code: public String getAuthType()
      {
          if (WCCustomProperties.CHECK_REQUEST_OBJECT_IN_USE){
              checkRequestObjectInUse();
          }
          String authType = null;
  
          //if (com.ibm.ws.security.core.SecurityContext.isSecurityEnabled())
          if(((WebAppDispatcherContext)this.getDispatchContext()).isSecurityEnabledForApplication())
          {
              authType = (String) getPrivateAttribute("AUTH_TYPE");
          }
          else
          {
              authType = _request.getAuthType();
          }
          //321485
          if (TraceComponent.isAnyTracingEnabled()&&logger.isLoggable (Level.FINE)) {  //306998.15
              logger.logp(Level.FINE, CLASS_NAME,"getAuthType", " authType --> " + authType);
          }
          // return one of the static vars defined in HttpServletRequest
          if (authType != null)
          {
              if (authType.equals("BASIC"))
                  return HttpServletRequest.BASIC_AUTH;
              else if (authType.equals("CLIENT_CERT"))
                  return HttpServletRequest.CLIENT_CERT_AUTH;
              else if (authType.equals("DIGEST"))
                  return HttpServletRequest.DIGEST_AUTH;
              else if (authType.equals("FORM"))
                  return HttpServletRequest.FORM_AUTH;
          }
  
          return authType;
      }
docs: Returns the authentication scheme of the request, or null if none.
  Same as the CGI variable AUTH_TYPE.