Try making authenticator priority configurable

Author: scheb

app/config/packages/scheb_2fa.yaml

@@ -52,6 +52,8 @@ scheb_two_factor:
     security_tokens:
         - Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken
 
+    authenticator_priority: -50
+
     # A list of IP addresses, which will not trigger two-factor authentication
     ip_whitelist:
        - 127.0.0.2 # Used for testing

doc/configuration.rst

@@ -78,6 +78,9 @@ Bundle Configuration
            - Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken
            - Symfony\Component\Security\Http\Authenticator\Token\PostAuthenticationToken
 
+       # Priority of the TwoFactorAuthenticator within Symfony's firewall
+       authenticator_priority: 0
+
        # A list of IP addresses or netmasks, which will not trigger two-factor authentication.
        # Supports IPv4, IPv6 and IP subnet masks.
        ip_whitelist:

src/bundle/DependencyInjection/Configuration.php

@@ -55,6 +55,7 @@ public function getConfigTreeBuilder(): TreeBuilder
                     ->prototype('scalar')->end()
                 ->end()
                 ->scalarNode('ip_whitelist_provider')->defaultValue('scheb_two_factor.default_ip_whitelist_provider')->end()
+                ->scalarNode('authenticator_priority')->defaultValue(0)->end()
                 ->scalarNode('two_factor_token_factory')->defaultValue('scheb_two_factor.default_token_factory')->end()
                 ->scalarNode('two_factor_provider_decider')->defaultValue('scheb_two_factor.default_provider_decider')->end()
                 ->scalarNode('two_factor_condition')->defaultNull()->end()

src/bundle/DependencyInjection/Factory/Security/TwoFactorFactory.php

@@ -57,8 +57,10 @@ class TwoFactorFactory implements FirewallListenerFactoryInterface, Authenticato
     public const KERNEL_ACCESS_LISTENER_DEFINITION_ID = 'scheb_two_factor.security.access_listener';
     public const FORM_LISTENER_DEFINITION_ID = 'scheb_two_factor.security.form_listener';
 
-    public function __construct(private readonly TwoFactorServicesFactory $twoFactorServicesFactory)
-    {
+    public function __construct(
+        private readonly ContainerBuilder $container,
+        private readonly TwoFactorServicesFactory $twoFactorServicesFactory,
+    ) {
     }
 
     public function addConfiguration(NodeDefinition $builder): void
@@ -169,6 +171,6 @@ public function getKey(): string
 
     public function getPriority(): int
     {
-        return 0;
+        return $this->container->getParameter('scheb_two_factor.authenticator_priority');
     }
 }

src/bundle/DependencyInjection/SchebTwoFactorExtension.php

@@ -31,6 +31,7 @@ public function load(array $configs, ContainerBuilder $container): void
         $container->setParameter('scheb_two_factor.model_manager_name', $config['model_manager_name']);
         $container->setParameter('scheb_two_factor.security_tokens', $config['security_tokens']);
         $container->setParameter('scheb_two_factor.ip_whitelist', $config['ip_whitelist']);
+        $container->setParameter('scheb_two_factor.authenticator_priority', $config['authenticator_priority']);
 
         $loader = new Loader\PhpFileLoader($container, new FileLocator(__DIR__.'/../Resources/config'));
         $loader->load('security.php');

src/bundle/SchebTwoFactorBundle.php

@@ -30,7 +30,7 @@ public function build(ContainerBuilder $container): void
         $extension = $container->getExtension('security');
         assert($extension instanceof SecurityExtension);
 
-        $securityFactory = new TwoFactorFactory(new TwoFactorServicesFactory());
+        $securityFactory = new TwoFactorFactory($container, new TwoFactorServicesFactory());
         $extension->addAuthenticatorFactory($securityFactory);
     }
 }

tests/DependencyInjection/Factory/Security/TwoFactorFactoryTest.php

@@ -35,7 +35,7 @@ class TwoFactorFactoryTest extends TestCase
     public function setUp(): void
     {
         $this->servicesFactory = $this->createMock(TwoFactorServicesFactory::class);
-        $this->factory = new TwoFactorFactory($this->servicesFactory);
+        $this->factory = new TwoFactorFactory($this->servicesFactory, 0);
         $this->container = new ContainerBuilder();
         $this->container->setDefinition('scheb_two_factor.firewall_context', new Definition());
     }

tests/DependencyInjection/SchebTwoFactorExtensionTest.php

@@ -65,6 +65,7 @@ public function load_emptyConfig_setDefaultValues(): void
             'Symfony\Component\Security\Http\Authenticator\Token\PostAuthenticationToken',
         ], 'scheb_two_factor.security_tokens');
         $this->assertHasParameter([], 'scheb_two_factor.ip_whitelist');
+        $this->assertHasParameter(0, 'scheb_two_factor.authenticator_priority');
     }
 
     /**
@@ -100,6 +101,7 @@ public function load_fullConfig_setConfigValues(): void
         $this->assertHasParameter('/cookie-path', 'scheb_two_factor.trusted_device.cookie_path');
         $this->assertHasParameter(['Symfony\Component\Security\Core\Authentication\Token\SomeToken'], 'scheb_two_factor.security_tokens');
         $this->assertHasParameter(['127.0.0.1', '10.0.0.0/8', '192.168.0.0/16'], 'scheb_two_factor.ip_whitelist');
+        $this->assertHasParameter(-50, 'scheb_two_factor.authenticator_priority');
     }
 
     /**
@@ -649,6 +651,7 @@ private function getFullConfig(): array
     - 127.0.0.1
     - ['10.0.0.0/8', '192.168.0.0/16']
 ip_whitelist_provider: acme_test.ip_whitelist_provider
+authenticator_priority: -50
 two_factor_token_factory: acme_test.two_factor_token_factory
 two_factor_provider_decider: acme_test.two_factor_provider_decider
 two_factor_condition: acme_test.two_factor_condition

tests/SchebTwoFactorBundleTest.php

@@ -28,6 +28,13 @@ public function build_initializeBundle_addCompilerPass(): void
             $this->isInstanceOf(MailerCompilerPass::class),
         ];
 
+        // Expect parameter to be read
+        $containerBuilder
+            ->expects($this->any())
+            ->method('getParameter')
+            ->with('scheb_two_factor.authenticator_priority')
+            ->willReturn(0);
+
         // Expect compiler pass to be added
         $containerBuilder
             ->expects($this->exactly(count($compilerPasses)))