This is mostly a matter of style. Since the method signature declares "throws AuthenticationException" you can't simply rethrow Exception without an explicit cast, which I tend to avoid, and even then you'd have to do a type check to cast into the declared exception or RuntimeException (which can be thrown without a declaration). I think it's about the same amount of code either way. A couple alternatives:

 - Put the logAuthenticationHandlerError statement in a higher level (in the authenticate method) and simply not catch the exception here. That was along the lines of the original strategy: simply don't catch anything.
 - Simply do not log RuntimeExceptions and let them be thrown implicitly.