API token used as user identifier in custom authenticator example

[ihmels]

In the example for a custom authenticator, the API key is passed to the UserBadge as the user identifier. However, it cannot be assumed that the API key is the same as the user identifier. Doesn't the user identifier have to be determined from the API token and then passed to the UserBadge?

symfony-docs/security/authenticator_manager.rst

Lines 318 to 328 in 15084a8

	public function authenticate(Request $request): Passport
	{
	$apiToken = $request->headers->get('X-AUTH-TOKEN');
	if (null === $apiToken) {
	// The token header was empty, authentication fails with HTTP Status
	// Code 401 "Unauthorized"
	throw new CustomUserMessageAuthenticationException('No API token provided');
	}
	return new SelfValidatingPassport(new UserBadge($apiToken));
	}

[javiereguiluz]

Closing in favor of #15908, a meta-issue that groups all pending security-related issues so we can easily check them.

[javiereguiluz]

Fixed in #18928.