Filter which processes OpenID authentication requests.
The OpenID authentication involves two stages.
Submission of OpenID identity
The user's OpenID identity is submitted via a login form, just as it would be for a normal form login. At this stage the filter will extract the identity from the submitted request (by default, the parameter is called
openid_identifier, as recommended by the OpenID 2.0 Specification). It then passes the identity to the configured
OpenIDConsumer, which returns the URL to which the request should be redirected for authentication. A "return_to" URL is also supplied, which matches the URL processed by this filter, to allow the filter to handle the request once the user has been successfully authenticated. The OpenID server will then authenticate the user and redirect back to the application.
Processing the Redirect from the OpenID Server
Once the user has been authenticated externally, the redirected request will be passed to the
OpenIDConsumer again for validation. The returned
OpenIDAuthentication will be passed to the
AuthenticationManager where it should (normally) be processed by an
OpenIDAuthenticationProvider in order to load the authorities for the user.
@author Robin Bramley
@author Ray Krueger
@author Luke Taylor
@since 2.0
@see OpenIDAuthenticationProvider