code: private AuthorizationService autoDetectAuthorizationService() {
          Iterator<AuthorizationService> services = authorization.getServices();
          if (services.hasNext() == false) {
              Tr.error(tc, "SECURITY_SERVICE_NO_SERVICE_AVAILABLE", KEY_AUTHORIZATION);
              throw new IllegalStateException(Tr.formatMessage(tc, "SECURITY_SERVICE_NO_SERVICE_AVAILABLE", KEY_AUTHORIZATION));
          }
  
          AuthorizationService authzService = services.next();
          if (services.hasNext()) {
              authzService = null;
              services.next();
  
              if (services.hasNext()) {
                  // more than 2 services
                  Tr.error(tc, "SECURITY_SERVICE_MULTIPLE_SERVICE_AVAILABLE", KEY_AUTHORIZATION);
                  throw new IllegalStateException(Tr.formatMessage(tc, "SECURITY_SERVICE_MULTIPLE_SERVICE_AVAILABLE", KEY_AUTHORIZATION));
  
              }
  
              boolean builtinAuthzFound = false;
  
              for (String key : authorization.keySet()) {
                  String type = (String) authorization.getReference(key).getProperty(AuthorizationService.AUTHORIZATION_TYPE);
                  if ("Builtin".equals(type)) {
                      builtinAuthzFound = true;
                  } else {
                      authzService = authorization.getService(key);
                  }
              }
  
              if (!builtinAuthzFound) {
                  Tr.error(tc, "SECURITY_SERVICE_MULTIPLE_SERVICE_AVAILABLE", KEY_AUTHORIZATION);
                  throw new IllegalStateException(Tr.formatMessage(tc, "SECURITY_SERVICE_MULTIPLE_SERVICE_AVAILABLE", KEY_AUTHORIZATION));
              }
          }
  
          return authzService;
      }
docs: The addition of this logic is undesirable, however it is necessary to
  keep the configuration "simple", and not have the authorization services
  know about each other. Because the SAF and built-in authorization
  can exist in the runtime together, we need to handle this case. The SAF
  authorization service will not start unless configured, however, the
  builtin authorization service will always start. Therefore, error cases:
  1. If there are no authorization services at all
  2. If there are more than two authorization services
  3. If there are two authorization services but the builtin isn't one
  
  @return ID of the active authorization service