if (pathRequested.endsWith(FORM_ACTION)) {
String username = request.getParameter(FORM_USER);
String password = request.getParameter(FORM_PASS);
// Send to error page if invalid
AuthenticationPrincipal principal = this.realm
.authenticateByUsernamePassword(username, password);
if (principal == null) {
javax.servlet.RequestDispatcher rdError = request
.getRequestDispatcher(this.errorPage);
rdError.forward(request, response);
}
// Send to stashed request
else {
// Iterate back as far as we can
ServletRequest wrapperCheck = request;
while (wrapperCheck instanceof HttpServletRequestWrapper) {
wrapperCheck = ((HttpServletRequestWrapper) wrapperCheck).getRequest();
}
// Get the stashed request
WinstoneRequest actualRequest = null;
if (wrapperCheck instanceof WinstoneRequest) {
actualRequest = (WinstoneRequest) wrapperCheck;
actualRequest.setRemoteUser(principal);
} else {
Logger.log(Logger.WARNING, AUTH_RESOURCES,
"FormAuthenticationHandler.CantSetUser",
wrapperCheck.getClass().getName());
}
HttpSession session = request.getSession(true);
String previousLocation = this.loginPage;
RetryRequestParams cachedRequest = (RetryRequestParams)
session.getAttribute(CACHED_REQUEST);
if ((cachedRequest != null) && (actualRequest != null)) {
// Repopulate this request from the params we saved
request = new RetryRequestWrapper(request, cachedRequest);
previousLocation =
(request.getServletPath() == null ? "" : request.getServletPath()) +
(request.getPathInfo() == null ? "" : request.getPathInfo());
} else {
Logger.log(Logger.DEBUG, AUTH_RESOURCES,
"FormAuthenticationHandler.NoCachedRequest");
}
// do role check, since we don't know that this user has permission
if (doRoleCheck(request, response, previousLocation)) {
principal.setAuthType(HttpServletRequest.FORM_AUTH);
session.setAttribute(AUTHENTICATED_USER, principal);
javax.servlet.RequestDispatcher rdPrevious = request
.getRequestDispatcher(previousLocation);
rdPrevious.forward(request, response);
} else {
javax.servlet.RequestDispatcher rdError = request
.getRequestDispatcher(this.errorPage);
rdError.forward(request, response);
}
}
return false;
}
// If it's not a login, get the session, and look up the auth user variable
else {
WinstoneRequest actualRequest = null;
if (request instanceof WinstoneRequest) {
actualRequest = (WinstoneRequest) request;
} else if (request instanceof HttpServletRequestWrapper) {
HttpServletRequestWrapper wrapper = (HttpServletRequestWrapper) request;
if (wrapper.getRequest() instanceof WinstoneRequest) {
actualRequest = (WinstoneRequest) wrapper.getRequest();
} else {
Logger.log(Logger.WARNING, AUTH_RESOURCES,
"FormAuthenticationHandler.CantSetUser", wrapper
.getRequest().getClass().getName());
}
} else {
Logger.log(Logger.WARNING, AUTH_RESOURCES,
"FormAuthenticationHandler.CantSetUser", request
.getClass().getName());
}
HttpSession session = actualRequest.getSession(false);
if (session != null) {
AuthenticationPrincipal authenticatedUser = (AuthenticationPrincipal)
session.getAttribute(AUTHENTICATED_USER);
if (authenticatedUser != null) {
actualRequest.setRemoteUser(authenticatedUser);
Logger.log(Logger.FULL_DEBUG, AUTH_RESOURCES,
"FormAuthenticationHandler.GotUserFromSession");