Merge branch '2.8' into 3.4

* 2.8:
  [Security] guardAuthenticationProvider::authenticate cannot return null according to interface specification
  [VarDumper] Remove decoration from actual output in tests
  [PropertyInfo] Minor cleanup and perf improvement
  [Bridge/Doctrine] fix count() notice on PHP 7.2
  [Security] Skip user checks if not implementing UserInterface
  [HttpFoundation] Add HTTP_EARLY_HINTS const
  [DoctrineBridge] Improve exception message at `IdReader::getIdValue()`
  fixed CS
  Use new PHP7.2 functions in hasColorSupport
  [VarDumper] Fix dumping of SplObjectStorage
  Fixed being logged out on failed attempt in guard

Author: nicolas-grekas

Authentication/Provider/SimpleAuthenticationProvider.php

@@ -54,7 +54,7 @@ public function authenticate(TokenInterface $token)
                 $user = $this->userProvider->loadUserByUsername($user);
 
                 if (!$user instanceof UserInterface) {
-                    throw new AuthenticationServiceException('The user provider must return a UserInterface object.');
+                    return $authToken;
                 }
             } catch (UsernameNotFoundException $e) {
                 $e->setUsername($user);

Tests/Authentication/Provider/SimpleAuthenticationProviderTest.php

@@ -12,10 +12,11 @@
 namespace Symfony\Component\Security\Core\Tests\Authentication\Provider;
 
 use PHPUnit\Framework\TestCase;
-use Symfony\Component\Security\Core\Exception\DisabledException;
 use Symfony\Component\Security\Core\Authentication\Provider\SimpleAuthenticationProvider;
+use Symfony\Component\Security\Core\Exception\DisabledException;
 use Symfony\Component\Security\Core\Exception\LockedException;
 use Symfony\Component\Security\Core\Exception\UsernameNotFoundException;
+use Symfony\Component\Security\Core\User\UserChecker;
 
 class SimpleAuthenticationProviderTest extends TestCase
 {
@@ -121,6 +122,20 @@ public function testUsernameNotFound()
         $this->getProvider($authenticator, $userProvider)->authenticate($token);
     }
 
+    public function testAuthenticateSkipsUserChecksForNonUserInterfaceObjects()
+    {
+        $token = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\Token\TokenInterface')->getMock();
+        $token->expects($this->any())
+            ->method('getUser')
+            ->will($this->returnValue('string-user'));
+        $authenticator = $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\SimpleAuthenticatorInterface')->getMock();
+        $authenticator->expects($this->once())
+            ->method('authenticateToken')
+            ->will($this->returnValue($token));
+
+        $this->assertSame($token, $this->getProvider($authenticator, null, new UserChecker())->authenticate($token));
+    }
+
     protected function getProvider($simpleAuthenticator = null, $userProvider = null, $userChecker = null, $key = 'test')
     {
         if (null === $userChecker) {