title: Multiple authentication filters with shiro
body: <p>I implemented a custom authentication filter with shiro, but would like to use basic authentication as a backup option. This means - if the user has the right credentials for my custom filter, he will be logged in. If not, I would like to check if the user provided basic authc header.</p>
  
  <p>This is my <code>shiro.ini</code></p>
  
  <pre><code>[main]
  myAuthc = com.company.security.MyAuthcFilter
  myRealm = com.company.security.MyAuthcRealm
  myRealm.authenticationTokenClass = com.company.security.MyAuthcToken
  securityManager.realms = $myRealm
  
  # user for the basic authc filter
  [users]
  testuser = testpass
  
  [urls]
  /web/** = myAuthc, authcBasic
  </code></pre>
  
  <p>The problem is that <code>myAuthc</code> gets evaluated, <code>authcBasic</code> not!
  In my test case, the client only supplies the basic authentication header, which means that <code>myAuthc</code> will not authenticate the user. I thought, that the next filter in the chain will be evaluated, but this does not happen!</p>
  
  <p>In the test scenario, both <code>isAccessAllowed()</code> and <code>onAccessDenied()</code> methods of <code>myAuthc</code> return <code>false</code>.</p>
  
  <p>BTW, when I request <code>/web/hello</code>, I actually receive <code>HTTP 200</code>, but with an empty response body - without the information that would come from the <code>hello</code> resource.</p>
  
  <p>Is it possible to combine filters like this?</p>