title: Tomcat - Understanding CredentialHandler
body: <p>I need to use Container Managed Security and Authentication in my latest
  project. And I have a couple of queries regarding how to configure a
  Credential Handler.</p>
  
  <ol>
  <li>Firstly how will a <a href="https://tomcat.apache.org/tomcat-8.0-doc/config/credentialhandler.html" rel="noreferrer">CredentialHandler</a> declaration look like ? <strong>Can
  someone provide a sample declaration of the NestedCredentialHandler with
  the algorithm attribute declared. I need to know since the Digest attribute
  in Realms has become deprecated.</strong> I didn't find any examples on the web and
  I am utterly confused.</li>
  <li>Whats the difference between <code>MessageDigestCredentialHandler</code> and
  <code>SecretKeyCredentialHandler</code> which one is more secure ?</li>
  <li><code>SecretKeyCredentialHandler</code> specifies <strong>only one algorithm</strong> in the
  <a href="https://tomcat.apache.org/tomcat-8.0-doc/config/credentialhandler.html" rel="noreferrer">documentation</a> which is <code>PBKDF2WithHmacSHA1</code>. What other algorithms are
  available ?</li>
  </ol>