bug symfony#59342 [SecurityBundle] Do not pass traceable authenticators to security.helper (MatTheCat)

This PR was merged into the 7.2 branch.

Discussion
----------

[SecurityBundle] Do not pass traceable authenticators to `security.helper`

| Q             | A
| ------------- | ---
| Branch?       | 7.2
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | no
| Issues        | Fix symfony#59341
| License       | MIT

Since symfony#59278 authenticators are no longer aliases for their traceable version, which means calling `Security::login` with an authenticator ID won’t match its traceable ID, and fail.

Plus, `Security::login` using the traceable authenticators meant the profiler could show them as successful while not supporting the request:

![](https://github.com/user-attachments/assets/dc36ff28-93ba-4adf-ba16-9ed7742f3fd4)

This PR fixes these issues by passing the original authenticators to `security.helper`, using their ID as name.

Commits
-------

c5a2360 [SecurityBundle] Do not pass traceable authenticators to `security.helper`

Author: fabpot

src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php

@@ -313,8 +313,8 @@ private function createFirewalls(array $config, ContainerBuilder $container): vo
                 $authenticators[$name] = null;
             } else {
                 $firewallAuthenticatorRefs = [];
-                foreach ($firewallAuthenticators as $authenticatorId) {
-                    $firewallAuthenticatorRefs[$authenticatorId] = new Reference($authenticatorId);
+                foreach ($firewallAuthenticators as $originalAuthenticatorId => $managerAuthenticatorId) {
+                    $firewallAuthenticatorRefs[$originalAuthenticatorId] = new Reference($originalAuthenticatorId);
                 }
                 $authenticators[$name] = ServiceLocatorTagPass::register($container, $firewallAuthenticatorRefs);
             }
@@ -501,7 +501,7 @@ private function createFirewall(ContainerBuilder $container, string $id, array $
         $configuredEntryPoint = $defaultEntryPoint;
 
         // authenticator manager
-        $authenticators = array_map(fn ($id) => new Reference($id), $firewallAuthenticationProviders);
+        $authenticators = array_map(fn ($id) => new Reference($id), $firewallAuthenticationProviders, []);
         $container
             ->setDefinition($managerId = 'security.authenticator.manager.'.$id, new ChildDefinition('security.authenticator.manager'))
             ->replaceArgument(0, $authenticators)
@@ -625,11 +625,11 @@ private function createAuthenticationListeners(ContainerBuilder $container, stri
                 $authenticators = $factory->createAuthenticator($container, $id, $firewall[$key], $userProvider);
                 if (\is_array($authenticators)) {
                     foreach ($authenticators as $authenticator) {
-                        $authenticationProviders[] = $authenticator;
+                        $authenticationProviders[$authenticator] = $authenticator;
                         $entryPoints[] = $authenticator;
                     }
                 } else {
-                    $authenticationProviders[] = $authenticators;
+                    $authenticationProviders[$authenticators] = $authenticators;
                     $entryPoints[$key] = $authenticators;
                 }
 

src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/SecurityExtensionTest.php

@@ -924,6 +924,10 @@ public function testAuthenticatorsDecoration()
         $this->assertSame('debug.'.TestAuthenticator::class, (string) reset($managerAuthenticators), 'AuthenticatorManager must be injected traceable authenticators in debug mode.');
 
         $this->assertTrue($container->hasDefinition(TestAuthenticator::class), 'Original authenticator must still exist in the container so it can be used outside of the AuthenticatorManager’s context.');
+
+        $securityHelperAuthenticatorLocator = $container->getDefinition($container->getDefinition('security.helper')->getArgument(1)['main']);
+        $this->assertArrayHasKey(TestAuthenticator::class, $authenticatorMap = $securityHelperAuthenticatorLocator->getArgument(0), 'When programmatically authenticating a user, authenticators’ name must be their original ID.');
+        $this->assertSame(TestAuthenticator::class, (string) $authenticatorMap[TestAuthenticator::class]->getValues()[0], 'When programmatically authenticating a user, original authenticators must be used.');
     }
 
     protected function getRawContainer()