class AuthenticationSubscriber

class AuthenticationSubscriber implements EventSubscriberInterface {

  /**
   * Authentication provider.
   *
   * @var \Drupal\Core\Authentication\AuthenticationProviderInterface
   */
  protected $authenticationProvider;

  /**
   * Authentication provider filter.
   *
   * @var \Drupal\Core\Authentication\AuthenticationProviderFilterInterface|null
   */
  protected $filter;

  /**
   * Authentication challenge provider.
   *
   * @var \Drupal\Core\Authentication\AuthenticationProviderChallengeInterface|null
   */
  protected $challengeProvider;

  /**
   * Account proxy.
   *
   * @var \Drupal\Core\Session\AccountProxyInterface
   */
  protected $accountProxy;

  /**
   * Constructs an authentication subscriber.
   *
   * @param \Drupal\Core\Authentication\AuthenticationProviderInterface $authentication_provider
   *   An authentication provider.
   * @param \Drupal\Core\Session\AccountProxyInterface $account_proxy
   *   Account proxy.
   */
  public function __construct(AuthenticationProviderInterface $authentication_provider, AccountProxyInterface $account_proxy) {
    $this->authenticationProvider = $authentication_provider;
    $this->filter = $authentication_provider instanceof AuthenticationProviderFilterInterface ? $authentication_provider : NULL;
    $this->challengeProvider = $authentication_provider instanceof AuthenticationProviderChallengeInterface ? $authentication_provider : NULL;
    $this->accountProxy = $account_proxy;
  }

  /**
   * Authenticates user on request.
   *
   * @param \Symfony\Component\HttpKernel\Event\RequestEvent $event
   *   The request event.
   *
   * @see \Drupal\Core\Authentication\AuthenticationProviderInterface::authenticate()
   */
  public function onKernelRequestAuthenticate(RequestEvent $event) {
    if ($event
      ->isMainRequest()) {
      $request = $event
        ->getRequest();
      if ($this->authenticationProvider
        ->applies($request)) {
        $account = $this->authenticationProvider
          ->authenticate($request);
        if ($account) {
          $this->accountProxy
            ->setAccount($account);
          return;
        }
      }
    }
  }

  /**
   * Denies access if authentication provider is not allowed on this route.
   *
   * @param \Symfony\Component\HttpKernel\Event\RequestEvent $event
   *   The request event.
   */
  public function onKernelRequestFilterProvider(RequestEvent $event) {
    if (isset($this->filter) && $event
      ->isMainRequest()) {
      $request = $event
        ->getRequest();
      if ($this->authenticationProvider
        ->applies($request) && !$this->filter
        ->appliesToRoutedRequest($request, TRUE)) {
        throw new AccessDeniedHttpException('The used authentication method is not allowed on this route.');
      }
    }
  }

  /**
   * Respond with a challenge on access denied exceptions if appropriate.
   *
   * On a 403 (access denied), if there are no credentials on the request, some
   * authentication methods (e.g. basic auth) require that a challenge is sent
   * to the client.
   *
   * @param \Symfony\Component\HttpKernel\Event\ExceptionEvent $event
   *   The exception event.
   */
  public function onExceptionSendChallenge(ExceptionEvent $event) {
    if (isset($this->challengeProvider) && $event
      ->isMainRequest()) {
      $request = $event
        ->getRequest();
      $exception = $event
        ->getThrowable();
      if ($exception instanceof AccessDeniedHttpException && !$this->authenticationProvider
        ->applies($request) && (!isset($this->filter) || $this->filter
        ->appliesToRoutedRequest($request, FALSE))) {
        $challenge_exception = $this->challengeProvider
          ->challengeException($request, $exception);
        if ($challenge_exception) {
          $event
            ->setThrowable($challenge_exception);
        }
      }
    }
  }

  /**
   * Detect disallowed authentication methods on access denied exceptions.
   *
   * @param \Symfony\Component\HttpKernel\Event\ExceptionEvent $event
   *   The event.
   */
  public function onExceptionAccessDenied(ExceptionEvent $event) {
    if (isset($this->filter) && $event
      ->isMainRequest()) {
      $request = $event
        ->getRequest();
      $exception = $event
        ->getThrowable();
      if ($exception instanceof AccessDeniedHttpException && $this->authenticationProvider
        ->applies($request) && !$this->filter
        ->appliesToRoutedRequest($request, TRUE)) {
        $event
          ->setThrowable(new AccessDeniedHttpException('The used authentication method is not allowed on this route.', $exception));
      }
    }
  }

  /**
   * {@inheritdoc}
   */
  public static function getSubscribedEvents() : array {

    // The priority for authentication must be higher than the highest event
    // subscriber accessing the current user. Especially it must be higher than
    // LanguageRequestSubscriber as LanguageManager accesses the current user if
    // the language module is enabled.
    $events[KernelEvents::REQUEST][] = [
      'onKernelRequestAuthenticate',
      300,
    ];

    // Access check must be performed after routing.
    $events[KernelEvents::REQUEST][] = [
      'onKernelRequestFilterProvider',
      31,
    ];
    $events[KernelEvents::EXCEPTION][] = [
      'onExceptionSendChallenge',
      75,
    ];
    $events[KernelEvents::EXCEPTION][] = [
      'onExceptionAccessDenied',
      80,
    ];
    return $events;
  }

}