public class AuthenticationSessionStrategyDefault extends AuthenticationSessionStrategyAbstract {
@Override
public AuthenticationSession lookupValid(final ServletRequest servletRequest, final ServletResponse servletResponse) {
final AuthenticationManager authenticationManager = getAuthenticationManager();
final HttpSession httpSession = getHttpSession(servletRequest);
// use previously authenticated session if available
AuthenticationSession authSession = (AuthenticationSession) httpSession.getAttribute(WebAppConstants.HTTP_SESSION_AUTHENTICATION_SESSION_KEY);
if (authSession != null) {
final boolean sessionValid = authenticationManager.isSessionValid(authSession);
if (sessionValid) {
return authSession;
}
}
// otherwise, look for LogonFixture and try to authenticate
final ServletContext servletContext = getServletContext(servletRequest);
final IsisSystem system = (IsisSystem) servletContext.getAttribute(WebAppConstants.ISIS_SYSTEM_KEY);
if (system == null) {
// not expected to happen...
return null;
}
final LogonFixture logonFixture = system.getLogonFixture();
// see if exploration is supported
if (system.getDeploymentType().isExploring()) {
authSession = authenticationManager.authenticate(new AuthenticationRequestExploration(logonFixture));
if (authSession != null) {
return authSession;
}
}
final boolean loggedInUsingLogonFixture = httpSession.getAttribute(WebAppConstants.HTTP_SESSION_LOGGED_ON_PREVIOUSLY_USING_LOGON_FIXTURE_KEY) != null;
if (logonFixture != null && !loggedInUsingLogonFixture) {
httpSession.setAttribute(WebAppConstants.HTTP_SESSION_LOGGED_ON_PREVIOUSLY_USING_LOGON_FIXTURE_KEY, true);
return authenticationManager.authenticate(new AuthenticationRequestLogonFixture(logonFixture));
}
return null;
}