private Author getAuthorAndCheckAuthentication(HttpServletRequest request) {
String accountName = request.getParameter("account");
String password = request.getParameter("password");
SessionAuthentication auth = (SessionAuthentication) request.getSession().getAttribute(SESSION_AUTHENTICATION_ATTRIBUTE_NAME);
Author author;
if (accountName == null || password == null) {
if (auth == null) {
logger.debug("login data missing");
throw new IllegalArgumentException("login data missing");
}
author = CollabReviewSingleton.get().getAuthorManager().getAuthor(auth.getUserName());
author.authenticate(auth.getPassword());
} else {
// wait a moment to reduce risk of brute force attacks
try {
Thread.sleep(500);
} catch (InterruptedException e) {
}
logger.debug("Login attempt: " + accountName);
author = CollabReviewSingleton.get().getAuthorManager().getAuthor(accountName);
author.authenticate(password);
auth = new SessionAuthentication(accountName, password);
}
if (!author.isAuthenticated()) {
logger.warn("Authentication failed for user " + accountName);
throw new IllegalArgumentException("login failed");
}
request.getSession().setAttribute(SESSION_AUTHENTICATION_ATTRIBUTE_NAME, auth);
return author;