* @see AbstractLoginModule#getAuthentication(Principal, Credentials)
*/
@Override
protected Authentication getAuthentication(Principal principal, Credentials creds) throws RepositoryException {
if (!disableTokenAuth && tokenCredentials != null) {
Authentication authentication = new TokenBasedAuthentication(tokenCredentials.getToken(), tokenExpiration, session);
if (authentication.canHandle(creds)) {
return authentication;
}
}
if (user != null) {
Authentication authentication = new SimpleCredentialsAuthentication(user);
if (authentication.canHandle(creds)) {
return authentication;
}
}
// no valid user or authentication could not handle the given credentials
return null;