title: Symfony 3.2: Authenticate users through different properties
body: <p>I want to achieve the following:</p>
  
  <p>In my installation there are two bundles, ApiBundle and BackendBundle. Users are defined in BackendBundle, though I could put them in a UserBundle later.</p>
  
  <p>ApiBundle basically provides a controller with api methods like for example <code>getSomething()</code>.</p>
  
  <p>BackendBundle has the user entities, services and some views like a login form and a backend view. From the backend controller I would want to access certain api methods.</p>
  
  <p>Other api methods will be requested from outside. Api methods will be requested through curl.</p>
  
  <p>I would want to have different users for both purposes. The <code>User</code> class implements <code>UserInterface</code> and has properties like <code>$username</code>, <code>$password</code> and <code>$apiKey</code>.</p>
  
  <p>Now basically I want to provide an authentication method through login form with username and password, and another authentication method for api calls through curl from outside, that only will require the apiKey.</p>
  
  <p>In both cases, the authenticated user then should have access to different ressources.</p>
  
  <p>My security.yml so far looks like this:</p>
  
  <pre><code>providers:
      chain_provider:
          chain:
              providers: [db_username, db_apikey]
      db_username:
          entity:
              class: BackendBundle:User
              property: username
      db_apikey:
          entity:
              class: BackendBundle:User
              property: apiKey
  
  encoders:
      BackendBundle\Entity\User:
          algorithm: bcrypt
          cost: 12
  
  firewalls:
      dev:
          pattern: ^/(_(profiler|wdt)|css|images|js)/
          security: false
      main:
          anonymous: ~
          form_login:
              login_path: login
              check_path: login
              default_target_path: backend
              csrf_token_generator: security.csrf.token_manager
          logout:
              path:   /logout
              target: /login
          provider: chain_provider
  
  access_control:
      - { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
      - { path: ^/api, roles: ROLE_API }
      - { path: ^/backend, roles: ROLE_BACKEND } 
  </code></pre>
  
  <p><strong>Question 1:</strong> How can I achieve that users from the same entity can authenticate differently and access certain ressources? The desired behaviour is authentication with username/password OR only apikey.</p>
  
  <p><strong>Question 2:</strong> How can I achieve, that api methods return a json if the requester is not authenticated properly, instead of returning the view for the login form? Eg. I want to return something like <code>{ 'error': 'No access' }</code> instead of the html for the login form if someone requests <code>/api/getSomething</code> and of course I want to show the login form if someone requests <code>/backend/someroute</code>.</p>
  
  <p>Every help is very much appreciated! :)
  <hr>
  The symfony docs say:</p>
  
  <blockquote>
    <p>The main job of a firewall is to configure how your users will authenticate. Will they use a login form? HTTP basic authentication? An API token? All of the above?</p>
  </blockquote>
  
  <p>I think my question basically is, how can I have login form AND api token authentication at the same time.</p>
  
  <p>So maybe, I need something like this: <a href="http://symfony.com/doc/current/security/guard_authentication.html#frequently-asked-questions" rel="nofollow noreferrer">http://symfony.com/doc/current/security/guard_authentication.html#frequently-asked-questions</a></p>