ListIterator iter = req.getHeaders(header_name);
boolean found = false;
while (iter.hasNext() == true)
{
found = true;
AuthorizationHeader header = (AuthorizationHeader) iter.next();
String call_id = ((CallIdHeader) req.getHeader(CallIdHeader.NAME))
.getCallId();
if (JipletLogger.isDebugEnabled() == true)
{
JipletLogger.debug("Found an authentication entry for call-id"
+ call_id + " for realm " + header.getRealm());
}
// check if the user has already been authenticated
String[] uroles = authorizations.findEntry(header.getRealm(),
call_id, header.getNonce(), header.getResponse());
if (uroles != null)
{
if (JipletLogger.isDebugEnabled() == true)
{
JipletLogger.debug("Authenticated call-id " + call_id
+ " from cached authentications");
}
// update the cached information with the new time-stamp
AuthorizationInfo ainfo = new AuthorizationInfo();
ainfo.setRealm(realm_name);
ainfo.setResponse(header.getResponse());
ainfo.setCallId(call_id);
ainfo.setNonce(header.getNonce());
authorizations.addEntry(ainfo, new Date());
// the user has a prior authentication for this realm, check if
// the user has proper authority
if (hasAuthorization(roles, uroles) == true)
{
return new Pair(new JipletPrincipal(header.getUsername()),
uroles);
}
else
{
// send a FORBIDDEN response
sendResponse(jiplet, event, Response.FORBIDDEN,
"You are not authorized to use this service", null);
return null;
}
}
else
{
// the user either does not prior authentication or the auth
// failed. Check if the authentication info that the user has
// sent can
// be authenticated.
try
{
// set the context class loader to that of the realm.
Thread.currentThread().setContextClassLoader(
realm.getClass().getClassLoader());
uroles = realm.authenticate(req.getMethod(), header);
}
finally
{
Thread.currentThread().setContextClassLoader(cl);
}
if (uroles != null)
{
// add the information to the cached authorizations
AuthorizationInfo ainfo = new AuthorizationInfo();
ainfo.setRealm(realm_name);
ainfo.setResponse(header.getResponse());
ainfo.setCallId(call_id);
ainfo.setNonce(header.getNonce());
authorizations.addEntry(ainfo, new Date());
// the user has proper authentication for this realm, check
// if the user has proper authority
if (hasAuthorization(roles, uroles) == true)
{
return new Pair(new JipletPrincipal(header
.getUsername()), uroles);
}
else
{
// send a FORBIDDEN response