@Override
    public Optional<Credentials> extract(final CallContext ctx) {
        val credentials = this.extractor.extract(ctx);
        if (credentials.isEmpty()) {
            return Optional.empty();
        }

        val token = ((TokenCredentials) credentials.get()).getToken();
        val valueMap = parseTokenValue(token);
        val username = valueMap.get("username");
        val response = valueMap.get("response");

        if (StringUtils.isBlank(username) || StringUtils.isBlank(response)) {
            throw new CredentialsException("Bad format of the digest auth header");
        }
        val realm = valueMap.get("realm");
        val nonce = valueMap.get("nonce");
        val uri = valueMap.get("uri");
        val cnonce = valueMap.get("cnonce");
        val nc = valueMap.get("nc");
        val qop = valueMap.get("qop");
        val method = ctx.webContext().getRequestMethod();

        return Optional.of(new DigestCredentials(response, method, username, realm, nonce, uri, cnonce, nc, qop));
    }
{@inheritDoc}

Extracts digest Authorization header components.
As per RFC 2617 :
username is the user's name in the specified realm
qop is quality of protection
uri is the request uri
response is the client response
nonce is a server-specified data string which should be uniquely generated
  each time a 401 response is made
cnonce is the client nonce
nc is the nonce count
If in the Authorization header it is not specified a username and response, we throw CredentialsException because
the client uses an username and a password to authenticate. response is just a MD5 encoded value
based on user provided password and RFC 2617 digest authentication encoding rules
pac4j-http/src/main/java/org/pac4j/http/credentials/extractor/DigestAuthExtractor.java