How to add a org.eclipse.jetty.ee8.security.ConstraintSecurityHandler to a org.eclipse.jetty.server.Handler.Collection

[msohn]

Jetty Version
12.0.16
Jetty Environment
ee8

Java Version
17

Question
Since Gerrit Code Review can't yet update from servlet API 4 to 6 it is currently stuck to
use JGit 6.10. Since Gerrit wants to benefit from all the new stuff in JGit master and JGit
doesn't want new features on its stable-6.10 branch I am trying to downgrade JGit master
on the servlet-4 branch from servlet API 6.1.0 to 4.0.4 in this change:
https://eclipse.gerrithub.io/c/eclipse-jgit/jgit/+/1208599

I am stuck with a compile error on line 339 of the class org.eclipse.jgit.junit.http.AppServer
since I can't figure out how to add a org.eclipse.jetty.ee8.security.ConstraintSecurityHandler to a org.eclipse.jetty.server.Handler.Collection.
Looks like I am lost in Jetty class hierarchies.

[Spikhalskiy]

org.eclipse.jetty.ee8.webapp.WebAppContext and its ancestor org.eclipse.jetty.ee8.servlet.ServletContextHandler accept org.eclipse.jetty.ee8.security.SecurityHandler as a constructor parameter.
org.eclipse.jetty.ee8.security.ConstraintSecurityHandler is a subclass of org.eclipse.jetty.ee8.security.SecurityHandler.

This may be also helpful:

jetty.project/jetty-ee8/jetty-ee8-demos/jetty-ee8-demo-jaas-webapp/src/main/config/modules/demo.d/ee8-demo-jaas.xml

Line 14 in aac0353

<Set name="securityHandler">

[msohn]

Thanks a lot, your hint helped to find the fix.

Instead of wrapping the ServletContextHandler with a ConstraintSecurityHandler
we need to set the ServletContextHandler's security handler using ServletContextHandler.setSecurityHandler(ConstraintSecurityHandler).

See https://eclipse.gerrithub.io/c/eclipse-jgit/jgit/+/1208599/2..3/org.eclipse.jgit.junit.http/src/org/eclipse/jgit/junit/http/AppServer.java#339