private boolean shouldDeferToJwtSso ( HttpServletRequest req , MicroProfileJwtConfig config , MicroProfileJwtConfig jwtssoConfig ) { if ( ( ! isJwtSsoFeatureActive ( config ) ) && ( jwtssoConfig == null ) ) { return false ; } String hdrValue = req . getHeader ( Authorization_Header ) ; if ( tc . isDebugEnabled ( ) ) { Tr . debug ( tc , "Authorization header=" , hdrValue ) ; } boolean haveValidBearerHeader = ( hdrValue != null && hdrValue . startsWith ( "Bearer " ) ) ; return ! haveValidBearerHeader ; }
if we don t have a valid bearer header and jwtsso is active we should defer .