JWT authentication failure responds with Basic Auth challenge when both JWT and basic mechanisms are enabled

[jfrantzius]

Describe the bug
When using quarkus-smallrye-jwt, and on authentication failure of a request, Quarkus responds with the wrong challenge www-authenticate: basic realm= ... instead of www-authenticate: Bearer {token} in the 401 response. This causes the Chrome browser to display a Basic Auth login popup on XHR requests where it shouldn't.

Expected behavior
If multiple HttpAuthenticationMechanism implementations are present, It's not entirely clear how Quarkus should know which HttpAuthenticationMechanism to use for the challenge to respond with. However, it should be possible to prevent Basic Auth from providing the challenge in the response. It should somehow be possible to get Quarkus to use io.quarkus.smallrye.jwt.runtime.auth.JWTAuthMechanism.getChallenge(RoutingContext).

Actual behavior
HttpAuthenticator.sendChallenge(RoutingContext) uses the first mechanism it finds
to send the challenge, and that always seems to be BasicAuthenticationMechanism.

To Reproduce
It's hard to come up with a small reproducer, because it requires some OIDC server. Maybe a custom authentication mechanism with its own getChallenge() implementation could serve to demonstrate that that never gets called.

Environment (please complete the following information):

• Output of uname -a or ver: Linux + Mac
• Output of java -version: openjdk version "11.0.4" 2019-07-16
• GraalVM version (if different from Java): N/A
• Quarkus version or git rev: 1.8.3-Final
• Build tool (ie. output of mvnw --version or gradlew --version): Apache Maven 3.6.3 (cecedd343002696d0abb50b32b541b8a6ba2883f)

Additional context
Using Keycloak as OIDC server

[ghost]

/cc @pedroigor, @sberyozkin

[sberyozkin]

I've done some work on this PR, could not fix the form+basic authentication test, so more time is needed

[jfrantzius]

Anyone using OIDC will have to workaround this issue by stripping the www-authenticate: from responses, if there hopefully is an upstream proxy that can do this.