Question

Is it possible to have multiple authentication methods for a java servlet? For example, have form based authentication in addition to open id based authentication so users can choose how they log in.

Answer 1

Yes.

However, I would suggest doing this using servlet filters instead of on the servlet itself.

http://brendangraetz.wordpress.com/2010/06/17/use-servlet-filters-for-user-authentication/

Follow the steps in that post, and override the isAuth() method such that it performs the authentication in however many modes you wish. In (very rough, untested) code:

@Override protected boolean isAuth()
{
    String authMode = (String)(getSession(true).getAttribute("authMode"));
    if (authMode == null) { return false; }
    if (authMode.equals("open id") {
        //do open id authentication steps here
        //return true if authentication passes
    }
    else if (authMode.equals("some other authentication") {
        //do some other authentication steps here
        //return true if authentication passes
    }
    ...
    return false;    
}

I am assuming of course that you already know how to implement the authentication steps in each mode individually.

The “trick” is to store a value in the HTTP session, immediately after the user performs the log in authentication, in the HTTP session. Based on this value, the filter will know what it should check or query whatever you specify before loading the servlet.