},
		}
	}

	if len(authenticators) == 0 {
		if c.Anonymous {
			return anonymous.NewAuthenticator(), &securityDefinitions, nil
		}
		return nil, nil, errors.New("No authentication method configured")
	}

	authenticator := group.NewAuthenticatedGroupAdder(unionauth.New(authenticators...))
	if c.Anonymous {
		authenticator = unionauth.NewFailOnError(authenticator, anonymous.NewAuthenticator())
	}

	testCases := map[string]struct {
		authenticators []security.Authenticator
		ca             CertificateAuthority
		certChain      []string
		code           codes.Code
	}{
		"No authenticator": {
			authenticators: nil,
			code:           codes.Unauthenticated,
			ca:             &mockca.FakeCA{},
		},
		"Unauthenticated request": {
			authenticators: []security.Authenticator{&mockAuthenticator{

		)
		authenticators = append(authenticators, authenticator.WrapAudienceAgnosticRequest(config.APIAudiences, requestHeaderAuthenticator))
	}

	// X509 methods
	if config.ClientCAContentProvider != nil {
		certAuth := x509.NewDynamic(config.ClientCAContentProvider.VerifyOptions, x509.CommonNameUserConversion)
		authenticators = append(authenticators, certAuth)
	}

// Authenticate authenticates the ADS request using the configured authenticators.
// Returns the validated principals or an error.
// If no authenticators are configured, or if the request is on a non-secure
// stream ( 15010 ) - returns amn empty caller and no errors.
func Authenticate(ctx context.Context, authenticators []Authenticator) (*Caller, error) {
	if !features.XDSAuth {
		return nil, nil
	}

# See the OWNERS docs at https://go.k8s.io/owners

approvers:
  - sig-auth-authenticators-approvers
reviewers:
  - sig-auth-authenticators-reviewers
labels:

# See the OWNERS docs at https://go.k8s.io/owners

approvers:
  - sig-auth-authenticators-approvers
reviewers:
  - sig-auth-authenticators-reviewers
labels:

# See the OWNERS docs at https://go.k8s.io/owners

approvers:
  - sig-auth-authenticators-approvers
reviewers:
  - sig-auth-authenticators-reviewers
labels:

# See the OWNERS docs at https://go.k8s.io/owners

reviewers:
  - sig-auth-authenticators-approvers
  - sig-auth-authenticators-reviewers
labels:

# See the OWNERS docs at https://go.k8s.io/owners

approvers:
  - sig-auth-authenticators-approvers
reviewers:
  - sig-auth-authenticators-reviewers
labels:

# See the OWNERS docs at https://go.k8s.io/owners

# approval on api packages bubbles to api-approvers
reviewers:
  - sig-auth-authenticators-approvers
  - sig-auth-authenticators-reviewers
labels: