Constrained auth methods

[ccnifo]

10_security.config.erb forces the same auth methods for the several params SEC_*_AUTHENTICATION_METHODS: is it a feature or can we make it more flexible?
Same question goes for the auth string: the very specific ordering of the auth methods (determined by a function), does it obey some constraint/best practice or can we make it more flexible?

[kreczko]

That's just laziness ;).
In most places, you will find shortcuts that were treated as "good enough" - this is one of them.

For both the params and the auth string function I am open to suggestions.

[ccnifo]

That makes sense :)
It looks like we might need a setup a bit more complex, if so I won't hesitate to submit PRs!
Changing the methods ordering sounds quite easy as it can be defined in 1 parameter, but taking into account the numerous SEC_*_AUTHENTICATION_METHODS would need some further thinking.