<dependencies>
    ...
    <dependency>
        <groupId>org.picketbox</groupId>
        <artifactId>picketbox-cdi</artifactId>
        <version>${picketbox.version}</version>
    </dependency>
    ...
</dependencies>

@ApplicationScoped
public class PicketBoxConfigurer {

    /**
     * <p>
     * As we are  using a database identity store, we need to inject and configure the JPATemplate to integrate with your JPA configuration.
     * </p>
     */
    @Inject
    private DefaultJPATemplate jpaTemplate;

    /**
     * <p>Inject a custom authentication mechanism used to authenticate users with Facebook.</p>
     */
    @Inject
    private FacebookAuthenticationMechanism fbAuthenticationMechanism;

    /**     
     * <p>Inject a custom authentication mechanism used to authenticate users with OpenID.</p>     
     */    
    @Inject
    private OpenIDAuthenticationMechanism openidAuthenticationMechanism;

    /**
     * <p>Inject a custom authentication mechanism used to authenticate users with Twitter.</p>
     */
    @Inject
    private TwitterAuthenticationMechanism twitterAuthenticationMechanism;

    /**
     * <p>
     * Produces the {@link ConfigurationBuilder}.
     * </p>
     * 
     * @return
     */
    @Produces
    public ConfigurationBuilder produceConfiguration() {
        ConfigurationBuilder builder = new ConfigurationBuilder(); 
        
        // configure the social authentication mechanisms
        builder
            .authentication()
                .mechanism(this.fbAuthenticationMechanism)
                .mechanism(this.openidAuthenticationMechanism)
                .mechanism(this.twitterAuthenticationMechanism);
        
        // configure the identity manager using a JPA-based identity store.
        builder
            .identityManager()
                .jpaStore().template(this.jpaTemplate);
               
        // session management configuration
        builder
            .sessionManager()
                .inMemorySessionStore();

        return builder;
    }
}

<beans
	xmlns="http://java.sun.com/xml/ns/javaee"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="
        http://java.sun.com/xml/ns/javaee
        http://java.sun.com/xml/ns/javaee/beans_1_0.xsd">
	<interceptors>
		<class>org.apache.deltaspike.security.impl.extension.SecurityInterceptor</class>
	</interceptors>
</beans>

<system-properties>
    <property name="CLIENT_ID" value="CLIENT_ID"/>
    <property name="FB_CLIENT_ID" value="FB_CLIENT_ID"/>
    <property name="FB_CLIENT_SECRET" value="FB_CLIENT_SECRET"/>
    <property name="FB_RETURN_URL" value="http://localhost:8080/todo-server/facebook"/>
</system-properties>

@ApplicationScoped
@ServerInterceptor
public class SecurityInterceptor implements PreProcessInterceptor {

    private static final String AUTH_TOKEN_HEADER_NAME = "Auth-Token";

    @Inject
    private PicketBoxIdentity identity;

    @Override
    public ServerResponse preProcess(HttpRequest request, ResourceMethod method) throws Failure, WebApplicationException {
        ServerResponse response = null;

        if (requiresAuthentication(method) && !this.identity.isLoggedIn()) {
            boolean isLoggedIn = false;
            String token = getToken(request);

            if (token != null) {
                try {
                    isLoggedIn = identity.restoreSession(token);
                } catch (AuthenticationException e) {

                }
            }

            if (!isLoggedIn) {
                AuthenticationResponse authcResponse = new AuthenticationResponse();

                authcResponse.setLoggedIn(false);

                response = new ServerResponse();
                response.setEntity(authcResponse);
                response.setStatus(HttpStatus.SC_FORBIDDEN);
            }
        }

        return response;
    }

    /**
     * <p>Retrieve the token from the request, if present.</p>
     *
     * @param request
     * @return
     */
    private String getToken(HttpRequest request) {
        List<String> tokenHeader = request.getHttpHeaders().getRequestHeader(AUTH_TOKEN_HEADER_NAME);
        String token = null;

        if (tokenHeader != null && !tokenHeader.isEmpty()) {
            token = tokenHeader.get(0);
        }

        return token;
    }


}