In AeroGear we had a thread that shows some issues with the Basic/Digest stuff from PicketLink.

There is no specific Basic/Digest code in AeroGear-Security. The mentioned Demo is just using the default servlet-filters, that PL offers.

The thread is here:
http://aerogear-dev.1069024.n5.nabble.com/aerogear-dev-Basic-Digest-issue-with-the-Controller-or-AG-Security-tc3433.html

The first email explains the issue in detail (usage examples with cURL). the rest of the thread is more discussions on that issue