getResponse().setStatus(Status.CLIENT_ERROR_UNAUTHORIZED);
return null;
}
String authid = authorization.getIdentifier().trim();
String password = new String(authorization.getSecret());
User user = null;
if (realm!=null) {
RealmUser ruser = findRealmUser(db,realm,authid);
if (ruser!=null) {
user = ruser.getUser();
}
if (user==null) {
// see if the user is a super user across realms
user = findUser(db,authid);
if (user!=null) {
// The user must either be a superuser or have the cross-realm permission
Permission superuser = db.getPermission(AuthDB.SUPERUSER_PERMISSION);
Permission crossrealm = db.getPermission(AuthDB.ACROSS_REALM_PERMISSION);
if (!user.hasPermission(superuser) && !user.hasPermission(crossrealm)) {
user = null;
}
}
}
} else {
user = findUser(db,authid);
}
if (user!=null) {
try {
String seconds = requestForm.getFirstValue("expiration");
long requestExpiration = seconds==null ? expiration : Long.parseLong(seconds)*1000;
if ("false".equals(requestForm.getFirstValue("session"))) {
requestExpiration = 0;
}
User.Authenticated authd = user.authenticate(realm,password,requestExpiration);
if (authd!=null) {
String userAlias = authd.getUser().getAlias();
UUID userId = authd.getUser().getUUID();
String name = authd.getUser().getName();
String email = authd.getUser().getEmail();