web.xml, using form and basic authentication simultaneously

Question

I have setup FORM-authentication within web.xml (java-webcontainer) successfully.

I did not find a way to sent the username/password within the get-request of the restful-uri from my client when using FORM-Authentication. So I have to use BASIC-Authentication only for the restful-uri.

So I have this question:

How can I set up both form-based authentication and basic authentication? Basic authentication should only be enabled for the restful-uri.

Are you still interested in the answer to this question? – Olaf Aug 08 '12 at 14:23 — Olaf, Aug 08 '12 at 14:23
yes! I had been in holidays:) – nimo23 Aug 27 '12 at 08:50 — nimo23, Aug 27 '12 at 08:50

score 12 · Answer 1 · answered Aug 11 '15 at 18:59

12

I was also facing a similar problem and I realized that if you are using Wildfly then its possible to configure multiple mechanism using web.xml:-

    <auth-method>BASIC?silent=true,FORM</auth-method>

Using this silent basic authentication will be tried first, which is basic authentication that only takes effect if an Authorization header is present. If no such header is present then form authentication will be used instead.

Maybe its too late for a reply but I just updated this in case someone finds this useful :P

answered Aug 11 '15 at 18:59

nothingInTheName

313
4
11

2

Thanks a lot. This help a lot. Save lots of time. – Moon Mysterious Mar 08 '17 at 09:01
Thank you very much. Its never too late for people looking for answers – sergioFC Jul 25 '19 at 10:06

score 7 · Accepted Answer · answered Aug 08 '12 at 13:38

7

There were no responses here for a while, so I did a quick servlet refresher myself. Servlet specs indeed allow only one <login-config> element per web application, so there is no way to have an entry point with BASIC authetication for the REST API and another with FORM-based authentication for the UI. The only option is to build them as two independently deployable applications. To avoid code duplication, it might be a good idea just to let the UI application talk to the REST API the same way the third-party clients are supposed to.

answered Aug 08 '12 at 13:38

Olaf

6,249
1
19
37

I hope, it will be possible in future servlet specs. Maybe we should make a feature request? – nimo23 Aug 27 '12 at 08:52
For WILDFLY solution take a look at [nothingInTheName answer](https://stackoverflow.com/a/31949879/3870761) – sergioFC Jul 25 '19 at 10:23

web.xml, using form and basic authentication simultaneously

2 Answers2