diff --git a/BUCK b/BUCK
index f20aa8a..39d571d 100644
--- a/BUCK
+++ b/BUCK
@@ -10,6 +10,7 @@
     'Gerrit-PluginName: cfoauth',
     'Gerrit-ApiType: plugin',
     'Gerrit-ApiVersion: 2.12-SNAPSHOT',
+    'Gerrit-Module: com.googlesource.gerrit.plugins.cfoauth.OAuthModule',
     'Gerrit-HttpModule: com.googlesource.gerrit.plugins.cfoauth.HttpModule',
     'Gerrit-InitStep: com.googlesource.gerrit.plugins.cfoauth.InitOAuthConfig',
     'Implementation-Title: Cloud Foundry UAA OAuth 2.0 Authentication Provider',
diff --git a/src/main/java/com/googlesource/gerrit/plugins/cfoauth/CFOAuthService.java b/src/main/java/com/googlesource/gerrit/plugins/cfoauth/CFOAuthService.java
index ee919cb..2fde5d9 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/cfoauth/CFOAuthService.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/cfoauth/CFOAuthService.java
@@ -16,10 +16,12 @@
 
 import com.google.common.base.CharMatcher;
 import com.google.gerrit.extensions.annotations.PluginName;
+import com.google.gerrit.extensions.auth.oauth.OAuthLoginProvider;
 import com.google.gerrit.extensions.auth.oauth.OAuthServiceProvider;
 import com.google.gerrit.extensions.auth.oauth.OAuthToken;
 import com.google.gerrit.extensions.auth.oauth.OAuthUserInfo;
 import com.google.gerrit.extensions.auth.oauth.OAuthVerifier;
+import com.google.gerrit.reviewdb.client.AccountExternalId;
 import com.google.gerrit.server.config.CanonicalWebUrl;
 import com.google.gerrit.server.config.PluginConfig;
 import com.google.gerrit.server.config.PluginConfigFactory;
@@ -30,7 +32,7 @@
 import java.io.IOException;
 
 @Singleton
-class CFOAuthService implements OAuthServiceProvider {
+class CFOAuthService implements OAuthServiceProvider, OAuthLoginProvider {
 
   private static final String OAUTH_VERSION = "2.0";
   private static final String NAME = "Cloud Foundry UAA OAuth2";
@@ -78,6 +80,45 @@
   }
 
   @Override
+  public OAuthUserInfo login(String username, String secret)
+      throws IOException {
+    if (username == null || secret == null) {
+      throw new IOException("Authentication error");
+    }
+    AccessToken accessToken;
+    try {
+      if (uaaClient.isAccessTokenForClient(username, secret)) {
+        // "secret" is an access token for a client, i.e. a
+        // technical user; send it to UAA for verification
+        if (!uaaClient.verifyAccessToken(secret)) {
+          throw new IOException("Authentication error");
+        }
+        return getAsOAuthUserInfo(username);
+      } else {
+        if (uaaClient.isAccessTokenForUser(username, secret)) {
+          // "secret" is an access token for an ordinary user;
+          // send it to UAA for verification
+          if (!uaaClient.verifyAccessToken(secret)) {
+            throw new IOException("Authentication error");
+          }
+          accessToken = uaaClient.toAccessToken(secret);
+        } else {
+          // "secret" is not an access token but likely a password;
+          // send username and password to UAA and try to get an access
+          // token; if that succeeds the user is authenticated
+          accessToken = uaaClient.getAccessToken(username, secret);
+        }
+        UserInfo userInfo = accessToken.getUserInfo();
+        userInfo.setDisplayName(
+            uaaClient.getDisplayName(accessToken.getValue()));
+        return getAsOAuthUserInfo(userInfo);
+      }
+    } catch (UAAClientException e) {
+      throw new IOException("Authentication error", e);
+    }
+  }
+
+  @Override
   public String getVersion() {
     return OAUTH_VERSION;
   }
@@ -96,4 +137,9 @@
         userInfo.getUserName(), userInfo.getEmailAddress(),
         userInfo.getDisplayName(), null);
   }
+
+  private static OAuthUserInfo getAsOAuthUserInfo(String username) {
+    return new OAuthUserInfo(AccountExternalId.SCHEME_EXTERNAL + username,
+        username, null, null, null);
+  }
 }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/cfoauth/OAuthModule.java b/src/main/java/com/googlesource/gerrit/plugins/cfoauth/OAuthModule.java
new file mode 100644
index 0000000..b1dcc8c
--- /dev/null
+++ b/src/main/java/com/googlesource/gerrit/plugins/cfoauth/OAuthModule.java
@@ -0,0 +1,47 @@
+// Copyright (C) 2015 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.googlesource.gerrit.plugins.cfoauth;
+
+import com.google.gerrit.extensions.annotations.Exports;
+import com.google.gerrit.extensions.annotations.PluginName;
+import com.google.gerrit.extensions.auth.oauth.OAuthLoginProvider;
+import com.google.gerrit.server.config.PluginConfig;
+import com.google.gerrit.server.config.PluginConfigFactory;
+import com.google.inject.AbstractModule;
+import com.google.inject.Inject;
+
+class OAuthModule extends AbstractModule {
+
+  private final PluginConfigFactory cfgFactory;
+  private final String pluginName;
+
+  @Inject
+  OAuthModule(PluginConfigFactory cfgFactory,
+      @PluginName String pluginName) {
+    this.cfgFactory = cfgFactory;
+    this.pluginName = pluginName;
+  }
+
+  @Override
+  protected void configure() {
+    PluginConfig cfg = cfgFactory.getFromGerritConfig(pluginName);
+    if (cfg.getString(InitOAuthConfig.CLIENT_ID) != null) {
+      bind(OAuthLoginProvider.class)
+       .annotatedWith(Exports.named(pluginName))
+       .to(CFOAuthService.class);
+    }
+  }
+
+}
diff --git a/src/main/java/com/googlesource/gerrit/plugins/cfoauth/UAAClient.java b/src/main/java/com/googlesource/gerrit/plugins/cfoauth/UAAClient.java
index 259339d..c1a5f1f 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/cfoauth/UAAClient.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/cfoauth/UAAClient.java
@@ -42,11 +42,17 @@
   private static final String AUTHORIZE_ENDPOINT = OAUTH_ENDPOINT
       + "authorize?response_type=code&client_id=%s&redirect_uri=%s";
   private static final String TOKEN_ENDPOINT = OAUTH_ENDPOINT + "token";
+  private static final String CHECK_TOKEN_ENDPOINT = "%s/check_token";
   private static final String TOKEN_KEY_ENDPOINT = "%s/token_key";
   private static final String USERINFO_ENDPOINT = "%s/userinfo";
 
   private static final String GRANT_TYPE = "grant_type";
   private static final String BY_AUTHORIZATION_CODE = "authorization_code";
+  private static final String BY_PASSWORD = "password";
+
+  private static final String USERNAME_PARAMETER = "username";
+  private static final String PASSWORD_PARAMETER = "password";
+  private static final String TOKEN_PARAMETER = "token";
 
   private static final String ALG_ATTRIBUTE = "alg";
   private static final String VALUE_ATTRIBUTE = "value";
@@ -54,6 +60,7 @@
   private static final String MODULUS_ATTRIBUTE = "n";
   private static final String ACCESS_TOKEN_ATTRIBUTE = "access_token";
   private static final String EXP_ATTRIBUTE = "exp";
+  private static final String SUB_ATTRIBUTE = "sub";
   private static final String USER_NAME_ATTRIBUTE = "user_name";
   private static final String EMAIL_ATTRIBUTE = "email";
   private static final String NAME_ATTRIBUTE = "name";
@@ -67,6 +74,7 @@
 
   private final String authorizationEndpoint;
   private final String accessTokenEndpoint;
+  private final String checkTokenEndpoint;
   private final String tokenKeyEndpoint;
   private final String userInfoEndpoint;
 
@@ -90,6 +98,7 @@
     this.authorizationEndpoint = String.format(AUTHORIZE_ENDPOINT,
         uaaServerUrl, encode(clientId), encode(redirectUrl));
     this.accessTokenEndpoint = String.format(TOKEN_ENDPOINT, uaaServerUrl);
+    this.checkTokenEndpoint = String.format(CHECK_TOKEN_ENDPOINT, uaaServerUrl);
     this.tokenKeyEndpoint = String.format(TOKEN_KEY_ENDPOINT, uaaServerUrl);
     this.userInfoEndpoint = String.format(USERINFO_ENDPOINT, uaaServerUrl);
   }
@@ -132,6 +141,106 @@
   }
 
   /**
+   * Retrieves an access token from the UAA server providing a user name
+   * and password following the "Resource Owner Password Credentials Grant"
+   * scheme of RFC6749 section 4.3.
+   *
+   * @param username the name of the resource owner.
+   * @param password the password of the resource owner.
+   * @return an access token.
+   *
+   * @throws UAAClientException if the UAA request failed.
+   */
+  public AccessToken getAccessToken(String username, String password)
+      throws UAAClientException{
+    if (username == null || password == null) {
+      throw new UAAClientException("Must provide user name and password");
+    }
+    OAuthRequest request = new OAuthRequest(POST, accessTokenEndpoint);
+    request.addHeader(AUTHORIZATION_HEADER, clientCredentials);
+    request.addQuerystringParameter(GRANT_TYPE, BY_PASSWORD);
+    request.addQuerystringParameter(USERNAME_PARAMETER, username);
+    request.addQuerystringParameter(PASSWORD_PARAMETER, password);
+    Response response = request.send();
+    if (response.getCode() == 401) {
+      throw new UAAClientException("Invalid username or password");
+    }
+    if (response.getCode() != 200) {
+      throw new UAAClientException(MessageFormat.format(
+          "POST /oauth/token failed with status {0}", response.getCode()));
+    }
+    String tokenResponse = response.getBody();
+    if (Strings.isNullOrEmpty(tokenResponse)) {
+      throw new UAAClientException(
+          "POST /oauth/token failed: invalid access token response");
+    }
+    return parseAccessTokenResponse(tokenResponse);
+  }
+
+  /**
+   * Verifies the given access token with the UAA server.
+   * This method passes the access token to the <tt>/check_token</tt>
+   * endpoint of the UAA server.
+   *
+   * @param accessToken the access token to verify.
+   * @return <code>true</code> if the token could be verified.
+   *
+   * @throws UAAClientException if the UAA request failed.
+   */
+  public boolean verifyAccessToken(String accessToken)
+      throws UAAClientException {
+    OAuthRequest request = new OAuthRequest(POST, checkTokenEndpoint);
+    request.addHeader(AUTHORIZATION_HEADER, clientCredentials);
+    request.addBodyParameter(TOKEN_PARAMETER, accessToken);
+    Response response = request.send();
+    if (response.getCode() == 400) {
+      return false;
+    }
+    if (response.getCode() != 200) {
+      throw new UAAClientException(MessageFormat.format(
+          "POST /check_token failed with status {0}", response.getCode()));
+    }
+    return true;
+  }
+
+  /**
+   * Checks if the given access token is valid and is owned by the given user.
+   *
+   * @param username the name of the token owner.
+   * @param accessToken the access token to check.
+   *
+   * @return <code>true</code> if the token is valid and belongs to
+   * the given user.
+   */
+  public boolean isAccessTokenForUser(String username, String accessToken) {
+    try {
+      JsonObject jsonWebToken = toJsonWebToken(accessToken);
+      return username.equals(getAttribute(jsonWebToken, USER_NAME_ATTRIBUTE));
+    } catch (UAAClientException e) {
+      return false;
+    }
+  }
+
+  /**
+   * Checks if the given access token is valid and is owned by the given client.
+   *
+   * @param clientname the name of the client.
+   * @param accessToken the access token to check.
+   *
+   * @return <code>true</code> if the token is valid and belongs to
+   * the given client.
+   */
+  public boolean isAccessTokenForClient(String clientname, String accessToken) {
+    try {
+      JsonObject jsonWebToken = toJsonWebToken(accessToken);
+      return getAttribute(jsonWebToken, USER_NAME_ATTRIBUTE) == null &&
+          clientname.equals(getAttribute(jsonWebToken, SUB_ATTRIBUTE));
+    } catch (UAAClientException e) {
+      return false;
+    }
+  }
+
+  /**
    * Converts an access token given as string represenation
    * into an {@link AccessToken}.
    *
diff --git a/src/main/resources/Documentation/config.md b/src/main/resources/Documentation/config.md
index 75fc683..1ca272f 100644
--- a/src/main/resources/Documentation/config.md
+++ b/src/main/resources/Documentation/config.md
@@ -5,7 +5,7 @@
 
 Gerrit must be registered as client with the [CloudFoundry User Account and
 Authentication (UAA) Server](https://github.com/cloudfoundry/uaa) that acts
-as OAuth2 authentication and authorization backend.
+as OAuth 2 authentication and authorization backend.
 
 The following sequence assumes that the UAA client application (`uaac`) is
 installed. It will create a client with name `gerrit`.
@@ -22,20 +22,27 @@
     --autoapprove openid
     --access_token_validity <time in seconds>
     --redirect_uri <URL of the Gerrit server>/oauth
-    --secret <client secret>
+    --secret <secret>
 ```
 
-Make sure to choose a strong password for `secret`. Gerrit uses
-this password to obtain access tokens on behalf of its users.
+Make sure to choose a reasonable access token validity if you want to use
+access tokens to authenticate Git over HTTP communication. If tokens expire
+frequently using them with a native Git client might be cumbersome.
+On the other side, acccess tokens should be treated like passwords and
+should be changed from time to time for security reasons.
+
+Make sure to choose a strong password for `secret`.
 
 ## Configuring the @PLUGIN@ Plugin
 
 The configuration of the @PLUGIN@ plugin is done in the `gerrit.config`
-file. Note that `auth.type` must be set to `OAUTH`.
+file.
 
 ```
 [auth]
   type = OAUTH
+  gitBacicAuth = true
+  gitOAuthProvider = cfoauth:cfoauth
 
 [plugin "@PLUGIN@"]
   serverUrl = <URL of the UAA server>
@@ -44,26 +51,24 @@
   verifySignatures = true
 ```
 
+The `type` must be set to `OAUTH`.
+
+When the `gitBasicAuth` parameter is set to `true`, the UAA will be used
+to also authenticate Git over HTTP communication. If there are multiple
+OAuth providers installed that are capable of authenticating Git over HTTP
+traffic, add the parameter `gitOAuthProvider = cfoauth:cfoauth` to select
+the @PLUGIN@ plugin as default OAuth provider.
+
+For Git over HTTP communication the plugin accepts passwords and OAuth2
+access tokens sent in an `Authorization` header following the `BASIC`
+authentication scheme (RFC 2617 section 2). The plugin will pass
+credentials directly to UAA for verification.
+
+The `serverUrl` must point to the UAA server and include the
+context path, e.g `http(s)://example.org/uaa`.
+
 The parameters `clientId` and `clientSecret` must match the name and
-password of the Gerrit client as registered with the UAA server above.
-The `serverUrl` must point to the UAA server and include the context path,
-e.g `http(s)://example.org/uaa`.
-
-Alternatively, re-run `init` to configure the @PLUGIN@ plugin:
-
-```
-  java -jar gerrit.war init -d <site>
-  [...]
-
-  *** Cloud Foundry UAA OAuth 2.0 Authentication Provider
-  ***
-
-  UAA server URL    [http://localhost:8080/uaa]: <URL of the UAA server>
-  Client id         [gerrit]: <client id>
-  Client secret             : <client secret>
-           confirm password : <client secret>
-  Verify token signatures [Y/n]?
-```
+password of the Gerrit client as registered with the UAA server.
 
 UAA issues so-called [JSON Web Tokens](http://tools.ietf.org/html/rfc7519]),
 which include a signature. By default, the @PLUGIN@ plugin will verify
@@ -73,3 +78,22 @@
 the verification by setting the parameter `verifySignatures` to `false`.
 Note that this is strongly discouraged for security reasons.
 
+## Using Init for Configuring the @PLUGIN@ Plugin
+
+The @PLUGIN@ plugin can also be configured during setting up Gerrit with
+the `init` command:
+
+```
+  java -jar gerrit.war init -d <site>
+  [...]
+
+  *** Cloud Foundry UAA OAuth 2.0 Authentication Provider
+  ***
+
+  UAA server URL    [http://localhost:8080/uaa]: <serverUrl>
+  Client id         [gerrit]: <clientId>
+  Client secret             : <clientSecret>
+           confirm password : <clientSecret>
+  Verify token signatures [Y/n]? <verifySignatures>
+```
+