Interceptors are enabled via:
builder.http().allPaths().authenticateWith().basic().realmName("default");
Security mechanism initialization is internal to PicketLink. I would start investigation here: https://github.com/picketlink/picketlink/blob/master/modules/base/impl/src/main/java/org/picketlink/http/internal/SecurityFilter.java
Unfortunately I can't tell you what exactly doesn't kick in in Scenario #2 since there are no error messages whatsoever except HTTP security simply appears to be non-existent.
|