code: @FFDCIgnore({ com.ibm.ws.security.authentication.AuthenticationException.class })
      @Override
      public AuthenticationResult authenticate(WebRequest webRequest) {
          Subject sessionSubject = null;
          JaspiRequest jaspiRequest = new JaspiRequest(webRequest, null);
          // can set authenticate method here if webrequest has no websecuritycontext
          AuthenticationResult result = null;
          AuthConfigProvider provider = getAuthConfigProvider(jaspiRequest.getAppContext());
  
          if (provider != null) {
              try {
                  if (jaspiRequest.getWebSecurityContext() != null) {
                      JaspiAuthContext jaspiContext = getJaspiAuthContext(jaspiRequest, provider);
                      webRequest.getWebSecurityContext().setJaspiAuthContext(jaspiContext);
                  }
                  // if we have a jaspi session subject from a previous request
                  // then set it as the current subject (both caller and invocation)
                  sessionSubject = getSessionSubject(jaspiRequest);
                  if (sessionSubject != null) {
                      SubjectManager sm = new SubjectManager();
                      sm.setCallerSubject(sessionSubject);
                      sm.setInvocationSubject(sessionSubject);
                  }
                  result = authenticate(new Subject(),
                                        getJaspiAuthType(jaspiRequest),
                                        jaspiRequest,
                                        provider);
  
              } catch (AuthenticationException e) {
                  if (tc.isDebugEnabled())
                      Tr.debug(tc, "Internal error during JASPI authentication", e);
                  if (result == null)
                      result = new AuthenticationResult(AuthResult.FAILURE, e.getMessage());
              }
          } else {
              result = new AuthenticationResult(AuthResult.CONTINUE, "No JASPIC provider found for request: " + webRequest.getHttpServletRequest().getRequestURI());
          }
  
          if (provider != null && provider.getClass() != null) {
              result.setAuditAuthConfigProviderName(provider.getClass().toString());
              result.setAuditAuthConfigProviderAuthType(getRequestAuthType(jaspiRequest.getHttpServletRequest(), "AUTH_TYPE"));
          }
          return result;
      }
docs: /*
  (non-Javadoc)
  
  @see com.ibm.ws.webcontainer.security.WebAuthenticator#authenticate(com.ibm.ws.webcontainer.security.WebRequest)