That depends entirely on how/where you implement this.

You can make your application code check the authorization header, get the username from there and do authorization based on that.