...

Different derivatives of the Principal Provider class can initialize in different ways, either through the repositoriesrepository.json file, other credential files, from information sent via HTTP header or by connecting to external information sources such as LDAP. 

PrincipalProvider

The parent class of all the Principal Provider instances, does no credential initialization or authenticationinterface that the providers must implement.

Container Roles Principal Provider

ContainerRolesPrincipalProvider is a module used by Fedora Commons to provide added authentication/roles to a repository.The roles are read by the ContainerRolesPrincipalProvider module from the repo.xml file located at (not sure?) by ContainerRolesPrincipalProvider.setRoleNames() and are stored internally to the instance using the getPrincipals() member function. Calls to the module to test the existence of a given username/role are through the equals() member function that returns true if the given username/role is in the list of principal roles read from the configuration file or false if it was not present, or true if a username/role has authentication and false if they fail authentication.. 

HTTP Header Principal Provider

...