Support for alternate authentication schemes

public interface UserContext {
  /* Maintain support in API for simple authentication */
  public User authenticate(String username, String password)
    throws ContextAuthenticationException;

  /* Also support any future authentication scheme */
  public Authenticated authenticate(Credentials credentials)
    throws ContextAuthenticationException;

  // Registration or removal of authentication schemes are protected
  protected void addAuthenticationScheme(AuthenticationScheme scheme);
  protected void removeAuthenticationScheme(AuthenticationScheme scheme);
}

/*
 * Authentication schemes define their own credentials.
 * Any client authenticating against a given scheme must
 * supply appropriate credentials.
 */
public interface Credentials {
  /*
   * Credentials will contains scheme-specific properties, but
   * all credentials must declare their scheme.
   */
  public String getAuthenticationScheme();
}

/* Defines an authentication scheme that can be used by the API. */
public interface AuthenticationScheme {
  /*
   * Returns the authenticated user for the API, but may return
   * additional information (e.g., an authentication token that
   * can be used for subsequent authentication).
   */
  public Authenticated authenticate(Credentials credentials)
    throws ContextAuthenticationException;
}

/* Used to allow more than just a user to be returned by authentication */
public interface Authenticated {
  // Scheme through which user was authenticated
  public String getAuthenticationScheme();

  // OpenMRS user account that was authenticated
  public User getUser();

  // ... any additional data return by scheme (e.g., token) ...
}