CAS SSO与Silex guard authfailure处理程序

I have implemented jasig/phpCas authentication in My Silex App. It is almost done, but I can't Handle authfailure Response correclty.

$app['app.token_authenticator'] = function ($app) {
return new MyApp\Domain\MyTokenAuthenticator($app['security.encoder_factory'],$app['cas'],$app['dao.usersso']);
};

$app['security.firewalls'] = array(
    'default' => array(
            'pattern' => '^/.*$',
            'anonymous' => true,

            'guard' => array(
                    'authenticators' => array(
                            'app.token_authenticator'
                    ),
            ),
            'logout' => array ( 'logout_path' => '/logout', 'target_url' => '/goodbye' ),
            'form' => array('login_path' =>'/login', 'check_path' =>'/admin/login_check', 'authenticator' => 'time_authenticator' ),
            'users' => function () use ($app) {
                return new MyApp\DAO\UserDAO($app['db']);
            },
    ),
);

MyTokenAuthenticator class :

class MyTokenAuthenticator extends AbstractGuardAuthenticator
{
    private $encoderFactory;
    private $cas_settings;
    private $sso_dao;

    public function __construct(EncoderFactoryInterface $encoderFactory, $cas_settings, MyApp\DAO\UserSsoDAO $userdao)
{
    $this->encoderFactory = $encoderFactory;
    $this->cas_settings = $cas_settings;
    $this->sso_dao = $userdao;
}

public function getCredentials(Request $request)
{
    $bSSO = false;

    //Test request for sso
    if ( strpos($request->get("ticket"),"cas-intra") !==false )
        $bSSO = true;
    if($request->get("sso") == "1")
        $bSSO=true;

    if ($bSSO)
    {
        if ($this->cas_settings['debug'])
        {
            \CAS_phpCAS::setDebug();
            \CAS_phpCAS::setVerbose(true);
        }

        \CAS_phpCAS::client(CAS_VERSION_2_0,
                $this->cas_settings['server'],
                $this->cas_settings['port'],
                $this->cas_settings['context'],
                false); 

        \CAS_phpCAS::setCasServerCACert('../app/config/cas.pem');
        // force CAS authentication
        \CAS_phpCAS::forceAuthentication();
        $username = \CAS_phpCAS::getUser();
        return array ( 
                'username' => $username,
                'secret' => 'SSO'
        );
    }

    //Nothing to do, skip custom auth
    return;
}

/**
 * Get User from the SSO database.
 * Add it into the MyApp users database (Update if already exists)
 * {@inheritDoc}
 * @see \Symfony\Component\Security\Guard\GuardAuthenticatorInterface::getUser()
 */
public function getUser($credentials, UserProviderInterface $userProvider)
{
    //Get user stuf
    ....
    //return $userProvider->loadUserByUsername($credentials['username']);
    return $user;
}

/**
 * 
 * {@inheritDoc}
 * @see \Symfony\Component\Security\Guard\GuardAuthenticatorInterface::checkCredentials()
 */
public function checkCredentials($credentials, UserInterface $user)
{
    // check credentials - e.g. make sure the password is valid
    // return true to cause authentication success

    if ( $this->sso_dao->isBAllowed($user->getLogin() ) )
        return true;
    else 
        throw new CustomUserMessageAuthenticationException("Sorry, you're not alllowed tu use this app.");
}

public function onAuthenticationSuccess(Request $request, TokenInterface $token, $providerKey)
{
    // on success, let the request continue
    return;
}

public function onAuthenticationFailure(Request $request, AuthenticationException $exception)
{
    $data = array(
            'message' => strtr($exception->getMessageKey(), $exception->getMessageData()),

            // or to translate this message
            // $this->translator->trans($exception->getMessageKey(), $exception->getMessageData())
    );

    return new JsonResponse($data,403);

}

Issue is when a valid user from SSO is denied in app. It displays a page with json Message, without any rendering. My workaround is to use minimal html page with sso logout link as response and session_destroy(), but its quick and dirty fix.

I'd like a redenring via twig with a nice error message. Maybe some other class to extend ? Silex's Documentation was no help. Thank you !

Back to this question as I was on others apsects of the dev. @mTorres solution is working. I had to store whole app object via constructor as twig is not set at this time in service registry.

class MyTokenAuthenticator extends AbstractGuardAuthenticator
{
    private $app;

   public function __construct($app)
   {
        $this->app=$app;
   }

then custom event

public function onAuthenticationFailure(Request $request, AuthenticationException $exception)
{
   return new \Symfony\Component\HttpFoundation\Response(
            $this->app['twig']->render( 'logout.html.twig',array(
                'error'         => $data,
            ));
}

Many thanks !