@Override
  public Authentication attemptAuthentication(HttpServletRequest request,
      HttpServletResponse response) throws AuthenticationException {

    String header = request.getHeader("Authorization");

    if (header == null || !header.startsWith("Bearer ")) {
      throw new BadCredentialsException("No JWT token found in request headers, header: " + header);
    }

    String[] tokens = header.split(" ");

    if (tokens.length != 2) {
      throw new BadCredentialsException("Wrong authentication header format: " + header);
    }

    return new UsernamePasswordAuthenticationToken(tokens[0], tokens[1]);
  }
Json Web Token authentication filter. This would filter the requests with "Bearer" token in the
authentication header, and put the token in the form of UsernamePasswordAuthenticationToken
format for the downstream to consume.
geode-web-management/src/main/java/org/apache/geode/management/internal/rest/security/JwtAuthenticationFilter.java