title: Symfony 2.6 authentication with third party cookie or login form
body: <p>I'm struggling with the security components of symfony. I want to achieve an authentication, based on a third party cookie and/or a traditional login form.
  A little more in detail:
  First of all the application should check if the user has a cookie from an other application in our environment. In this case the app recognizes the cookie,
  validates it against an external api and the user is authenticated, if the session in the external api is valid. If it is not valid or the user has not such cookie the application forwards the request to the normal login form.
  I already tried a lot ways to implement this behaviour, beginning with a custom login form authentication provider, through custom listeners, etc.</p>
  
  <p>Currently I'm trying it with two separated security factories. One implements SecurityFactoryInterface with custom listener and provider and the other one
  extends FormLoginFactory with a custom provider and the default listener.</p>
  
  <p>Here some sample code from the current state:</p>
  
  <p>CustomCookieSecurityFactory.php</p>
  
  <pre><code>class CustomCookieSecurityFactory implements SecurityFactoryInterface
  {
    public function create(ContainerBuilder $container, $id, $config, $userProvider, $defaultEntryPoint)
    {
      $providerId = 'security.authentication.provider.custom.cookie.'.$id;
      $container
          -&gt;setDefinition($providerId, new DefinitionDecorator('security.authentication.provider.custom.cookie'))
          -&gt;replaceArgument(0, new Reference($userProvider))
      ;
  
      $listenerId = 'security.authentication.listener.custom.cookie.'.$id;
      $listener = $container-&gt;setDefinition($listenerId, new DefinitionDecorator('security.authentication.listener.custom.cookie'));
  
      return array($providerId, $listenerId, $defaultEntryPoint);
    }
  
    public function getPosition()
    {
      return 'pre_auth';
    }
  
    public function getKey() {
      return 'custom_cookie';
    }
  }  
  </code></pre>
  
  <p>CustomFormLoginSecurityFactory </p>
  
  <pre><code>class CustomFormLoginSecurityFactory extends FormLoginFactory
  {
    public function getKey()
    {
      return 'custom_form_login';
    }
  
    /**
     * Create custom provider.
     *
     */
    protected function createAuthProvider(ContainerBuilder $container, $id, $config, $userProviderId)
    {
      $provider = 'security.authentication.provider.custom.form.'.$id;
      $container
      -&gt;setDefinition($provider, new DefinitionDecorator('security.authentication.provider.custom.form'))
      -&gt;replaceArgument(0, new Reference($userProviderId))
      -&gt;replaceArgument(2, $id)
      ;
  
      return $provider;
    }
  }
  </code></pre>
  
  <p>service.yml</p>
  
  <pre><code>security.authentication.listener.custom.cookie:
      class: AppBundle\Security\Http\Firewall\CustomCookieAuthenticationListener
      arguments: ["@security.token_storage", "@security.authentication.manager", "@service_container", "@logger"]
  
  security.authentication.provider.custom.cookie:
      class: AppBundle\Security\Authentication\Provider\CustomCookieAuthenticationProvider
      arguments: ["", "@logger"]
  
  security.authentication.provider.custom.form:
      class: AppBundle\Security\Authentication\Provider\CustomFormLoginAuthenticationProvider
      arguments: ["", "@security.user_checker", "", "@security.encoder_factory", true, "@logger", "@custom_router", "@doctrine.orm.entity_manager", "@request_stack"]
  </code></pre>
  
  <p>security.yml</p>
  
  <pre><code>firewalls:
      dev:
          pattern: ^/(_(profiler|wdt|error)|css|images|js)/
          security: false
  
      secured_area:
          anonymous: ~
          custom_cookie: ~
          custom_form_login:
              provider: custom_user
              login_path: /login
              check_path: /login-check
              username_parameter: form[username]
              password_parameter: form[password]
          logout:
              path:   /logout
              target: /
  </code></pre>
  
  <p>My main problem is, if the cookie based authentication does not work, the second type of authentication is not invoked. Maybe I'm on the completely wrong way or have just not configured my firewall correctly.</p>
  
  <p>Would be good to have some help from someone knowing good symfony's security components.</p>