@ Override public SecurityContext initializeAndExamineRequest ( final HttpServletRequest request , final HttpServletResponse response ) throws FrameworkException { logger . warn ( "KAI: RestAuthenticator.initializeAndExamineRequest" ) ; SecurityContext securityContext ; Principal user = SessionHelper . checkSessionAuthentication ( request ) ; if ( user == null ) { user = getUser ( request , true ) ; } if ( user == null ) { // If no user could be determined, assume frontend access securityContext = SecurityContext . getInstance ( user , request , AccessMode . Frontend ) ; } else { if ( user instanceof SuperUser ) { securityContext = SecurityContext . getSuperUserInstance ( request ) ; } else { securityContext = SecurityContext . getInstance ( user , request , AccessMode . Backend ) ; SessionHelper . clearInvalidSessions ( user ) ; } } securityContext . setAuthenticator ( this ) ; // Check CORS settings (Cross-origin resource sharing, see http://en.wikipedia.org/wiki/Cross-origin_resource_sharing) final String origin = request . getHeader ( "Origin" ) ; if ( ! StringUtils . isBlank ( origin ) ) { final Services services = Services . getInstance ( ) ; response . setHeader ( "Access-Control-Allow-Origin" , origin ) ; // allow cross site resource sharing (read only) final String maxAge = Settings . AccessControlMaxAge . getValue ( ) ; if ( StringUtils . isNotBlank ( maxAge ) ) { response . setHeader ( "Access-Control-Max-Age" , maxAge ) ; } final String allowMethods = Settings . AccessControlAllowMethods . getValue ( ) ; if ( StringUtils . isNotBlank ( allowMethods ) ) { response . setHeader ( "Access-Control-Allow-Methods" , allowMethods ) ; } final String allowHeaders = Settings . AccessControlAllowHeaders . getValue ( ) ; if ( StringUtils . isNotBlank ( allowHeaders ) ) { response . setHeader ( "Access-Control-Allow-Headers" , allowHeaders ) ; } final String allowCredentials = Settings . AccessControlAllowCredentials . getValue ( ) ; if ( StringUtils . isNotBlank ( allowCredentials ) ) { response . setHeader ( "Access-Control-Allow-Credentials" , allowCredentials ) ; } final String exposeHeaders = Settings . AccessControlExposeHeaders . getValue ( ) ; if ( StringUtils . isNotBlank ( exposeHeaders ) ) { response . setHeader ( "Access-Control-Expose-Headers" , exposeHeaders ) ; } } examined = true ; return securityContext ; }
Examine request and try to find a user .