Drupal UserLoginForm vs UserAuthenticationController login function - which to override?

Question

I have a drupal site where I am customizing the login by validating credentials against an OAuth2 provider, implementing the OAuth2 password flow, basically what this module does, except I am using D8 and this is for D7

https://www.drupal.org/project/oauth2_authentication

I upgraded that module to D8. It works by adding a replacing the validateAuthentication function in the #validate array of the form with an implementation that validates against the external OAuth provider. I upgraded all that to D8, but then I noticed in D8 that the login method of the UserAuthenticationController is also called to validate credentials.

So I have a couple questions

1. These two things both do basically the same thing. Both pieces of code (UserLoginForm and UserAuthenticationController) validate against the user table in the DB. Why are both doing essentially the same thing? Are they both actually being called?
2. I realize it would be a cleaner implementation (and more Drupal 8-like) to override the UserAuthenticationController. If my module registers the /user/login route to a different controller (provided by my module) will this override the default mapping to the UserAuthenticationController?

Thanks in advance. I am new to drupal so any help would be appreciated.

Answer 1

UserAuthenticationController is a service that can be used by e.g. apps and decoupled websites.

Either one or the other is used, not both.

But both use the user.auth service, which receives username and password and returns a user ID in case of a match.

So if you want to override a single place to do that, that's what you want to do. Implement a service provider in your module and switch out the class of that service definition.