Source:
<code>public JsonNode newSession(@Context ContainerRequestContext requestContext, @ApiParam(name = "Login request", value = "Credentials. The default " + "implementation requires presence of two properties: 'username' and " + "'password'. However a plugin may customize which kind of credentials " + "are accepted and therefore expect different properties.", required = true) @NotNull JsonNode createRequest) { final SecurityContext securityContext = requestContext.getSecurityContext(); if (!(securityContext instanceof ShiroSecurityContext)) { throw new InternalServerErrorException("Unsupported SecurityContext class, this is a bug!"); } final ShiroSecurityContext shiroSecurityContext = (ShiroSecurityContext) securityContext; final ActorAwareAuthenticationToken authToken; try { authToken = tokenFactory.forRequestBody(createRequest); } catch (IllegalArgumentException e) { throw new BadRequestException(e.getMessage()); } final String sessionId = shiroSecurityContext.getUsername(); final String host = RestTools.getRemoteAddrFromRequest(grizzlyRequest, trustedSubnets); try { Optional<Session> session = sessionCreator.create(sessionId, host, authToken); if (session.isPresent()) { return sessionResponseFactory.forSession(session.get()); } else { throw new NotAuthorizedException("Invalid credentials.", "Basic realm=\"Graylog Server session\""); } } catch (AuthenticationServiceUnavailableException e) { <START> throw new ServiceUnavailableException(e.getMessage()); <END> } }</code><technical_language>I expose details unauthenticated users. able discover auth backends using. suggestion throw new ServiceUnavailableException("Authentication service unavailable");</technical_language>

Target:
public JsonNode newSession(@Context ContainerRequestContext requestContext, @ApiParam(name = "Login request", value = "Credentials. The default " + "implementation requires presence of two properties: 'username' and " + "'password'. However a plugin may customize which kind of credentials " + "are accepted and therefore expect different properties.", required = true) @NotNull JsonNode createRequest) { final SecurityContext securityContext = requestContext.getSecurityContext(); if (!(securityContext instanceof ShiroSecurityContext)) { throw new InternalServerErrorException("Unsupported SecurityContext class, this is a bug!"); } final ShiroSecurityContext shiroSecurityContext = (ShiroSecurityContext) securityContext; final ActorAwareAuthenticationToken authToken; try { authToken = tokenFactory.forRequestBody(createRequest); } catch (IllegalArgumentException e) { throw new BadRequestException(e.getMessage()); } final String sessionId = shiroSecurityContext.getUsername(); final String host = RestTools.getRemoteAddrFromRequest(grizzlyRequest, trustedSubnets); try { Optional<Session> session = sessionCreator.create(sessionId, host, authToken); if (session.isPresent()) { return sessionResponseFactory.forSession(session.get()); } else { throw new NotAuthorizedException("Invalid credentials.", "Basic realm=\"Graylog Server session\""); } } catch (AuthenticationServiceUnavailableException e) { throw new ServiceUnavailableException("Authentication service unavailable"); } }