Proposal to inject built-in HttpAuthenticationMechanism beans

[OndroMih]

A proposal to address jakartaee/security#188.

This is to make it possible to choose programmatically which of the built-in authentication mechanisms should be used based on configuration or user input. It would be possible to inject one or more mechanisms configured using the existing definition annotations (e.g. @BasicAuthenticationMechanismDefinition) and delegate authentication to them from a custom HttpAuthenticationMechanism bean.

See the README for more details.

[tofflos]

Minor typo "mplemented" should be "implemented".

[OndroMih]

Fixed, thank you

[OndroMih]

An alternative option would be to support qualifiers for built in auth mechanisms, like this:

@BasicAuthenticationMechanismDefinition( qualifier = BasicAuth.class /* user-specified CDI qualifier*/ )
@FormAuthenticationMechanismDefinition(
   qualifier  = FormAuth.class /* user-specified CDI qualifier*/,
   loginToContinue = @LoginToContinue(loginPage = "/login.xhtml"))
@Dependent
public class MyAuthMechanism implements HttpAuthenticationMechanism {
    @Inject
    @FormAuth
    HttpAuthenticationMechanism formAuthentication;

    @Inject
    @BasicAuth
    HttpAuthenticationMechanism basicAuthentication;
}

More boiler-plate code because it requires creating a qualifier for each injected mechanism but does the same job.