I've attached a simple patch for org.restlet.Guard which breaks out
the checking of identifier.equals(secret) to a separate method. We
use Acegi Security and this lets me simply delegate the
username/password check to the ProviderManager without having to
override authenticate() completely. By default,
authenticate(identifier,secret) still delegates to findSecret().
Index: Guard.java
===================================================================
--- Guard.java (revision 1549)
+++ Guard.java (working copy)
@@ -84,14 +84,14 @@
}
/**
- * Indicates if the call is properly authenticated. By default, a
call is
- * authenticated if the request has a challenge response with a
correct
- * login/password couple as verified via the findSecret() method.
- * + * Indicates if the call is properly authenticated. By
default, this
+ * delegates credential checking to authenticate().
+ *
* @param request
* The request to authenticate.
* @return -1 if the given credentials were invalid, 0 if no
credentials
- * were found and 1 otherwise.
+ * were found and 1 otherwise.
+ * @see #authenticate(identifier,secret)
*/
public int authenticate(Request request) {
int result = 0;
@@ -110,11 +110,7 @@
// Check the credentials
if ((identifier != null) && (secret != null)) {
- if (secret.equals(findSecret(identifier))) {
- result = 1;
- } else {
- result = -1;
- }
+ result = authenticate(identifier, secret) ? 1
: -1;
}
} else {
// The challenge schemes are incompatible, we need to
@@ -126,6 +122,19 @@
}
return result;
+ }
+
+ /**
+ * Indicates if the secret is valid for the given identifier. By
default, + * this returns true given the correct login/password
couple as verified
+ * via the findSecret() method.
+ *
+ * @param identifier the identifier
+ * @param secret the identifier's secret
+ * @return true if the secret is valid for the given
identifier
+ */
+ protected boolean authenticate(String identifier, String secret) {
+ return (secret.equals(findSecret(identifier)));
}
/**
------------------------------------------------------------------------
Index: Guard.java
===================================================================
--- Guard.java (revision 1549)
+++ Guard.java (working copy)
@@ -84,14 +84,14 @@
}
/**
- * Indicates if the call is properly authenticated. By default, a call is
- * authenticated if the request has a challenge response with a correct
- * login/password couple as verified via the findSecret() method.
- *
+ * Indicates if the call is properly authenticated. By default, this
+ * delegates credential checking to authenticate().
+ *
* @param request
* The request to authenticate.
* @return -1 if the given credentials were invalid, 0 if no credentials
- * were found and 1 otherwise.
+ * were found and 1 otherwise.
+ * @see #authenticate(identifier,secret)
*/
public int authenticate(Request request) {
int result = 0;
@@ -110,11 +110,7 @@
// Check the credentials
if ((identifier != null) && (secret != null)) {
- if (secret.equals(findSecret(identifier))) {
- result = 1;
- } else {
- result = -1;
- }
+ result = authenticate(identifier, secret) ? 1 : -1;
}
} else {
// The challenge schemes are incompatible, we need to
@@ -126,6 +122,19 @@
}
return result;
+ }
+
+ /**
+ * Indicates if the secret is valid for the given identifier. By default,
+ * this returns true given the correct login/password couple as verified
+ * via the findSecret() method.
+ *
+ * @param identifier the identifier
+ * @param secret the identifier's secret
+ * @return true if the secret is valid for the given
identifier
+ */
+ protected boolean authenticate(String identifier, String secret) {
+ return (secret.equals(findSecret(identifier)));
}
/**
