What do you think about doing this at the application level? Typically someone would do it in an application callback:

http://www.quickfixj.org/confluence/display/qfj/Implementing+Custom+Logons

However, we could create an AuthenticatingApplication implementation to implement this behavior or create some type of utility class that can be used with another concrete Application to easily implement the behavior.

Steve, i see you point.
I was originally thinking that it would make sense to do it in the Session since the values (username/password) may be coming from the same config file as the rest of the session descriptor.
However,that may not be the case, as people may not want to store the password in a plain-text config file.

So i'm actually ambivalent about this now - I can easily be convinced that this feature is better left up to individual implementors to be done in the toAdmin() callback.

Having an abstract AuthenticatingApplication is a good idea, it could be something that has to implement a getUser() and getPassword() function and would know how to implement the logon correctly.
Then we take care of doing the logon logic, and the user is still required to implement getPassword() which will enable them to do it in a secure way.

I'm leaving the decision up to you - we can close it as "won't fix" and leave as-is, or we can change it to create the AuthenticatingApplication instead.

The user could provide the SessionSettings to the authenticated application implementation or extract the user name and password from the SessionSettings and inject them into the application. I like the idea of having some ready-to-go capabilities at the application level. At the same time, I'd like to keep the Session itself as lean and simple as possible.

I agree. So let's brand this as an RFE to create an easy-to-use out-of-the-box AuthenticatingApplication subclass.

Closing this due to https://github.com/quickfix-j/quickfixj/pull/285
Not quite an AuthenticatingApplication but given the fact that no-one implemented this in all these years we've aimed for a simple solution. Users requiring a more sophisticated approach could still do this in their toAdmin() method.