public WebAuthenticator getWebAuthenticator ( WebRequest webRequest ) { String authMech = webAppSecurityConfig . getOverrideHttpAuthMethod ( ) ; if ( authMech != null && authMech . equals ( "CLIENT_CERT" ) ) { return createCertificateLoginAuthenticator ( ) ; } SecurityMetadata securityMetadata = webRequest . getSecurityMetadata ( ) ; LoginConfiguration loginConfig = securityMetadata . getLoginConfiguration ( ) ; if ( loginConfig != null ) { String authenticationMethod = loginConfig . getAuthenticationMethod ( ) ; if ( LoginConfiguration . FORM . equalsIgnoreCase ( authenticationMethod ) ) { return createFormLoginAuthenticator ( webRequest ) ; } else if ( LoginConfiguration . CLIENT_CERT . equalsIgnoreCase ( authenticationMethod ) ) { return createCertificateLoginAuthenticator ( ) ; } } return getBasicAuthAuthenticator ( ) ; }
Determine the correct WebAuthenticator to use based on the authentication method . If there authentication method is not specified in the web . xml file then we will use BasicAuth as default .