log.debug(" Failed authenticate() test ??" + requestURI );
return;
}
}
Realm realm = this.context.getRealm();
// Is this request URI subject to a security constraint?
SecurityConstraint [] constraints = realm.
findSecurityConstraints(hrequest, this.context);
if ((constraints == null) /* &&
(!Constants.FORM_METHOD.equals(config.getAuthMethod())) */ ) {
if (log.isDebugEnabled())
log.debug(" Not subject to any constraint");
context.invokeNext(request, response);
return;
}
// Make sure that constrained resources are not cached by web proxies
// or browsers as caching can provide a security hole
HttpServletRequest hsrequest = (HttpServletRequest)hrequest.getRequest();
if (disableProxyCaching &&
!hsrequest.isSecure() &&
!"POST".equalsIgnoreCase(hsrequest.getMethod())) {
HttpServletResponse sresponse =
(HttpServletResponse) response.getResponse();
sresponse.setHeader("Pragma", "No-cache");
sresponse.setHeader("Cache-Control", "no-cache");
sresponse.setHeader("Expires", DATE_ONE);
}
int i;
for(i=0; i < constraints.length; i++) {
if (log.isDebugEnabled())
log.debug(" Subject to constraint " + constraints[i]);
// Enforce any user data constraint for this security constraint
if (log.isDebugEnabled())
log.debug(" Calling hasUserDataPermission()");
if (!realm.hasUserDataPermission(hrequest, hresponse, constraints[i])) {
if (log.isDebugEnabled())
log.debug(" Failed hasUserDataPermission() test");
// ASSERT: Authenticator already set the appropriate
// HTTP status code, so we do not have to do anything special
return;
}
}
for(i=0; i < constraints.length; i++) {
// Authenticate based upon the specified login configuration
if (constraints[i].getAuthConstraint()) {
if (log.isDebugEnabled())
log.debug(" Calling authenticate()");
if (!authenticate(hrequest, hresponse, config)) {
if (log.isDebugEnabled())
log.debug(" Failed authenticate() test");
// ASSERT: Authenticator already set the appropriate
// HTTP status code, so we do not have to do anything special
return;
}
}
// Perform access control based on the specified role(s)
if (constraints[i].getAuthConstraint()) {
if (log.isDebugEnabled())
log.debug(" Calling accessControl()");
if (!realm.hasResourcePermission(hrequest, hresponse, constraints[i], this.context)) {
if (log.isDebugEnabled())
log.debug(" Failed accessControl() test");
// ASSERT: AccessControl method has already set the appropriate
// HTTP status code, so we do not have to do anything special
return;