public String verifyResponse(HttpServletRequest httpReq) {
try {
// extract the parameters from the authentication response
// (which comes in as a HTTP request from the OpenID providerType)
ParameterList response =
new ParameterList(httpReq.getParameterMap());
StringBuilder receivingURL = new StringBuilder(returnToUrl());
String queryString = httpReq.getQueryString();
if (queryString != null && queryString.length() > 0) {
receivingURL.append("?").append(httpReq.getQueryString());
}
// verify the response; ConsumerManager needs to be the same
// (static) instance used to place the authentication request
VerificationResult verification =
manager.verify(receivingURL.toString(), response,
discovered);
// The OpenId provider cancelled the authentication
if ("cancel".equals(response.getParameterValue("openid.mode"))) {
// TODO This should be done at a higher level. i.e. instead of
// returning a string, return an
// object that holds more information for the UI to render
FacesMessages.instance().add(StatusMessage.Severity.INFO,
"Authentication Request Cancelled");