How to register my own SecurityProvider?

[Peter Haensgen <P....@intershop.de>]

Hi there,

I have written my own security provider that authenticates users against my
database. Now I'm wondering how I can register this provider so that it is
invoked?

Normally, the flow is like this:
- org.apache.axis.handlers.http.HTTPAuthHandler (extracts the username /
password from HTTP headers)
- org.apache.axis.handlers.SimpleAuthenticationHandler (performs
authentication by calling a SecurityProvider implementation).

The SimpleAuthenticationHandler tries to get the SecurityProvider from the
MessageContext, if its not there, it creates a SimpleSecurityProvider
instance. But I don't see any factory class, system property or similar,
where I can register my own implementation.

The only solution I can see is to write my own AuthenticationHandler and not
to use the SimpleAuthenticationHandler, but then the whole SecurityProvider
interface is useless. Alternatively, I I could add a handler that registers
my class at the message context on every call before the
SimpleAuthenticationhandler, but this is a really ugly workaround.

thanx,
Peter