title: multiple authentication mechanisms in a single app using java config
body: <p>Currently I have a single authentication mechanism in my application which is to use LDAP for authentication and authorization. My security configuration looks like this</p>
  
  <pre><code>@Configuration
  @EnableWebMvcSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
  @Override
  protected void configure(HttpSecurity http) throws Exception {
      http
          .csrf().disable()
          .authorizeRequests()
              .anyRequest().fullyAuthenticated()
              .and()
              .httpBasic();
  }
  
  @Configuration
  protected static class AuthenticationConfiguration extends GlobalAuthenticationConfigurerAdapter {
  
      @Value("${ldap-${env}.manager.dn}")
      private String managerDn;
  
      @Value("${ldap-${env}.manager.pass}")
      private String managerPass;
  
      @Value("${ldap-${env}.server.url}")
      private String url;
  
      @Value("${ldap.password.attribute:userPassword}")
      private String passwordAttr;
  
      @Override
      public void init(AuthenticationManagerBuilder auth) throws Exception {
          auth.ldapAuthentication().userDnPatterns("uid={0},ou=people").groupSearchBase("ou=groups")
                  .groupSearchFilter("(member={0})").userSearchBase("ou=people").userSearchFilter("(uid={0})")
                  .userDetailsContextMapper(new CustomLdapPersonContextMapper())
                  // .passwordCompare()
                  // .passwordAttribute(passwordAttr)
                  // .passwordEncoder(new PlaintextPasswordEncoder())
                  // .and()
                  .contextSource().managerDn(managerDn).managerPassword(managerPass).url(url);
      }
  }
  }
  </code></pre>
  
  <p>There are situations though where users might come in with a session token which can authentication from a session key server and valid token returns a username which can then be used to load authrization information from LDAP for that user. So my second authentication mechanism should happen first where if a session token is present in http headers it should perform the token authentication and then ldap lookup and if no session token is present it should just fall to current authentication mechanism. How can I add this second layer of authentication.</p>