I kept getting this error in my watchdog message when testing the MCP module:
Path: /mcp/post. Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException: The used authentication method is not allowed on this route. in Drupal\Core\EventSubscriber\AuthenticationSubscriber->onExceptionAccessDenied() (line 135 of /var/www/html/docroot/core/lib/Drupal/Core/EventSubscriber/AuthenticationSubscriber.php).
The error message could be improved by specifying which authentication method was involved. In this case, it was basic_auth. Knowing that would have saved me about an hour when debugging.
Proposed help text: The authentication method %name is not allowed on this route.
We could also consider specifying which authentication methods are allowed instead.
Remaining tasks
(Novice) Resolve comments on MR
Review change record
Issue fork drupal-3546804
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #2
dries commentedThis was spin off from #3546811: Authentication provider selection ignores route restrictions. More details and context in #3546811.
Comment #3
quietone commentedComment #6
ankitv18 commentedMoving into review.
Comment #7
znerol commentedI think it isn't necessary to use reflection in this case. Instead I suggest to following:
authentication_collectoras an additional dependency to theauthentication_subscribergetSortedProviders()and callapplies()on each of themComment #9
karimb commentedComment #10
oily commentedTriggered test-only test. Here is the output:
The test-only test should fail but it passes. Quick read of the test code cannot see anything wrong. Needs investigation.
Comment #11
smustgrave commentedLeft comments on the MR.
Comment #12
lostcarpark commentedThe Drupal Contribution Mentoring team is triaging issues for DrupalCon Vienna 2025, and we are reserving this issue for Mentored Contribution during the event.
After October 17, this issue returns to being open to all. Thanks!
I performed Novice Triage on this issue. I am leaving the Novice tag on this issue because I believe fixing the MR issue is good novice task.
Comment #13
jberghammer commentedI am working on this issue on DrupalCon Vienna with @till79, @manuel-ranzmeir, @michael.j.gleeson with @lostcarpark mentoring.
Comment #14
jberghammer commentedWe have converted the variables into properties of constructor promotion.
Comment #15
jberghammer commentedThis test-only pipeline is somehow succeeding: https://git.drupalcode.org/issue/drupal-3546804/-/jobs/6927680.
Comment #16
jberghammer commentedAdded declaration on a variable.
Comment #17
znerol commentedThank you. I left a comment in the merge request. There is also an unresolved suggestion by @smustgrave from a couple of weeks ago. That should be resolved as well.
Comment #18
lostcarpark commentedI believe @manuel-ranzmeir referenced in comment #13 is actually @ranzinator2000.
My lesson from this is to get everyone working on an issue to post their own comment, rather than get one person to type the usernames.
I have added the users to the Contribution record.
Comment #19
mradcliffeThis was great work at Vienna2025, everyone!.
I performed Novice Triage on this issue. I am leaving the Novice tag on this issue because I think that the issue needs a little bit more work based on the reviews. It would be a good issue for new contributors to clone an existing issue fork, modify it, and then also have another new contributor review the change.
The Drupal Contribution Mentoring team is triaging issues for DrupalCon Nara 2025, and we are reserving this issue for Mentored Contribution during the event.
After November 19, this issue returns to being open to all. Thanks!
Comment #20
awset commentedI will try to work on it as part DrupalCon Nara 2025.
Comment #21
rduterteHi, I believe @awset has addressed the feedback from the MR.
authenticationCollectoris now optional with aNULLdefault, includes the deprecation notice, and falls back to the container. TheRequestimport was added to support the typedRequest $requestparameter.Moving this to Needs Review.
Comment #22
znerol commentedLeft comments in the MR. Also it seems that the test run did not pass.
Comment #24
rakesh.regarComment #25
znerol commentedCan somebody please rebase the MR? The spell check job fails, and that happens sometimes if it is too far behind 11.x.
Comment #26
lostcarpark commentedRebased off 11.x. Tests seem to be passing again.
Comment #27
mradcliffeI updated the status to reflect the review by @znerol.
Comment #30
sj.suraj commentedAdded missing deprecation notice for $authenticationCollector as per #16 comment.
Moviing this for review
Comment #31
znerol commentedThe version number in the message seem off. Next major is Drupal 12 (not 11), and the current deprecation target is 11.4.
Also phpstan and phpcs tests are failing with a weird message. A rebase wouldn't hurt I guess.
Comment #32
lostcarpark commentedWhile this would be a good issue to work on during mentored contribution, if we hope to get it in 11.4, we need to get a move on.
I have rebased and updated the deprecation message.
One test failed, but it seems to be a common failure, and there's an issue open for it: #3593673: [random test failure] ConfigInstallProfileOverrideTest randomly fails.
Comment #33
lostcarpark commentedI have created a change record: https://www.drupal.org/node/3594314
I don't really know what I'm doing when it comes to change records, so hopefully someone can help make it contain what it needs to contain, but at least something exists.
Also made the suggested formatting correction.
All tests passed this time, confirming the fail on the previous attempt was a random issue not related to this change.
Comment #34
smustgrave commentedBelieve this one is good to go now.
Comment #35
quietone commentedThe format of the deprecation message needs to be adjusted. And while Here I also suggested a variable name change to something more description. Setting to needs work for the comments in the MR.
I don't see any discussion here, but why is a method that is being deprecated being converted to using property promotion. Why do the extra work?
Comment #36
quietone commentedAlso, the change record needs to be reviewed.
Comment #37
quietone commentedI checked with other committers about the conversion to property promotion and he pointed out that it is better to not do it because it is adding a nullable type hint. So, remove the property promotion.
Comment #39
samlewis commentedHi, I have checked MR !13267
The MR still changes core/core.services.yml, AuthenticationSubscriber.php, and the REST entity resource test base.
The new error message includes the authentication provider name.
A deprecation message is present for calling AuthenticationSubscriber::__construct() without $authenticationCollector.
The change record exists and is still marked Draft.
Comment #37 says to remove constructor property promotion, but the MR diff appears to use constructor property promotion for $authenticationProvider, $accountProxy, and nullable $authenticationCollector.
From comment 37 I have removed constructor property promotion from AuthenticationSubscriber::__construct() and added explicit class properties for $authenticationProvider, $accountProxy, and $authenticationCollector.
Comment #40
samlewis commentedI've created MR !1 on branch 3546804-remove-property-promotion.
This is a small follow-up to MR !13267 to addresses comment #37 only.