Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently building a Java-servlet applcation (using Jersey on GlassFish to be specific). In some parts of the application I need to authenticate the user using basic authentication and in some other parts I need to use client certificates. Which one is used will be based on the path of the request. E.g. /cert/secretMethod1 or /basic/secretMethod2 .

How do I do that? Below is my current web.xml which currently only does basic authentication. I guess I need to use two different but I'd prefer to use only one authentication realm. Are there tags/attributes for web.xml which enables me to specify different auth-methods for different paths of the app?

<?xml version="1.0" encoding="UTF-8"?>
<web-app id="WebApp_ID" version="2.4" xmlns=""
    <description>Jersey servlet</description>
    <display-name>Jersey servlet</display-name>
        <description>Have to be a USER</description>
share|improve this question

Unfortunately, client certificate authentication works at a different layer than the application. So, your best bet would be to re-direct the client to a different SSL listening port that requires client certificate authentication to connect.


  1. App connects to that uses a standard SSL connection without client certification verification. Works as normal.
  2. App connects to that uses a standard SSL connection without client certification verification. Is then redirected to that is a SSL connection which requires client certificate verification. App proceeds as normal.
share|improve this answer
Thanks, but unfortunately the clients I'm working with only work on port 443 and 80 so that doesn't work in my case. – Yrlec Sep 13 '09 at 16:12
Are they not web-browsers? Otherwise, you could try re-directing them to a different IP on port 443 instead. – sybreon Sep 13 '09 at 16:40
Nope, they are not web-browsers. Right now it looks like I will create two separate web-modules and configure them with different auth-mechanisms. – Yrlec Sep 13 '09 at 16:51
I wish I could vote your answer up but my rep. is too low (I need 15p first). – Yrlec Sep 16 '09 at 17:14
up vote 2 down vote accepted

I solved it by creating two separate web-apps (i.e. two modules in IntelliJ or two projects in Eclipse). That way I could configure the authentication-mechanisms separately and have different mechanisms for different paths.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.