code: public WebAuthenticator getWebAuthenticator(WebRequest webRequest) {
          String authMech = webAppSecurityConfig.getOverrideHttpAuthMethod();
          if (authMech != null && authMech.equals("CLIENT_CERT")) {
              return createCertificateLoginAuthenticator();
          }
          SecurityMetadata securityMetadata = webRequest.getSecurityMetadata();
          LoginConfiguration loginConfig = securityMetadata.getLoginConfiguration();
  
          if (loginConfig != null) {
              String authenticationMethod = loginConfig.getAuthenticationMethod();
              if (LoginConfiguration.FORM.equalsIgnoreCase(authenticationMethod)) {
                  return createFormLoginAuthenticator(webRequest);
              } else if (LoginConfiguration.CLIENT_CERT.equalsIgnoreCase(authenticationMethod)) {
                  return createCertificateLoginAuthenticator();
              }
          }
          return getBasicAuthAuthenticator();
      }
docs: Determine the correct WebAuthenticator to use based on the authentication
  method. If there authentication method is not specified in the web.xml file,
  then we will use BasicAuth as default.
  
  @param webRequest
  @return The correct WebAuthenticator to handle the webRequest, or {@code null} if it could not be created.