IIRC we need to establish if auth is mandatory in order to set the javax.security.auth.message.MessagePolicy.isMandatory property that is set into the JASPI MessageInfo. Need to check the spec to see if this property MUST always be set or not but I believe it does.