@Override
public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject, Subject serviceSubject)
throws AuthException {
Request request = (Request) messageInfo.getRequestMessage();
Response response = (Response) messageInfo.getResponseMessage();
Principal principal;
context = request.getContext();
LoginConfig config = context.getLoginConfig();
// references to objects we will need later.
Session session = null;
// lets find out if the cache is enabled or not.
cache = Boolean.valueOf((String) messageInfo.getMap().get("CACHE"));
// have we authenticated this user before but have caching disabled?
if (!cache) {
session = request.getSessionInternal(true);
WebLogger.WEB_SECURITY_LOGGER.debugf("Checking for reauthenticate in session %s", session.getIdInternal());
String username = (String) session.getNote(Constants.SESS_USERNAME_NOTE);
String password = (String) session.getNote(Constants.SESS_PASSWORD_NOTE);
if ((username != null) && (password != null)) {
WebLogger.WEB_SECURITY_LOGGER.debugf("Reauthenticating username '%s'", username);
principal = context.getRealm().authenticate(username, password);
if (principal != null) {
session.setNote(Constants.FORM_PRINCIPAL_NOTE, principal);
if (!matchRequest(request)) {
registerWithCallbackHandler(principal, username, password);
return AuthStatus.SUCCESS;
}
}
WebLogger.WEB_SECURITY_LOGGER.tracef("Reauthentication failed, proceed normally");
}
}
// is this the re-submit of the original request URI after successful authentication? If so, forward the *original* request instead.
if (matchRequest(request)) {
session = request.getSessionInternal(true);
WebLogger.WEB_SECURITY_LOGGER.tracef("Restore request from session '%s'", session.getIdInternal());
principal = (Principal) session.getNote(Constants.FORM_PRINCIPAL_NOTE);
registerWithCallbackHandler(principal,
(String) session.getNote(Constants.SESS_USERNAME_NOTE),
(String) session.getNote(Constants.SESS_PASSWORD_NOTE));
// if we're caching principals we no longer need the username and password in the session, so remove them.
if (cache) {
session.removeNote(Constants.SESS_USERNAME_NOTE);
session.removeNote(Constants.SESS_PASSWORD_NOTE);
}
if (restoreRequest(request, session)) {
WebLogger.WEB_SECURITY_LOGGER.tracef("Proceed to restored request");
return (AuthStatus.SUCCESS);
} else {
WebLogger.WEB_SECURITY_LOGGER.tracef("Restore of original request failed");
try {
response.sendError(HttpServletResponse.SC_BAD_REQUEST);
} catch (IOException e) {
// Ignore IOException here (client disconnect)
}
return AuthStatus.FAILURE;
}
}
// acquire references to objects we will need to evaluate.
MessageBytes uriMB = MessageBytes.newInstance();
CharChunk uriCC = uriMB.getCharChunk();
uriCC.setLimit(-1);
String contextPath = request.getContextPath();
String requestURI = request.getDecodedRequestURI();
// is this the action request from the login page?
boolean loginAction = requestURI.startsWith(contextPath) && requestURI.endsWith(Constants.FORM_ACTION);
// no - save this request and redirect to the form login page.
if (!loginAction) {
session = request.getSessionInternal(true);
WebLogger.WEB_SECURITY_LOGGER.tracef("Save request in session '%s'", session.getIdInternal());
try {
saveRequest(request, session);
} catch (IOException ioe) {
WebLogger.WEB_SECURITY_LOGGER.tracef("Request body too big to save during authentication");
try {
response.sendError(HttpServletResponse.SC_FORBIDDEN, sm.getString("authenticator.requestBodyTooBig"));
} catch (IOException e) {
// Ignore IOException here (client disconnect)
throw new AuthException(e.getLocalizedMessage());
}
return (AuthStatus.FAILURE);
}
forwardToLoginPage(request, response, config);
return (AuthStatus.SEND_CONTINUE);
}
// yes - validate the specified credentials and redirect to the error page if they are not correct
Realm realm = context.getRealm();
String characterEncoding = request.getCharacterEncoding();
if (characterEncoding != null) {
try {
request.setCharacterEncoding(characterEncoding);
} catch (UnsupportedEncodingException e) {
WebLogger.WEB_SECURITY_LOGGER.unsupportedEncoding(e.getLocalizedMessage());
}
}
String username = request.getParameter(Constants.FORM_USERNAME);
String password = request.getParameter(Constants.FORM_PASSWORD);
WebLogger.WEB_SECURITY_LOGGER.tracef("Authenticating username '%s'", username);
principal = realm.authenticate(username, password);
if (principal == null) {
forwardToErrorPage(request, response, config);
return (AuthStatus.FAILURE);
}
WebLogger.WEB_SECURITY_LOGGER.tracef("Authentication of '%s' was successful", username);
if (session == null)
session = request.getSessionInternal(false);
if (session == null) {
WebLogger.WEB_SECURITY_LOGGER.tracef("User took so long to log on the session expired");
try {
response.sendError(HttpServletResponse.SC_REQUEST_TIMEOUT, sm.getString("authenticator.sessionExpired"));
} catch (IOException e) {