Security - Java EE 7 First Look - page 193

this.handler = handler;
}
public Class[] getSupportedMessageTypes() {
return new
Class[]{HttpServletRequest.class,
HttpServletResponse.class};
}
public AuthStatus
validateRequest(MessageInfo messageInfo,
Subject clientSubject, Subject serviceSubject)
throws AuthException {
try {
String username =
validation(messageInfo, clientSubject);
if (username == null &&
requestPolicy.isMandatory()) {
HttpServletRequest request =
(HttpServletRequest)
messageInfo.getRequestMessage();
HttpServletResponse response =
(HttpServletResponse)
messageInfo.getResponseMessage();
String header = "Basic" + "
realm=\"" + request.getServerName() + "\"";
response.setHeader("WWW-Authenticate", header);
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
return AuthStatus.SEND_CONTINUE;
}