PicketLinkAuthenticator always returns null for calling of sendChallenge method. It should rather return ChallengeResult indicating if a challenge was sent and the desired response code. Returning null leads to internal server error instead of appropriate http status code.