Fixed in #13155.

I disagree with closing this as fixed, as the feature itself is not documented yet. Furthermore, I think we should also add the new AbstractListener with the support() method logic, in case someone implemented a custom authentication provider/listener and wants to support lazy firewalls.

@javiereguiluz We have number of support issues about what anonymous: lazy means, I would expect the fix to give an explanation about it

edit: missed the comment from @wouterj

You are right. I'm sorry I closed this one too quickly.

I've opened #13171, let me know if we need to be more exhaustive or other places it should be mentioned. Thanks