Does normal authentication occur before userSession.onBeforeLogin event? I'm trying to take advantage of the userSession.onBeforeLogin event to interrupt the normal Control Panel login (/admin/login) so that I can first authenticate the user against an LDAP server. However, in my testing it seems that Craft runs its own authentication prior to onBeforeLogin event.

class AdminAuthPlugin extends BasePlugin
{
    public function init()
    {
        parent::init();

        craft()-&gt;on('userSession.BeforeLogin', function (Event $event) {
            if (craft()-&gt;request-&gt;isCpRequest() == true) {
                $event-&gt;performAction = false;
                exit();
            }
        });
    }
}


Using the above example, attempting to log in with a known username (with correct password) who has access to the CP, UserSessionService throws an error--which I expect to see due to the exit(): "An unknown error occurred." However, if I try to log in with the same username and an invalid password, UserSessionService throws the standard error, "Invalid username or password", which indicates that onBeforeLogin has not been executed.

Am I correct to understand that the userSession.onBeforeLogin event indeed fires after the default authentication attempt?
The onBeforeLogin event is fired after the username/password is already authenticated, but before the actual authenticated session is started, which is why you're seeing the behavior you're seeing.

For the same reason that you wouldn't expect the onBeforeSaveEntry event to be fired before entry validation has occurred.

I believe to pull off what you're looking for, we'd need to add a new event... something like onBeforeAuthenticateUser.

Probably worth adding as a feature request.