When looking for anAuthenticationHandlerthe authentication handler is selected whose path is the longest match on the request URL. If the service is registered with Scheme and Host/Port, these must exactly match for the service to be eligible. If multipleAuthenticationHandlerservices are registered with the same length matching path, the handler with the higher service ranking is selected[^ranking].
[^ranking]: Service ranking is defined by the OSGi Core Specification as follows:If multiple qualifying service interfaces exist, a service with the highestservice.rankingnumber, or when equal to the lowestservice.id, determines which service object is returned by the Framework.
So the idea is if you are using a custom authentication handler, it should have the highest ranking for it to be executed and hence a high value number, just to make sure it does not collide with any existing service.
This service.ranking indicates the priority of the filter in the chain. The higher the number the earlier the filter will be invoked. Sling supports filter processing by applying filter chains to the requests before actually dispatching to the servlet or script for processing. They can be used to call a servlet, to redirect to another page, to authenticate request, preprocessing, post-processing of mark up, logging, measuring, decoration or adding/removing request parameters.
Any Integer value
Indication of where to place the filter in the filter chain. The higher the number the earlier in the filter chain. This value may span the whole range of integer values. Two filters with equal service.ranking property value (explicitly set or default value of zero) will be ordered according to their service.id service property