SEC-1058: Substantial refactoring of AbstractProcessingFilter to use AuthenticationFailureHandler strategy. Also changed attemptAuthentication method to take a response object and have the option of returning null, to allow OpenIDAuthenticationProcessingFilter to work without having to throw exceptions between the template methods (which made the logic very hard to follow). The OpenID filter now redirects to the OpenID provider service from this method, rather than treating it as a temporary failure and throwing OpenIDAuthenticationRequiredException.

cas/src/main/java/org/springframework/security/ui/cas/CasProcessingFilter.java

@@ -78,7 +78,7 @@ public class CasProcessingFilter extends AbstractProcessingFilter {
     private ProxyGrantingTicketStorage proxyGrantingTicketStorage;
 
     //~ Methods ========================================================================================================  
-    public Authentication attemptAuthentication(final HttpServletRequest request)
+    public Authentication attemptAuthentication(final HttpServletRequest request, HttpServletResponse response)
         throws AuthenticationException {
         final String username = CAS_STATEFUL_IDENTIFIER;
         String password = request.getParameter("ticket");

cas/src/test/java/org/springframework/security/ui/cas/CasProcessingFilterTests.java

@@ -22,6 +22,7 @@ import org.springframework.security.AuthenticationException;
 import org.springframework.security.MockAuthenticationManager;
 
 import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
 
 
 /**
@@ -31,26 +32,8 @@ import org.springframework.mock.web.MockHttpServletRequest;
  * @version $Id$
  */
 public class CasProcessingFilterTests extends TestCase {
-    //~ Constructors ===================================================================================================
-
-    public CasProcessingFilterTests() {
-        super();
-    }
-
-    public CasProcessingFilterTests(String arg0) {
-        super(arg0);
-    }
-
     //~ Methods ========================================================================================================
 
-    public static void main(String[] args) {
-        junit.textui.TestRunner.run(CasProcessingFilterTests.class);
-    }
-
-    public final void setUp() throws Exception {
-        super.setUp();
-    }
-
     public void testGetters() {
         CasProcessingFilter filter = new CasProcessingFilter();
         assertEquals("/j_spring_cas_security_check", filter.getDefaultFilterProcessesUrl());
@@ -66,7 +49,7 @@ public class CasProcessingFilterTests extends TestCase {
         filter.setAuthenticationManager(authMgr);
         filter.init(null);
 
-        Authentication result = filter.attemptAuthentication(request);
+        Authentication result = filter.attemptAuthentication(request, new MockHttpServletResponse());
         assertTrue(result != null);
     }
 
@@ -81,7 +64,7 @@ public class CasProcessingFilterTests extends TestCase {
         filter.init(null);
 
         try {
-            filter.attemptAuthentication(request);
+            filter.attemptAuthentication(request, new MockHttpServletResponse());
             fail("Should have thrown AuthenticationException");
         } catch (AuthenticationException expected) {
             assertTrue(true);