* @throws UnauthorizedException if the username and password do not match
* any existing user.
*/
public Authorization createAuthorization(String username, String password) throws UnauthorizedException {
if (username == null || password == null) {
throw new UnauthorizedException();
}
//stores all passwords in hashed form. So, hash the plain text
//password for comparison.
password = StringUtils.hash(password);
int userID = 0;
Connection con = null;
PreparedStatement pstmt = null;
try {
con = DbConnectionManager.getConnection();
pstmt = con.prepareStatement(AUTHORIZE);
pstmt.setString(1, username);
pstmt.setString(2, password);
ResultSet rs = pstmt.executeQuery();
//If the query had no results, the username and password
//did not match a user record. Therefore, throw an exception.
if (!rs.next()) {
throw new UnauthorizedException();
}
userID = rs.getInt(1);
} catch (SQLException sqle) {
log.error("Exception in DbAuthorizationFactory:" , sqle);
throw new UnauthorizedException();
} finally {
try {
pstmt.close();
} catch (Exception e) {
log.error("pstmt close",e);