UsernamePasswordAuthenticationToken authentication)
throws AuthenticationException {
super.additionalAuthenticationChecks(userDetails, authentication);
SignedUsernamePasswordAuthenticationToken signedToken = (SignedUsernamePasswordAuthenticationToken) authentication;
if (signedToken.getRequestSignature() == null) {
throw new BadCredentialsException(messages.getMessage(
"SignedUsernamePasswordAuthenticationProvider"
+ " .missingSignature",
"Missing request signature"),
isIncludeDetailsObject() ? userDetails : null);
}
// calculate expected signature
if (!signedToken.getRequestSignature().equals(
calculateExpectedSignature(signedToken))) {
throw new BadCredentialsException(
messages
.getMessage(
"SignedUsernamePasswordAuthenticationProvider.badSignature",
"Invalid request signature"),
isIncludeDetailsObject() ? userDetails : null);