/**
* This method should be called by extensions of this class within their
* implementation of authenticate().
*/
protected void verifyUser(String userName, String password) throws HandlerException {
User ud = getUserData(userName);
String realpassword = ud.getPassword();
boolean encrypted = Boolean.valueOf(WebloggerConfig.getProperty("passwds.encryption.enabled"));
if (encrypted) {
password = Utilities.encodePassword(password, WebloggerConfig.getProperty("passwds.encryption.algorithm"));
}
if (!userName.trim().equals(ud.getUserName())) {
throw new UnauthorizedException("ERROR: User is not authorized: " + userName);
}
if (!password.trim().equals(realpassword)) {
throw new UnauthorizedException("ERROR: User is not authorized: " + userName);
}
if (!ud.hasRole("admin")) {
throw new UnauthorizedException("ERROR: User must have the admin role to use the RAP endpoint: " + userName);
}
if (!ud.getEnabled().booleanValue()) {
throw new UnauthorizedException("ERROR: User is disabled: " + userName);
}
}