/**
* RexPro authentication
*/
public NextAction handleRead(final FilterChainContext ctx) throws IOException {
final RexProRequest request = ctx.getMessage();
request.process();
final RexProMessage message = request.getRequestMessage();
if (message instanceof SessionRequestMessage && !message.hasSession()) {
final SessionRequestMessage specificMessage = (SessionRequestMessage) message;
if (!specificMessage.metaGetKillSession()) {
final String username = specificMessage.Username;
final String password = specificMessage.Password;
if (!authenticate(username, password)) {
// there is no session to this message...that's a problem
final ErrorResponseMessage errorMessage = new ErrorResponseMessage();
errorMessage.setSessionAsUUID(RexProMessage.EMPTY_SESSION);
errorMessage.Request = specificMessage.Request;
errorMessage.ErrorMessage = "Invalid username or password.";
errorMessage.metaSetFlag(ErrorResponseMessage.AUTH_FAILURE_ERROR);
request.writeResponseMessage(errorMessage);
ctx.write(request);
return ctx.getStopAction();
}
}
} else if (message instanceof ScriptRequestMessage && !message.hasSession()) {
// sessionless script requests don't support secure requests atm - requires a changes to the
// rexpro protocol to do so
// there is no session to this message...that's a problem
final ErrorResponseMessage errorMessage = new ErrorResponseMessage();
errorMessage.setSessionAsUUID(RexProMessage.EMPTY_SESSION);
errorMessage.Request = message.Request;
errorMessage.ErrorMessage = "Cannot make sessionless requests with <security> turned on.";
errorMessage.metaSetFlag(ErrorResponseMessage.AUTH_FAILURE_ERROR);
request.writeResponseMessage(errorMessage);
ctx.write(request);
return ctx.getStopAction();
}