I kept getting this error in my watchdog message when testing the MCP module:

Path: /mcp/post. Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException: The used authentication method is not allowed on this route. in Drupal\Core\EventSubscriber\AuthenticationSubscriber->onExceptionAccessDenied() (line 135 of /var/www/html/docroot/core/lib/Drupal/Core/EventSubscriber/AuthenticationSubscriber.php).

The error message could be improved by specifying which authentication method was involved. In this case, it was basic_auth. Knowing that would have saved me about an hour when debugging.

Proposed help text: The authentication method %name is not allowed on this route.

We could also consider specifying which authentication methods are allowed instead.

Remaining tasks

(Novice) Resolve comments on MR
Review change record

Issue fork drupal-3546804

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

dries created an issue. See original summary.

dries’s picture

This was spin off from #3546811: Authentication provider selection ignores route restrictions. More details and context in #3546811.

quietone’s picture

Version: 11.2.x-dev » 11.x-dev

ankitv18 made their first commit to this issue’s fork.

ankitv18’s picture

Status: Active » Needs review

Moving into review.

znerol’s picture

Status: Needs review » Needs work

I think it isn't necessary to use reflection in this case. Instead I suggest to following:

  • Add the authentication_collector as an additional dependency to the authentication_subscriber
  • Loop through getSortedProviders() and call applies() on each of them
  • Return the provider id of the first match

karimb made their first commit to this issue’s fork.

karimb’s picture

Status: Needs work » Needs review
oily’s picture

Triggered test-only test. Here is the output:

ℹ️ Changes from 8e34758f7c2e9febf07b7da207931d51b1f4b75a
core/core.services.yml
core/lib/Drupal/Core/EventSubscriber/AuthenticationSubscriber.php
core/modules/rest/tests/src/Functional/EntityResource/EntityResourceTestBase.php
If this list contains more files than what you changed, then you need to rebase your branch.
1️⃣ Reverting non test changes
grep: warning: * at start of expression
grep: warning: * at start of expression
↩️ Reverting core/core.services.yml
↩️ Reverting core/lib/Drupal/Core/EventSubscriber/AuthenticationSubscriber.php
grep: warning: * at start of expression
2️⃣ Running test changes for this branch
Exiting with EXIT_CODE=0

The test-only test should fail but it passes. Quick read of the test code cannot see anything wrong. Needs investigation.

smustgrave’s picture

Status: Needs review » Needs work

Left comments on the MR.

lostcarpark’s picture

Issue summary: View changes
Issue tags: +Vienna2025

The Drupal Contribution Mentoring team is triaging issues for DrupalCon Vienna 2025, and we are reserving this issue for Mentored Contribution during the event.

After October 17, this issue returns to being open to all. Thanks!

I performed Novice Triage on this issue. I am leaving the Novice tag on this issue because I believe fixing the MR issue is good novice task.

jberghammer’s picture

I am working on this issue on DrupalCon Vienna with @till79, @manuel-ranzmeir, @michael.j.gleeson with @lostcarpark mentoring.

jberghammer’s picture

Status: Needs work » Needs review

We have converted the variables into properties of constructor promotion.

jberghammer’s picture

This test-only pipeline is somehow succeeding: https://git.drupalcode.org/issue/drupal-3546804/-/jobs/6927680.

jberghammer’s picture

Added declaration on a variable.

znerol’s picture

Status: Needs review » Needs work

Thank you. I left a comment in the merge request. There is also an unresolved suggestion by @smustgrave from a couple of weeks ago. That should be resolved as well.

lostcarpark’s picture

I believe @manuel-ranzmeir referenced in comment #13 is actually @ranzinator2000.

My lesson from this is to get everyone working on an issue to post their own comment, rather than get one person to type the usernames.

I have added the users to the Contribution record.

mradcliffe’s picture

Issue tags: +Nara2025

This was great work at Vienna2025, everyone!.

I performed Novice Triage on this issue. I am leaving the Novice tag on this issue because I think that the issue needs a little bit more work based on the reviews. It would be a good issue for new contributors to clone an existing issue fork, modify it, and then also have another new contributor review the change.

The Drupal Contribution Mentoring team is triaging issues for DrupalCon Nara 2025, and we are reserving this issue for Mentored Contribution during the event.

After November 19, this issue returns to being open to all. Thanks!

awset’s picture

I will try to work on it as part DrupalCon Nara 2025.

rduterte’s picture

Status: Needs work » Needs review

Hi, I believe @awset has addressed the feedback from the MR.
authenticationCollector is now optional with a NULL default, includes the deprecation notice, and falls back to the container. The Request import was added to support the typed Request $request parameter.

Moving this to Needs Review.

znerol’s picture

Status: Needs review » Needs work

Left comments in the MR. Also it seems that the test run did not pass.

rakesh.regar made their first commit to this issue’s fork.

rakesh.regar’s picture

Status: Needs work » Needs review
znerol’s picture

Can somebody please rebase the MR? The spell check job fails, and that happens sometimes if it is too far behind 11.x.

lostcarpark’s picture

Rebased off 11.x. Tests seem to be passing again.

mradcliffe’s picture

Status: Needs review » Needs work

I updated the status to reflect the review by @znerol.

Please add a deprecation message here (no test needed, but the message should be added). See the other thread for pointers.

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.

sj.suraj made their first commit to this issue’s fork.

sj.suraj’s picture

Status: Needs work » Needs review

Added missing deprecation notice for $authenticationCollector as per #16 comment.
Moviing this for review

znerol’s picture

Status: Needs review » Needs work

The version number in the message seem off. Next major is Drupal 12 (not 11), and the current deprecation target is 11.4.

Also phpstan and phpcs tests are failing with a weird message. A rebase wouldn't hurt I guess.

lostcarpark’s picture

Status: Needs work » Needs review

While this would be a good issue to work on during mentored contribution, if we hope to get it in 11.4, we need to get a move on.

I have rebased and updated the deprecation message.

One test failed, but it seems to be a common failure, and there's an issue open for it: #3593673: [random test failure] ConfigInstallProfileOverrideTest randomly fails.

lostcarpark’s picture

I have created a change record: https://www.drupal.org/node/3594314

I don't really know what I'm doing when it comes to change records, so hopefully someone can help make it contain what it needs to contain, but at least something exists.

Also made the suggested formatting correction.

All tests passed this time, confirming the fail on the previous attempt was a random issue not related to this change.

smustgrave’s picture

Status: Needs review » Reviewed & tested by the community

Believe this one is good to go now.

quietone’s picture

Status: Reviewed & tested by the community » Needs work

The format of the deprecation message needs to be adjusted. And while Here I also suggested a variable name change to something more description. Setting to needs work for the comments in the MR.

I don't see any discussion here, but why is a method that is being deprecated being converted to using property promotion. Why do the extra work?

quietone’s picture

Issue summary: View changes

Also, the change record needs to be reviewed.

quietone’s picture

Issue summary: View changes

I checked with other committers about the conversion to property promotion and he pointed out that it is better to not do it because it is adding a nullable type hint. So, remove the property promotion.

samlewis made their first commit to this issue’s fork.

samlewis’s picture

Hi, I have checked MR !13267

The MR still changes core/core.services.yml, AuthenticationSubscriber.php, and the REST entity resource test base.
The new error message includes the authentication provider name.
A deprecation message is present for calling AuthenticationSubscriber::__construct() without $authenticationCollector.
The change record exists and is still marked Draft.

Comment #37 says to remove constructor property promotion, but the MR diff appears to use constructor property promotion for $authenticationProvider, $accountProxy, and nullable $authenticationCollector.

From comment 37 I have removed constructor property promotion from AuthenticationSubscriber::__construct() and added explicit class properties for $authenticationProvider, $accountProxy, and $authenticationCollector.

samlewis’s picture

I've created MR !1 on branch 3546804-remove-property-promotion.

This is a small follow-up to MR !13267 to addresses comment #37 only.