How can I provide an own implementation of HttpAuthenticationMechanism in Open Liberty - open-liberty

Question

In a simple app that I run on Open Liberty 21.0.0.8, I have provided an implementation of HttpAuthenticationMechanism:
// imports omitted
#CustomFormAuthenticationMechanismDefinition(
loginToContinue = #LoginToContinue(
loginPage = "/login.xhtml",
errorPage = "",
useForwardToLogin = false))
#ApplicationScoped
public class CustomAuthenticationMechanism implements HttpAuthenticationMechanism {
#Inject
private IdentityStoreHandler identityStoreHandler;
#Override
public AuthenticationStatus validateRequest(HttpServletRequest request,
HttpServletResponse response,
HttpMessageContext context) throws AuthenticationException {
Credential credential = context.getAuthParameters().getCredential();
if (credential != null) {
return context.notifyContainerAboutLogin(identityStoreHandler.validate(credential));
}
else {
return context.doNothing();
}
}
}
I expected Open Liberty to place that implementation of HttpAuthenticationMechanism into service.
However, on startup of Open Liberty a javax.enterprise.inject.spi.DeploymentException is thrown:
[INFO] [ERROR ] CWWKS1925E: The deployment for the dsgvo-management.war module in the dsgvo-management application failed because of multiple HttpAuthenticationMechanism implementations: de.knusperfisch.dsgvo.app.security.control.CustomAuthenticationMechanism, com.ibm.ws.security.javaeesec.cdi.beans.CustomFormAuthenticationMechanism. This failure is likely an application packaging issue. Make sure that each module has only one HttpAuthenticationMechanism implementation.
[INFO] [ERROR ] CWWKZ0004E: An exception occurred while starting the application dsgvo-management. The exception message was: com.ibm.ws.container.service.state.StateChangeException: org.jboss.weld.exceptions.DefinitionException: Exception List with 1 exceptions:
[INFO] Exception 0 :
[INFO] javax.enterprise.inject.spi.DeploymentException: CWWKS1925E: The deployment for the dsgvo-management.war module in the dsgvo-management application failed because of multiple HttpAuthenticationMechanism implementations: de.knusperfisch.dsgvo.app.security.control.CustomAuthenticationMechanism, com.ibm.ws.security.javaeesec.cdi.beans.CustomFormAuthenticationMechanism. This failure is likely an application packaging issue. Make sure that each module has only one HttpAuthenticationMechanism implementation.
[INFO] at com.ibm.ws.security.javaeesec.cdi.extensions.JavaEESecCDIExtension.verifyConfiguration(JavaEESecCDIExtension.java:893)
[INFO] at com.ibm.ws.security.javaeesec.cdi.extensions.JavaEESecCDIExtension.afterBeanDiscovery(JavaEESecCDIExtension.java:173)
The Java EE Security API states that:
An application MAY supply its own HttpAuthenticationMechanism, if desired.
and:
An HttpAuthenticationMechanism must be a CDI bean, and is therefore
visible to the container through CDI if it is packaged in a bean
archive, which generally include Java EE modules and application
archives [...]
It MUST be possible for the definition of an
HttpAuthenticationMechanism to exist within the application archive
[...]
Is there a way in Open Liberty to configure a specific HttpAuthenticationMechanism for an app from an application archive, and if so, how is this done?

Answer 1

At first glance, as the error message indicates, looks like there are multiple HttpAuthMechanisms active which is not allowed. Are there are any apps that are using the #CustomFormAuthenticationMechanismDefinition annotation which would bring in the default com.ibm.ws.security.javaeesec.cdi.beans.CustomFormAuthenticationMechanism AuthMech in addition to your CustomAuthenticationMechanism ?