substitutedPathInContext = substitutedPathInContext.replaceAll("%3A", "%3A%3A");
if (substitutedPathInContext.indexOf(":") > -1)
substitutedPathInContext = substitutedPathInContext.replaceAll(":", "%3A");
Authenticator authenticator = getAuthenticator();
boolean isAuthenticated = false;
if (authenticator instanceof FormAuthenticator
&& pathInContext.endsWith(FormAuthenticator.__J_SECURITY_CHECK)) {
/**
* This is a post request to __J_SECURITY_CHECK. Stop now after authentication.
* Whether or not authentication succeeded, we return.
*/
authenticator.authenticate(realm, pathInContext, request, response);
return false;
}
// attempt to access an unprotected resource that is not the
// j_security_check.
// if we are logged in, return the logged in principal.
if (request != null) {
// null response appears to prevent redirect to login page
Principal user = authenticator.authenticate(realm, pathInContext,
request, null);
if (user == null || user == SecurityHandler.__NOBODY) {
//TODO use run-as as nextCaller if present
ContextManager.setCallers(defaultPrincipal.getSubject(), defaultPrincipal.getSubject());
request.setUserPrincipal(new NotChecked());
} else if (user != null) {
isAuthenticated = true;
}
}
AccessControlContext acc = ContextManager.getCurrentContext();
/**
* JACC v1.0 section 4.1.1
*/
WebUserDataPermission wudp = new WebUserDataPermission(substitutedPathInContext, new String[]{request.getMethod()}, transportType);
acc.checkPermission(wudp);
WebResourcePermission webResourcePermission = new WebResourcePermission(request);
/**
* JACC v1.0 section 4.1.2
*/
if (isAuthenticated) {
//current user is logged in, this is the actual check
acc.checkPermission(webResourcePermission);
} else {
//user is not logged in: if access denied, try to log them in.
try {
acc.checkPermission(webResourcePermission);
} catch (AccessControlException e) {
//not logged in: try to log them in.
Principal user = authenticator.authenticate(realm, pathInContext, request, response);
if (user == SecurityHandler.__NOBODY) {
return true;
}
if (user == null) {
throw e;