*/
public AuthenticationInfo extractCredentials(HttpServletRequest request,
HttpServletResponse response) {
try {
final RelyingParty relyingParty = getRelyingParty(request);
// this may throw a ClassCastException after an update of the
// bundle if the HTTP Session object still holds on to an
// OpenIdUser instance created by the old bundle.
final OpenIdUser user = discover(relyingParty, request);
// no OpenID user in the request, check whether this is an
// OpenID response at all
if (user == null) {
if (RelyingParty.isAuthResponse(request)) {
log.debug("OpenID authentication timeout");
response.sendRedirect(request.getRequestURI());
return AuthenticationInfo.DOING_AUTH;
} else if (RelyingParty.isAuthCancel(request)) {
log.info("OpenID authentication cancelled by user");
return handleAuthFailure(OpenIDFailure.AUTHENTICATION,
request);
}
// check whether the request has an OpenID identifier
// request parameter not leading to a valid OpenID
// transaction; fail authentication in this case
final String identifier = request.getParameter(identifierParam);
if (identifier != null) {
log.info("OpenID authentication failed (probably failed to discover OpenID Provider)");
return handleAuthFailure(OpenIDFailure.DISCOVERY, request);
}
} else if (user.isAuthenticated()) {
// user already authenticated
return getAuthInfoFromUser(user);
} else if (user.isAssociated()) {
if (RelyingParty.isAuthResponse(request)) {
if (relyingParty.verifyAuth(user, request, response)) {
// authenticated
response.sendRedirect(getReturnToResource(request));
return AuthenticationInfo.DOING_AUTH;
}
// failed verification
return handleAuthFailure(OpenIDFailure.VERIFICATION,
request);
}
// Assume a cancel or some other non-successful response
// from provider failed verification
relyingParty.invalidate(request, response);
return handleAuthFailure(OpenIDFailure.AUTHENTICATION, request);
} else {
// associate and authenticate user
// prepare the url for the return_to parameter
final String url = getBaseUrl(request);
// set the realm/trustroot from configuration or the root url
final String trustRoot = (realm == null) ? url : realm;
// append the resource URL to the returnTo address
final String returnTo = url + getReturnToPath(request);
if (relyingParty.associateAndAuthenticate(user, request,
response, trustRoot, trustRoot, returnTo)) {
// user is associated and then redirected to his openid
// provider for authentication
return AuthenticationInfo.DOING_AUTH;
}