public AuthResult validateRequest(Request request, Response response, boolean isAuthMandatory) throws ServerAuthException {
try {
Session session = request.getSessionInternal(isAuthMandatory);
if (session == null) {
//default identity??
return new AuthResult(TomcatAuthStatus.SUCCESS, null);
}
if (matchRequest(request, session)) {
// if (log.isDebugEnabled())
// log.debug("Restore request from session '"
// + session.getIdInternal()
// + "'");
// UserIdentity userIdentity = (UserIdentity)
// session.getNote(Constants.FORM_PRINCIPAL_NOTE);
// register(request, response, principal, Constants.FORM_METHOD,
// (String) session.getNote(Constants.SESS_USERNAME_NOTE),
// (String) session.getNote(Constants.SESS_PASSWORD_NOTE));
// If we're caching principals we no longer need the username
// and password in the session, so remove them
// if (cache) {
// session.removeNote(Constants.SESS_USERNAME_NOTE);
// session.removeNote(Constants.SESS_PASSWORD_NOTE);
// }
if (!restoreRequest(request, session)) {
// if (log.isDebugEnabled())
// log.debug("Proceed to restored request");
// return new AuthResult(TomcatAuthStatus.SUCCESS, userIdentity);
// } else {
// if (log.isDebugEnabled())
// log.debug("Restore of original request failed");
response.sendError(HttpServletResponse.SC_BAD_REQUEST);
return new AuthResult(TomcatAuthStatus.SEND_FAILURE, null);
}
}
UserIdentity userIdentity = (UserIdentity) session.getNote(Constants.FORM_PRINCIPAL_NOTE);
if (userIdentity != null) {
return new AuthResult(TomcatAuthStatus.SUCCESS, userIdentity);
}
//we have not yet completed authentication.
// Acquire references to objects we will need to evaluate
MessageBytes uriMB = MessageBytes.newInstance();
CharChunk uriCC = uriMB.getCharChunk();
uriCC.setLimit(-1);
String contextPath = request.getContextPath();
String requestURI = request.getDecodedRequestURI();
response.setContext(request.getContext());
// Is this the action request from the login page?
boolean loginAction =
requestURI.startsWith(contextPath) &&
requestURI.endsWith(Constants.FORM_ACTION);
// No -- Save this request and redirect to the form login page
if (!loginAction) {
// session = request.getSessionInternal(true);
// if (log.isDebugEnabled())
// log.debug("Save request in session '" + session.getIdInternal() + "'");
if (!isAuthMandatory) {
return new AuthResult(TomcatAuthStatus.SUCCESS, null);
}
try {
saveRequest(request, session);
} catch (IOException ioe) {
// log.debug("Request body too big to save during authentication");
response.sendError(HttpServletResponse.SC_BAD_REQUEST,
sm.getString("authenticator.requestBodyTooBig"));
return new AuthResult(TomcatAuthStatus.SEND_FAILURE, null);
}
forwardToLoginPage(request, response);
return new AuthResult(TomcatAuthStatus.SEND_CONTINUE, unauthenticatedIdentity);
}
// Yes -- Validate the specified credentials and redirect
// to the error page if they are not correct
// if (characterEncoding != null) {
// request.setCharacterEncoding(characterEncoding);
// }
String username = request.getParameter(Constants.FORM_USERNAME);
String password = request.getParameter(Constants.FORM_PASSWORD);
// if (log.isDebugEnabled())
// log.debug("Authenticating username '" + username + "'");
userIdentity = loginService.login(username, password);
if (userIdentity == null) {
// if (isAuthMandatory) {
forwardToErrorPage(request, response);
//TODO right status?
return new AuthResult(TomcatAuthStatus.SEND_FAILURE, unauthenticatedIdentity);
// } else {
// userIdentity = unauthenticatedIdentity;
// }
}
// if (log.isDebugEnabled())
// log.debug("Authentication of '" + username + "' was successful");
if (session == null)
session = request.getSessionInternal(false);
if (session == null) {
// if (containerLog.isDebugEnabled())
// containerLog.debug
// ("User took so long to log on the session expired");
response.sendError(HttpServletResponse.SC_REQUEST_TIMEOUT,
sm.getString("authenticator.sessionExpired"));
return new AuthResult(TomcatAuthStatus.SEND_FAILURE, unauthenticatedIdentity);
}
// Save the authenticated Principal in our session
session.setNote(Constants.FORM_PRINCIPAL_NOTE, userIdentity);
// Save the username and password as well
session.setNote(Constants.SESS_USERNAME_NOTE, username);
session.setNote(Constants.SESS_PASSWORD_NOTE, password);
// Redirect the user to the original request URI (which will cause
// the original request to be restored)
requestURI = savedRequestURL(session);
// if (log.isDebugEnabled())
// log.debug("Redirecting to original '" + requestURI + "'");
if (requestURI == null) {
response.sendError(HttpServletResponse.SC_BAD_REQUEST,
sm.getString("authenticator.formlogin"));
return new AuthResult(TomcatAuthStatus.SEND_FAILURE, null);
} else {
response.sendRedirect(response.encodeRedirectURL(requestURI));
return new AuthResult(TomcatAuthStatus.SEND_CONTINUE, userIdentity);
}
} catch (IOException e) {
throw new ServerAuthException(e);
}