I've attached a simple patch for org.restlet.Guard which breaks out the
checking of identifier.equals(secret) to a separate method. We use
Acegi Security and this lets me simply delegate the username/password
check to the ProviderManager without having to override authenticate()
completely. By default, authenticate(identifier,secret) still delegates
to findSecret().
Index: Guard.java
===================================================================
--- Guard.java (revision 1549)
+++ Guard.java (working copy)
@@ -84,14 +84,14 @@
}
/**
- * Indicates if the call is properly authenticated. By default, a
call is
- * authenticated if the request has a challenge response with a
correct
- * login/password couple as verified via the findSecret() method.
- *
+ * Indicates if the call is properly authenticated. By default, this
+ * delegates credential checking to authenticate().
+ *
* @param request
* The request to authenticate.
* @return -1 if the given credentials were invalid, 0 if no
credentials
- * were found and 1 otherwise.
+ * were found and 1 otherwise.
+ * @see #authenticate(identifier,secret)
*/
public int authenticate(Request request) {
int result = 0;
@@ -110,11 +110,7 @@
// Check the credentials
if ((identifier != null) && (secret != null)) {
- if (secret.equals(findSecret(identifier))) {
- result = 1;
- } else {
- result = -1;
- }
+ result = authenticate(identifier, secret) ? 1 :
-1;
}
} else {
// The challenge schemes are incompatible, we need to
@@ -126,6 +122,19 @@
}
return result;
+ }
+
+ /**
+ * Indicates if the secret is valid for the given identifier. By
default,
+ * this returns true given the correct login/password couple as
verified
+ * via the findSecret() method.
+ *
+ * @param identifier the identifier
+ * @param secret the identifier's secret
+ * @return true if the secret is valid for the given
identifier
+ */
+ protected boolean authenticate(String identifier, String secret) {
+ return (secret.equals(findSecret(identifier)));
}
/**
Index: Guard.java
===================================================================
--- Guard.java (revision 1549)
+++ Guard.java (working copy)
@@ -84,14 +84,14 @@
}
/**
- * Indicates if the call is properly authenticated. By default, a call is
- * authenticated if the request has a challenge response with a correct
- * login/password couple as verified via the findSecret() method.
- *
+ * Indicates if the call is properly authenticated. By default, this
+ * delegates credential checking to authenticate().
+ *
* @param request
* The request to authenticate.
* @return -1 if the given credentials were invalid, 0 if no credentials
- * were found and 1 otherwise.
+ * were found and 1 otherwise.
+ * @see #authenticate(identifier,secret)
*/
public int authenticate(Request request) {
int result = 0;
@@ -110,11 +110,7 @@
// Check the credentials
if ((identifier != null) && (secret != null)) {
- if (secret.equals(findSecret(identifier))) {
- result = 1;
- } else {
- result = -1;
- }
+ result = authenticate(identifier, secret) ? 1 : -1;
}
} else {
// The challenge schemes are incompatible, we need to
@@ -126,6 +122,19 @@
}
return result;
+ }
+
+ /**
+ * Indicates if the secret is valid for the given identifier. By default,
+ * this returns true given the correct login/password couple as verified
+ * via the findSecret() method.
+ *
+ * @param identifier the identifier
+ * @param secret the identifier's secret
+ * @return true if the secret is valid for the given identifier
+ */
+ protected boolean authenticate(String identifier, String secret) {
+ return (secret.equals(findSecret(identifier)));
}
/**
