So in your case this returns an empty string? $user = $authToken->getUser();

It is needed to find way how to handle public token when we have anonymous user.

There's a different authenticator for anonymous users: anonymous: ~ in your firewall. You should most likely not be creating an anonymous user manually.

Hi, even if I add anonymous: ~ in my firewall, still SimpleAuthenticationProvider is called and there it breaks.

What about an early return if $token instanceof AnonymousToken to restaure the previous behavior?

This one if (empty($user)) { return $authToken; }
will resolve my problem. I do not know is the best solution ??

Are you creating the AnonymousToken object in your code? Unless I'm mistaken $user should be anon. here. Anyway I don't think we want to return for any empty user, only anonymous ones.

See also

You are right. I agree with you :D

What about an early return if $token instanceof AnonymousToken to restaure the previous behavior?

Be aware that this is not necessarily correct. At least for the AuthenticationTrustResolver, the token class that is supposed to be considered anonymous can be configured: https://github.com/symfony/symfony/blob/master/src/Symfony/Bundle/SecurityBundle/Resources/config/security.xml#L8

Parameters are not an extension point you should rely on. Previously all parameter based class names for services were removed. I'm not sure why this one still exists, because it's extremely fragile to make a token like this. I didn't find any documentation on this either.

I totally agree, just saying you can configure the ToBeConsideredAnonymousToken in the trust resolver, so just assuming AnonymousToken is the one to look for is not necessarily true 😉

Same issue here, breaking on version 2.8.38. Similar scenario with 'anon.' user token from a custom authenticator.

I'm trying to understand the AnonymousToken + UsernameNotFoundException thing, but can't really get it working just with changes on my Authenticator and Provider... am I missing something?

See #27044