log.debug("Authentication failed due to no temp User matching session token {}", rawToken);
throw new WebApplicationException(Response.Status.UNAUTHORIZED);
}
// Must have a temporary User to be here
User tempUser = tempUserOptional.get();
// Retrieve the discovery information
final DiscoveryInformationMemento memento = tempUser.getOpenIDDiscoveryInformationMemento();
Identifier identifier = new Identifier() {
@Override
public String getIdentifier() {
return memento.getClaimedIdentifier();
}
};
DiscoveryInformation discovered;
try {
discovered = new DiscoveryInformation(
URI.create(memento.getOpEndpoint()).toURL(),
identifier,
memento.getDelegate(),
memento.getVersion(),
memento.getTypes()
);
} catch (DiscoveryException e) {
throw new WebApplicationException(e, Response.Status.UNAUTHORIZED);
} catch (MalformedURLException e) {
throw new WebApplicationException(e, Response.Status.UNAUTHORIZED);
}
// Extract the receiving URL from the HTTP request
StringBuffer receivingURL = request.getRequestURL();
String queryString = request.getQueryString();
if (queryString != null && queryString.length() > 0) {
receivingURL.append("?").append(request.getQueryString());
}
log.debug("Receiving URL = '{}", receivingURL.toString());
// Extract the parameters from the authentication response
// (which comes in as a HTTP request from the OpenID provider)
ParameterList parameterList = new ParameterList(request.getParameterMap());
try {
// Verify the response
// ConsumerManager needs to be the same (static) instance used
// to place the authentication request
// This could be tricky if this service is load-balanced
VerificationResult verification = manager.verify(
receivingURL.toString(),
parameterList,
discovered);
// Examine the verification result and extract the verified identifier
Optional<Identifier> verified = Optional.fromNullable(verification.getVerifiedId());
if (verified.isPresent()) {
// Verified
AuthSuccess authSuccess = (AuthSuccess) verification.getAuthResponse();
// We have successfully authenticated so remove the temp user
// and replace it with a potentially new one
userDao.delete(tempUser);
tempUser = new User(UUID.randomUUID());
tempUser.setOpenIDIdentifier(verified.get().getIdentifier());
// Provide a basic authority in light of successful authentication
tempUser.getAuthorities().add(Authority.ROLE_PUBLIC);
// Extract additional information
if (authSuccess.hasExtension(AxMessage.OPENID_NS_AX)) {
tempUser.setEmailAddress(extractEmailAddress(authSuccess));
tempUser.setFirstName(extractFirstName(authSuccess));
tempUser.setLastName(extractLastName(authSuccess));
}
log.info("Extracted a temporary {}", tempUser);
// Search for a pre-existing User matching the temp User
Optional<User> userOptional = userDao.getByOpenIDIdentifier(tempUser.getOpenIDIdentifier());
User user;
if (!userOptional.isPresent()) {
// This is either a new registration or the OpenID identifier has changed
if (tempUser.getEmailAddress() != null) {
userOptional = userDao.getByEmailAddress(tempUser.getEmailAddress());
if (!userOptional.isPresent()) {
// This is a new User
log.debug("Registering new {}", tempUser);
user = userDao.saveOrUpdate(tempUser);
} else {
// The OpenID identifier has changed so update it
log.debug("Updating OpenID identifier for {}", tempUser);
user = userOptional.get();
user.setOpenIDIdentifier(tempUser.getOpenIDIdentifier());
user = userDao.saveOrUpdate(user);
}
} else {
// No email address to use as backup
log.warn("Rejecting valid authentication. No email address for {}");