public OUser authenticate ( final OToken authToken ) { final String dbName = getDatabase ( ) . getName ( ) ; if ( authToken . getIsValid ( ) != true ) { throw new OSecurityAccessException ( dbName , "Token not valid" ) ; } OUser user = authToken . getUser ( getDatabase ( ) ) ; if ( user == null && authToken . getUserName ( ) != null ) { // Token handler may not support returning an OUser so let's get username (subject) and query: user = getUser ( authToken . getUserName ( ) ) ; } if ( user == null ) { throw new OSecurityAccessException ( dbName , "Authentication failed, could not load user from token" ) ; } if ( user . getAccountStatus ( ) != STATUSES . ACTIVE ) throw new OSecurityAccessException ( dbName , "User '" + user . getName ( ) + "' is not active" ) ; return user ; }
Token MUST be validated before being passed to this method .