Description

An example was brought up in a post on stackoverflow to use both OpenID and FORM authentication together.

What I would like to achieve is to be able to use both authentication methods at the same time, depending on user preference. Some users may have an OpenID account and log in this way; other users may only have "local" accounts so they should be able to use the FORM authentication method. Each type of user (OpenID/local) may have a different login URL; this is perfectly reasonable.

I have also seen other combinations which have been asked about so could be a good idea to make this a generic mechanism if possible. For example BASIC and FORM authentication.

Another answer on stackoverflow said if you are using Wildfly then its possible to configure multiple authentication mechanisms in web.xml

<auth-method>BASIC?silent=true,FORM</auth-method>

Using this silent basic authentication will be tried first, which is basic authentication that only takes effect if an Authorization header is present. If no such header is present then form authentication will be used instead.

So maybe we could do something similar, or maybe this is achievable using something like JAAS or JASPI.