Changeset 1903

Timestamp:

2011-05-23 09:33:54 (12 months ago)

Author:

jgou

Message:

provide some sort of fallback for setting the ChallengeResponse? in the following cases:

• challengeresponse is not yet set : this is the case for custom auth methods such as the kauri form-based auth
• the set challengeresponse doesn't match the selectedAuthMethod : corner case, could happen when e.g. form-based and basic auth are both used to protect the same resource

File:

• trunk/modules/kauri-security/kauri-security-impl/src/main/java/org/kauriproject/security/infrastructure/SecurityFilter.java (modified) (3 diffs)

trunk/modules/kauri-security/kauri-security-impl/src/main/java/org/kauriproject/security/infrastructure/SecurityFilter.java

@@ -30 +30 @@
 import org.restlet.Request;
 import org.restlet.Response;
+import org.restlet.data.ChallengeResponse;
+import org.restlet.data.ChallengeScheme;
 import org.restlet.data.ClientInfo;
 import org.restlet.data.Status;
@@ -190 +192 @@
             if (authority.getAuthority() != null) {
                 Role role = getRestletRole(authority.getAuthority());
-                principals.add(role); //FIXME: remove ?
-                clientInfo.getRoles().add(role); //FIXME: OK ?
+                principals.add(role);
+                clientInfo.getRoles().add(role);
             }
         }
@@ -197 +199 @@
         if (authToken.getPrincipal() instanceof UserDetails) {
             UserDetails userDetails = (UserDetails)authToken.getPrincipal();
-            User user = new User(userDetails.getUsername());//TODO: check, was: new UserPrincipal(userDetails.getUsername())
-            principals.add(user); //FIXME: remove ?
-            clientInfo.setUser(user); //FIXME: OK ?
+            User user = new User(userDetails.getUsername());
+            principals.add(user);
+            clientInfo.setUser(user);
         }
 
         request.getAttributes().put("principal", authToken.getPrincipal());
-
         request.getAttributes().put(Realm.REALM_REQ_ATTR_NAME, filterContext.realm);
+        
+        // ensure that a correct challengeresponse is available in the restlet/jaxrs (security)context
+        ChallengeResponse currentChallengeResponse = request.getChallengeResponse();
+        if(currentChallengeResponse == null || !currentChallengeResponse.getIdentifier().equals(authToken.getName())) {
+          ChallengeResponse challengeResponse = new ChallengeResponse(ChallengeScheme.CUSTOM);
+          challengeResponse.setRealm(filterContext.realm.getName());
+          challengeResponse.setIdentifier(authToken.getName());
+          request.setChallengeResponse(challengeResponse);
+        } 
     }