Please specify detailed contract of HttpServerAuthenticationMechanismFactory.
Describe which params are allowed to be null and what happens in that case. Also describe if null return values are allowed from interface methods and when does that could happen.
You can consider javax.security.sasl.SaslServerFactory as example of detailed contract.

For example:

• Is properties parameter of getMechanismNames() allowed to be null?
• is getMechanismNames() allowed to return null ?
• Are any of createAuthenticationMechanism() parameters allowed to be null?
  • For ServerMechanismFactoryImpl implementation properties could not be null - is it general rule?

        java.lang.IllegalArgumentException: Parameter 'properties' may not be null
        at org.wildfly.common.Assert.checkNotNullParamChecked(Assert.java:69)
        at org.wildfly.common.Assert.checkNotNullParam(Assert.java:47)
        at org.wildfly.security.http.impl.ServerMechanismFactoryImpl.createAuthenticationMechanism(ServerMechanismFactoryImpl.java:79)
        

  • For ServerMechanismFactoryImpl implementation callbackHandler could not be null - is it general rule?

        java.lang.IllegalArgumentException: Parameter 'callbackHandler' may not be null
        at org.wildfly.common.Assert.checkNotNullParamChecked(Assert.java:69)
        at org.wildfly.common.Assert.checkNotNullParam(Assert.java:47)
        at org.wildfly.security.http.impl.ServerMechanismFactoryImpl.createAuthenticationMechanism(ServerMechanismFactoryImpl.java:80)
        

  • For ServerMechanismFactoryImpl implementation mechanismName could not be null - is it general rule?

        java.lang.IllegalArgumentException: Parameter 'mechanismName' may not be null
            at org.wildfly.common.Assert.checkNotNullParamChecked(Assert.java:69)
            at org.wildfly.common.Assert.checkNotNullParam(Assert.java:47)
            at org.wildfly.security.http.impl.ServerMechanismFactoryImpl.createAuthenticationMechanism(ServerMechanismFactoryImpl.java:78)
        

I would suggest to wrap java.lang.IllegalArgumentException to HttpAuthenticationException. Otherwise possibility of IllegalArgumentException should be documented in contract.

Filing as Critical, as this interface is expected to be implemented by custom factories.