@ Override public Response build ( final WebApplicationService webApplicationService , final String ticketId , final Authentication authentication ) { val service = ( OpenIdService ) webApplicationService ; val parameterList = new ParameterList ( HttpRequestUtils . getHttpServletRequestFromRequestAttributes ( ) . getParameterMap ( ) ) ; val parameters = new HashMap < String , String > ( ) ; if ( StringUtils . isBlank ( ticketId ) ) { parameters . put ( OpenIdProtocolConstants . OPENID_MODE , OpenIdProtocolConstants . CANCEL ) ; return buildRedirect ( service , parameters ) ; } val association = getAssociation ( serverManager , parameterList ) ; val associated = association != null ; val associationValid = isAssociationValid ( association ) ; var successFullAuthentication = true ; var assertion = ( Assertion ) null ; try { if ( associated && associationValid ) { assertion = centralAuthenticationService . validateServiceTicket ( ticketId , service ) ; LOGGER . debug ( "Validated openid ticket [{}] for [{}]" , ticketId , service ) ; } else if ( ! associated ) { LOGGER . debug ( "Responding to non-associated mode. Service ticket [{}] must be validated by the RP" , ticketId ) ; } else { LOGGER . warn ( "Association does not exist or is not valid" ) ; successFullAuthentication = false ; } } catch ( final AbstractTicketException e ) { LOGGER . error ( "Could not validate ticket : [{}]" , e . getMessage ( ) , e ) ; successFullAuthentication = false ; } val id = determineIdentity ( service , assertion ) ; return buildAuthenticationResponse ( service , parameters , successFullAuthentication , id , parameterList ) ; }
Generates an Openid response . If no ticketId is found response is negative . If we have a ticket id then we check if we have an association . If so we ask OpenId server manager to generate the answer according with the existing association . If not we send back an answer with the ticket id as association handle . This will force the consumer to ask a verification which will validate the service ticket .