It is not possible to configure both BASIC and CLIENT-CERT mechanisms for authentication via <login-conf> element for a single webapp. An alternate option is to have 2 different web-apps one for BASIC and other for CLIENT-CERT auth mechanisms
--Nithya
[Message sent by forum member 'nitkal' (nitkal)]
http://forums.java.net/jive/thread.jspa?messageID=320938