DefaultSecurityManager implements SecurityManager { @Override public boolean authenticate( HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException { boolean result = false; if (request.getAuthType() != null) { if (request.getAuthType().equals(HttpServletRequest.BASIC_AUTH)) { throw new ServletException("Basic auth is not supported"); } if (request.getAuthType().equals(HttpServletRequest.CLIENT_CERT_AUTH)) { throw new ServletException("Client cert auth is not supported"); } if (request.getAuthType().equals(HttpServletRequest.DIGEST_AUTH)) { throw new ServletException("Digest auth is not supported"); } if (request.getAuthType().equals(HttpServletRequest.FORM_AUTH)) { String username = request.getParameter("j_username"); String password = request.getParameter("j_password"); login(request, username, password); if (request.getUserPrincipal() != null) { result = true; } } } return result; }  void addUser(String username, String password, String... roles); void addUserRole(String username, String... roles); @Override boolean authenticate(
            HttpServletRequest request, HttpServletResponse response); @Override void declareRoles(String[] roles); @Override Set<String> getRoles(); @Override boolean getDenyUncoveredHttpMethods(); @Override WebApplication getWebApplication(); @Override boolean isUserInRole(HttpServletRequest request, String role); @Override void login(HttpServletRequest request, String username, String password); @Override void logout(HttpServletRequest request, HttpServletResponse response); void removeUser(String username); @Override void setDenyUncoveredHttpMethods(boolean denyUncoveredHttpMethods); @Override void setWebApplication(WebApplication webApplication);  }
@Test void testAuthenticate() throws ServletException, IOException { TestWebApplicationRequest request = new TestWebApplicationRequest(); TestWebApplicationResponse response = new TestWebApplicationResponse(); request.setAuthType(HttpServletRequest.BASIC_AUTH); DefaultSecurityManager securityManager = new DefaultSecurityManager(); assertThrows(ServletException.class, () -> assertFalse(securityManager.authenticate(request, response))); }
@Test void testAuthenticate2() throws ServletException, IOException { TestWebApplicationRequest request = new TestWebApplicationRequest(); TestWebApplicationResponse response = new TestWebApplicationResponse(); request.setAuthType(HttpServletRequest.CLIENT_CERT_AUTH); DefaultSecurityManager securityManager = new DefaultSecurityManager(); assertThrows(ServletException.class, () -> assertFalse(securityManager.authenticate(request, response))); }
@Test void testAuthenticate3() throws ServletException, IOException { TestWebApplicationRequest request = new TestWebApplicationRequest(); TestWebApplicationResponse response = new TestWebApplicationResponse(); request.setAuthType(HttpServletRequest.DIGEST_AUTH); DefaultSecurityManager securityManager = new DefaultSecurityManager(); assertThrows(ServletException.class, () -> assertFalse(securityManager.authenticate(request, response))); }
@Test void testAuthenticate4() throws ServletException, IOException { TestWebApplicationRequest request = new TestWebApplicationRequest(); TestWebApplicationResponse response = new TestWebApplicationResponse(); request.setAuthType(HttpServletRequest.FORM_AUTH); DefaultSecurityManager securityManager = new DefaultSecurityManager(); assertThrows(ServletException.class, () -> assertFalse(securityManager.authenticate(request, response))); }