Question: I have a Symfony application, which I want to access via both login and OAuth client credential authentication, using the same routes.

I have achieved this with the following firewall setup:

```
firewalls:
    # disables authentication for assets and the profiler, adapt it according to your needs
    dev:
        pattern: ^/(_(profiler|wdt)|css|images|js)/
        security: false

    oauth:
        pattern: ^/
        stateless: true
        simple_preauth:
            authenticator: AppBundle\Security\AccessTokenAuthenticator
        provider: access_token_user_provider

    main:
        anonymous: ~
        # activate different ways to authenticate

        # https://symfony.com/doc/current/security.html#a-configuring-how-your-users-will-authenticate
        http_basic: ~

        provider: chain_provider
        # https://symfony.com/doc/current/security/form_login_setup.html
        form_login:
            login_path: login
            check_path: login
            csrf_token_generator: security.csrf.token_manager
            #failure_path: login_failure

        logout:
            path:   /logout
            invalidate_session: true

access_control:
    - { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/site/signup, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/site/get_token, roles: IS_AUTHENTICATED_ANONYMOUSLY }
    - { path: ^/, roles: [ROLE_CUSTOMER, ROLE_PARTNER] }

```

However when I do this, all anonymous routes at the bottom are now checked with the AccessTokenAuthenticator as well and don't work anymore.

Do I need to manually exclude them like the profiler routes or is there a better way to handle them all through the access\_control: entries?

Answer: 
I think the order of the rules in the security file may be different. Would you say that way.

```
firewalls:
    # disables authentication for assets and the profiler, adapt it according to your needs
dev:
    pattern: ^/(_(profiler|wdt)|css|images|js)/
    security: false

# First Main Firewall
main:
    anonymous: ~
    # activate different ways to authenticate

    # https://symfony.com/doc/current/security.html#a-configuring-how-your-users-will-authenticate
    http_basic: ~

    provider: chain_provider
    # https://symfony.com/doc/current/security/form_login_setup.html
    form_login:
        login_path: login
        check_path: login
        csrf_token_generator: security.csrf.token_manager
        #failure_path: login_failure

    logout:
        path:   /logout
        invalidate_session: true

# Second Oauth Firewall
oauth:
    pattern: ^/
    stateless: true
    simple_preauth:
        authenticator: AppBundle\Security\AccessTokenAuthenticator
    provider: access_token_user_provider

```
I solved this by using multiple authentication providers in the same firewall:

```
firewalls:
    # disables authentication for assets and the profiler, adapt it according to your needs
    dev:
        pattern: ^/(_(profiler|wdt)|css|images|js)/
        security: false
    main:
        anonymous: ~
        # activate different ways to authenticate

        # https://symfony.com/doc/current/security.html#a-configuring-how-your-users-will-authenticate
        http_basic: ~

        provider: chain_provider
        # https://symfony.com/doc/current/security/form_login_setup.html
        simple_preauth:
            authenticator: AppBundle\Security\AccessTokenAuthenticator
            provider: access_token_user_provider
        form_login:
            login_path: login
            check_path: login
            csrf_token_generator: security.csrf.token_manager
            #failure_path: login_failure

        logout:
            path:   /logout
            invalidate_session: true

```