Injecting OpenIdAuthenticationMechanismDefinition mechanism by qualifier doesn't work

[OndroMih]

Version of Soteria: 4.0.0
App server: Wildfly 34 Preview, GlassFish 8-M9

Injecting a mechanism defined by @OpenIdAuthenticationMechanismDefinition with a qualifier into a custom handler doesn't work. CDI contains complains that HttpAuthenticationMechanism bean with the qualifier doesn't exist.

The same thing with the @BasicAuthenticationMechanismDefinition mechanism works.

To reproduce, just create a plain WAR application and add the following class. The application will fail to deploy on WildFly or GlassFish.

@OpenIdAuthenticationMechanismDefinition(
        qualifiers = {QualifierA.class},
        providerURI = "${oidcConfigQualifierA.issuerUri}",
        clientId = "${oidcConfigQualifierA.clientId}",
        clientSecret = "${oidcConfigQualifierA.clientSecret}",
        redirectURI = "${baseURL}/oidcredirecturi",
        jwksReadTimeout = 5000, jwksConnectTimeout = 5000)

@OpenIdAuthenticationMechanismDefinition(
        qualifiers = {QualifierB.class},
        providerURI = "${oidcConfigQualifierB.issuerUri}",
        clientId = "${oidcConfigQualifierB.clientId}",
        clientSecret = "${oidcConfigQualifierB.clientSecret}",
        redirectURI = "${baseURL}/oidcredirecturi",
        jwksReadTimeout = 5000, jwksConnectTimeout = 5000)

@Alternative
@Priority(APPLICATION)
@ApplicationScoped
public class CustomAuthenticationMechanismHandler implements HttpAuthenticationMechanismHandler {

    @Inject
    @QualifierA
    HttpAuthenticationMechanism qualifierAAuthenticationMechanism;

    @Inject
    @QualifierB
    HttpAuthenticationMechanism qualifierBAuthenticationMechanism;

    @Override
    public AuthenticationStatus validateRequest(HttpServletRequest request, HttpServletResponse response, HttpMessageContext httpMessageContext) throws AuthenticationException {

        try {
            URI uri = new URI(request.getRequestURI().toString());
            return switch (uri.getHost()) {
                case "events.qualifierA.com" -> qualifierAAuthenticationMechanism.validateRequest(request, response, httpMessageContext);
                case "events.qualifierB.com" -> qualifierBAuthenticationMechanism.validateRequest(request, response, httpMessageContext);
                default -> AuthenticationStatus.NOT_DONE;
            };
        } catch (URISyntaxException e) {
            return AuthenticationStatus.NOT_DONE;
        }
    }

}

If the @OpenIdAuthenticationMechanismDefinition definitions are replaced with @BasicAuthenticationMechanismDefinition definitions, the app is deployed successfully.

More information in jakartaee/security#342.