logger.info("Login authorization: "+auth+" name:"+name+" adjustCookies: "+adjustCookies);
if( null == auth ) {
// No authentication provided. Assume default user.
User user = userRepository.getDefaultUser();
// If adjusting cookies, do not complain and return OK
if( adjustCookies ) {
acceptRequest(response, false, user);
} else {
// Inform client that authentication is required.
rejectRequest(response);
}
return;
}
String[] userNameAndPassword = null;
try {
userNameAndPassword = AuthenticationUtils.getUserNameAndPassword(auth);
} catch (Exception e) {
throw new Exception("Unable to acquire user",e);
}
// An auth has been provided. Check that the auth corresponds to
// the 'name' provided by the script. This is to avoid a situation
// where the browser has changed its tokens, already learned from
// the fact that this path is protected and supplies already known
// credentials, ignoring the username and password provided in the
// XmlHttpRequest
if( false == adjustCookies ) {
if( null == name ) {
// We're not adjusting cookies, therefore we must know the
// intended user
throw new Exception("name parameter not provided");
}
if( false == name.equals( userNameAndPassword[0] ) ) {
// The funny (interesting) situation has occurred.
// Send back a 401 to get intended name and password
rejectRequest(response);
return;
}
}
// From this point on, an auth has been provided for an intended
// user. We do not want to return an error or else a pop-up box
// from the browser (not javascript) will be displayed. Even if
// login fails, return an OK status. The outcome of the login is
// returned as a JSON object. Also, the cookie installed on the
// client reflects a default user if the authentication fails.
User user;
boolean loggedIn = false;
try {
user = userRepository.authenticate(userNameAndPassword[0],userNameAndPassword[1]);
loggedIn = true;
} catch (Exception e) {