* @since 2.3
*/
public final boolean login( HttpServletRequest request ) throws WikiSecurityException
{
HttpSession httpSession = request.getSession();
WikiSession session = SessionMonitor.getInstance(m_engine).find( httpSession );
AuthenticationManager authenticationMgr = m_engine.getAuthenticationManager();
AuthorizationManager authorizationMgr = m_engine.getAuthorizationManager();
CallbackHandler handler = null;
Map<String,String> options = EMPTY_MAP;
// If user not authenticated, check if container logged them in, or if
// there's an authentication cookie
if ( !session.isAuthenticated() )
{
// Create a callback handler
handler = new WebContainerCallbackHandler( m_engine, request );
// Execute the container login module, then (if that fails) the cookie auth module
Set<Principal> principals = authenticationMgr.doJAASLogin( WebContainerLoginModule.class, handler, options );
if ( principals.size() == 0 && authenticationMgr.allowsCookieAuthentication() )
{
principals = authenticationMgr.doJAASLogin( CookieAuthenticationLoginModule.class, handler, options );
}
// If the container logged the user in successfully, tell the WikiSession (and add all of the Principals)
if ( principals.size() > 0 )
{
fireEvent( WikiSecurityEvent.LOGIN_AUTHENTICATED, getLoginPrincipal( principals ), session );
for ( Principal principal : principals )
{
fireEvent( WikiSecurityEvent.PRINCIPAL_ADD, principal, session );
}
// Add all appropriate Authorizer roles
injectAuthorizerRoles( session, authorizationMgr.getAuthorizer(), request );
}
}
// If user still not authenticated, check if assertion cookie was supplied
if ( !session.isAuthenticated() && authenticationMgr.allowsCookieAssertions() )
{
// Execute the cookie assertion login module
Set<Principal> principals = authenticationMgr.doJAASLogin( CookieAssertionLoginModule.class, handler, options );
if ( principals.size() > 0 )
{
fireEvent( WikiSecurityEvent.LOGIN_ASSERTED, getLoginPrincipal( principals ), session);
}
}
// If user still anonymous, use the remote address
if (session.isAnonymous() )
{
Set<Principal> principals = authenticationMgr.doJAASLogin( AnonymousLoginModule.class, handler, options );
if ( principals.size() > 0 )
{
fireEvent( WikiSecurityEvent.LOGIN_ANONYMOUS, getLoginPrincipal( principals ), session );