Q:

Jetty LoginModule or LoginService

I'm involved in a java EE project with very old code. It has own mechanism for authentication and authorization user from a html form. Now I want to port this mechanism in Java EE Login mechanism using
<login-config>
  <auth-method>FORM</auth-method>
  <realm-name>Test Realm</realm-name>
  <form-login-config>
     <form-login-page>/logon.html?param=test</form-login-page>
     <form-error-page>/logonError.html?param=test</form-error-page>
  </form-login-config>
</login-config>

Jetty Document says, one can implement the Interface LoginModule (may use 
 org.eclipse.jetty.jaas.spi.AbstractLoginModule) and use the class JASSLoginService to configure Jetty, s.t. like 
<Set name="securityHandler">
    <New class="org.eclipse.jetty.security.ConstraintSecurityHandler">
     <Set name="loginService">
       <New class="org.eclipse.jetty.jaas.JAASLoginService">
         <Set name="name">Test JAAS Realm</Set>
         <Set name="loginModuleName">xyz</Set>
       </New>
     </Set>
    </New>
  </Set>

Since I don't want to make the app over-configuration, my question is, instead of using LoginModule with all circumstance of JASS, can I just implement the Interface org.eclipse.jetty.security.LoginService and use it directly in the "securityHandler"?
Environment: Java SE 8/JavaEE7; Jetty 9.2.x; Windows Server

A:

You can do either. If you want to use the javaee standard authentication mechanism, configure the JAASLoginService, and then specify a LoginModule implementation, either one provided by jetty or implemented by yourself or from a 3rd party lib.  If you write your own LoginModule, then it should be portable to any servlet container.
Alternatively, you can use the jetty specific api for authentication, which is the LoginService, and plug in one of our existing LoginServices, like HashLoginService, JDBCLoginService etc, or you could instead code your own LoginService implementation. Of course, a jetty LoginService won't be portable to any other servlet container.

