<p dir="auto">Using the latest release, using the SimplePreAuthenticatorInterface as per the docs, results in errors.</p>
<p dir="auto">Issuing a return null, rather than a return new PreAuthenticatedToken, in createToken() results in a Fatal Error since the AuthenticationProviderManager::authenticate() is expecting a TokenInterface instance. The docs say we can return (filtering URL section) when authentication is not required. Throwing an exception is the only means to exit the method, but, I don't know what others think, using an Exception for this conveys the wrong intention. Also, when used in conjunction with AuthenticationFailureHandlerInterface, throwing an Exception causes the onAuthenticationFailure() method to be called.</p>
<p dir="auto">In my instance, I'm using it to validate a captch (among other things) on the login screen. I was previously extending UsernamePasswordFormAuthenticationListener to do this, which will cause problems if any other bundle tries to extend the same class. I obviously don't want the captcha to be validated on every page.</p>
<p dir="auto">What would be the correct Exception to throw from createToken() when we simply don't want to authorize?</p>
<p dir="auto">Symfony cookbook entry for <a href="http://symfony.com/doc/current/cookbook/security/api_key_authentication.html" rel="nofollow">Api Key Authentication </a> states that you can return <code class="notranslate">null</code> from <code class="notranslate">SimplePreAuthenticatorInterface::createToken</code>. If you don't want to authenticate at certain url:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="public function createToken(Request $request, $providerKey)
{
    // set the only URL where we should look for auth information
    // and only return the token if we're at that URL
    $targetUrl = '/login/check';
    if (!$this-&gt;httpUtils-&gt;checkRequestPath($request, $targetUrl)) {
        return;
    }

    // ...
}"><pre class="notranslate"><code class="notranslate">public function createToken(Request $request, $providerKey)
{
    // set the only URL where we should look for auth information
    // and only return the token if we're at that URL
    $targetUrl = '/login/check';
    if (!$this-&gt;httpUtils-&gt;checkRequestPath($request, $targetUrl)) {
        return;
    }

    // ...
}
</code></pre></div>
<p dir="auto">However, when I did it, I got the following error:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="Catchable Fatal Error: Argument 1 passed to Symfony\Component\Security\Core\Authentication\AuthenticationProviderManager::authenticate() must be an instance of Symfony\Component\Security\Core\Authentication\Token\TokenInterface, null given"><pre class="notranslate"><code class="notranslate">Catchable Fatal Error: Argument 1 passed to Symfony\Component\Security\Core\Authentication\AuthenticationProviderManager::authenticate() must be an instance of Symfony\Component\Security\Core\Authentication\Token\TokenInterface, null given
</code></pre></div>
<p dir="auto"><code class="notranslate">createToken</code> method is called from <code class="notranslate">SimplePreAuthenticationListener</code> and when I examined it, this looked like the part that is problematic:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="$token = $this-&gt;simpleAuthenticator-&gt;createToken($request, $this-&gt;providerKey);
$token = $this-&gt;authenticationManager-&gt;authenticate($token);"><pre class="notranslate"><code class="notranslate">$token = $this-&gt;simpleAuthenticator-&gt;createToken($request, $this-&gt;providerKey);
$token = $this-&gt;authenticationManager-&gt;authenticate($token);
</code></pre></div>
<p dir="auto">So when <code class="notranslate">SimpleAuthenticator</code> returns <code class="notranslate">null</code>, it passes that <code class="notranslate">null</code> to <code class="notranslate">AuthenticationManager::authenticate</code> which doesn't accept nulls:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="interface AuthenticationManagerInterface
{
    public function authenticate(TokenInterface $token);
}"><pre class="notranslate"><code class="notranslate">interface AuthenticationManagerInterface
{
    public function authenticate(TokenInterface $token);
}
</code></pre></div>