Source:
public void doFilter(final ServletRequest request, final ServletResponse response, final FilterChain chain) throws IOException, ServletException { if (!this.useMellonForUserIdentity) { LOGGER.debug("Skipping Mellon token processing, since Mellon is not configured to be used."); chain.doFilter(request, response); return; } if (!(request instanceof HttpServletRequest)) { throw new IOException("Expecting a HTTP request"); } final HttpServletRequest httpRequest = (HttpServletRequest) request; final String username = httpRequest.getHeader(this.httpHeaderForUsername); if (StringUtils.isEmpty(username) || "(null)".equals(username)) { LOGGER.error("MellonTokenProcessingFilter with mellon configured, no HTTP header \"" + this.httpHeaderForUsername + "\" for Mellon with a username."); chain.doFilter(request, response); return; } if (this.isLogoutRequest(httpRequest)) { this.logoutMellon(httpRequest, (HttpServletResponse) response, username); return; } LOGGER.info("Validating login for user based on input via Mellon", username); final Authentication authenticationFromSecurityContext = SecurityContextHolder.getContext().getAuthentication(); if (authenticationFromSecurityContext instanceof CustomAuthentication) { final CustomAuthentication existingAuthentication = (CustomAuthentication) authenticationFromSecurityContext; if (username.equals(existingAuthentication.getName())) { LOGGER.info( "SecurityContext already has an authentication for user {}, stop further Mellon authentication", username); this.includeFrontendHeader(response, existingAuthentication); chain.doFilter(request, response); return; } LOGGER.warn("Remove authentication for user from SecurityContext, continue authenticating user {}", existingAuthentication.getName(), username); SecurityContextHolder.getContext().setAuthentication(null); } final CustomAuthentication mellonAuthentication = new CustomAuthentication(); mellonAuthentication.setUserName(username); try { final Authentication authentication = this.authenticationManager.authenticate(mellonAuthentication); SecurityContextHolder.getContext().setAuthentication(authentication); this.includeFrontendHeader(response, authentication); } catch (final Exception e) { LOGGER.warn("Failed to login based on mellon username: '{}'", username, e); } chain.doFilter(request, response); }

Target:
public void doFilter(final ServletRequest request, final ServletResponse response, final FilterChain chain) throws IOException, ServletException { if (!this.useMellonForUserIdentity) { LOGGER.debug("Skipping Mellon token processing, since Mellon is not configured to be used."); chain.doFilter(request, response); return; } if (!(request instanceof HttpServletRequest)) { throw new IOException("Expecting a HTTP request"); } final HttpServletRequest httpRequest = (HttpServletRequest) request; final String username = httpRequest.getHeader(this.httpHeaderForUsername); if (this.noValidUsernamePresent(username)) { chain.doFilter(request, response); return; } if (this.isLogoutRequest(httpRequest)) { this.logoutMellon((HttpServletResponse) response, username); return; } LOGGER.info("Validating login for user based on input via Mellon", username); final Authentication authenticationFromSecurityContext = SecurityContextHolder.getContext().getAuthentication(); if (this.authenticationExistsForUsername(authenticationFromSecurityContext, username)) { this.includeFrontendHeader(response, authenticationFromSecurityContext); chain.doFilter(request, response); return; } final Authentication authentication = this.authenticateUser(authenticationFromSecurityContext, username); if (authentication != null) { SecurityContextHolder.getContext().setAuthentication(authentication); this.includeFrontendHeader(response, authentication); } chain.doFilter(request, response); }