I disagree -- this code is specific to the _default_ HTTP authentication adapter setup that zf-mvc-auth will consume. If you're providing your own custom HTTP authentication adapter, you'll have your own criteria as to what constitutes a valid adapter. As such, I moved it into the HttpAuthAdapter factory.