Using both basic and client-certificate authentication with GlassFish

Solution 1:

Unfortunately, client certificate authentication works at a different layer than the application. So, your best bet would be to re-direct the client to a different SSL listening port that requires client certificate authentication to connect.

E.g.

1. App connects to https://example.com/basic that uses a standard SSL connection without client certification verification. Works as normal.
2. App connects to https://example.com/cert that uses a standard SSL connection without client certification verification. Is then redirected to https://example.com:8443/cert that is a SSL connection which requires client certificate verification. App proceeds as normal.

Solution 2:

I solved it by creating two separate web-apps (i.e. two modules in IntelliJ or two projects in Eclipse). That way I could configure the authentication-mechanisms separately and have different mechanisms for different paths.