With the introduction of authorization_realm (and existing run_as) functionality, it would be helpful to be able to configure a realm to perform lookup only, but not authenticate.

See: #33262 (comment)

The proposed design is to add a authentication.enabled flag in the config (default true), which would be readby RealmConfig, and then when authenticating, the AuthenticationService would skip any realms for which the config's isAuthenticationEnabled method returned false.