This is needed to allow dependency injection in that class. Since the first parameter of the constructor is the ID of the auth source to use, we don't know the value it must take during compilation of the container. We only know what auth source to use when we are in the controller, becase at that point the URL as been parsed and the auth source ID has been passed to the controller as an argument. Therefore, we need to add this factory class as a service to the container, and once we have the auth source ID, we can call the create() method of the factory to obtain a relevant instance of \SimpleSAML\Auth\Simple.