}
final RestConfig restConfig = ResourceUtil.getRestConfig(locatorBridge.getRemoteLocator());
Response.ResponseBuilder responseBuilder = Response.status(UNAUTHORIZED);
RestActionReporter ar = new RestActionReporter();
Request grizzlyRequest = request.get();
// If the call flow reached here, the request has been authenticated by logic in RestAdapater
// probably with an admin username and password. The remoteHostName value
// in the data object is the actual remote host of the end-user who is
// using the console (or, conceivably, some other client). We need to
// authenticate here once again with that supplied remoteHostName to
// make sure we enforce remote access rules correctly.
String hostName = data.get("remoteHostName");
boolean isAuthorized = false;
boolean responseErrorStatusSet = false;
Subject subject = null;
try {
// subject = ResourceUtil.authenticateViaAdminRealm(Globals.getDefaultHabitat(), grizzlyRequest, hostName);
subject = ResourceUtil.authenticateViaAdminRealm(locatorBridge.getRemoteLocator(), grizzlyRequest, hostName);
isAuthorized = ResourceUtil.isAuthorized(locatorBridge.getRemoteLocator(), subject, "domain/rest-sessions/rest-session", "create");
} catch (RemoteAdminAccessException e) {
responseBuilder.status(FORBIDDEN);
responseErrorStatusSet = true;
} catch (Exception e) {
ar.setMessage("Error while authenticating " + e);
}
if (isAuthorized) {
responseBuilder.status(OK);
// Check to see if the username has been set (anonymous user case)
String username = (String) grizzlyRequest.getAttribute("restUser");
if (username != null) {
ar.getExtraProperties().put("username", username);
}
ar.getExtraProperties().put("token", sessionManager.createSession(grizzlyRequest.getRemoteAddr(), subject, chooseTimeout(restConfig)));
} else {
if ( ! responseErrorStatusSet) {
responseBuilder.status(UNAUTHORIZED);
}