code: protected void setRequestAuthType(MessageInfo msgInfo, JaspiRequest jaspiRequest) {
          String authType = null;
          if (msgInfo.getMap().containsKey(AUTH_TYPE)) {
              authType = (String) msgInfo.getMap().get(AUTH_TYPE);
          } else {
              authType = getDDAuthMethod(jaspiRequest);
              if (authType == null) {
                  authType = "JASPI";
              }
          }
          HttpServletRequest req = (HttpServletRequest) msgInfo.getRequestMessage();
          setRequestAuthType(req, authType);
      }
docs: /*
  The runtime must also ensure that the value returned by calling
  getAuthType on the HttpServletRequest is consistent in terms of being null
  or non-null with the value returned by getUserPrincipal. When getAuthType
  is to return a non-null value, the runtime must consult the Map of
  the MessageInfo object used in the call to validateRequest to determine
  if it contains an entry for the key "javax.servlet.http.authType".
  If the Map contains an entry for the key, the runtime must obtain (from
  the Map) the value corresponding to the key and establish it as the
  getAuthType return value. If the Map does not contain an entry for the key,
  and an auth-method is defined in the login-config element of the
  deployment descriptor for the web application, the runtime must establish
  the value from the auth-method as the value returned by getAuthType.
  If the Map does not contain an entry for the key, and the deployment
  descriptor does not define an auth-method, the runtime must establish a
  non-null value of its choice as the value returned by getAuthType.