WindowsAzure/azure-sdk-for-java-samples — pull request #2 by woloski (2012-07-24 21:02:04+00:00)
Title: Adding a Filter that plays like WSFederationAuthenticationModule and decuple the concept of session token

You can simply add the filter to your app like this and you are set. I know you guys wanted to show some of the protocol, you can still do that by creating your own filter and follow the steps in the doc. This is another step towards make it easier.

```xml

FederationFilter
com.microsoft.samples.federation.WSFederationFilter

login-page-url
login.jsp

exclude-urls-regex
/public/*

FederationFilter
/*

```

The only breaking change is that `FederationLoginManager.authenticate` returns a Principal and in the current code it sets the Principal in session and redirect to the "wctx". So I decoupled that. `authenticate` returns the principal and there is another method that will "put the principal in session". If you want to be farm-friendly you would derive from the WSFederationFilter and implement your own `authenticateWithSessionToken` using signed cookies.

```java
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {

FederatedPrincipal principal = null;
HttpServletRequest httpRequest = (HttpServletRequest) request;

HttpServletResponse httpResponse = (HttpServletResponse) response;

// is the request is a token?
if (this.isSignInResponse(httpRequest)) {
principal = this.authenticateWithToken(httpRequest, httpResponse);
this.writeSessionToken(httpRequest, principal);
this.redirectToOriginalUrl(httpRequest, httpResponse);
}

// is principal in session?
if (principal == null && this.sessionTokenExists(httpRequest)) {
principal = this.authenticateWithSessionToken(httpRequest, httpResponse);
}

// if not authenticated at this point, redirect to login page
boolean excludedUrl = httpRequest.getRequestURL().toString().contains(this.loginPage) ||
(this.excludedUrlsRegex != null &&
!this.excludedUrlsRegex.isEmpty() &&
Pattern.compile(this.excludedUrlsRegex).matcher(httpRequest.getRequestURL().toString()).find());

if (!excludedUrl && principal == null) {
if (!FederatedConfiguration.getInstance().getEnableManualRedirect()) {
this.redirectToIdentityProvider(httpRequest, httpResponse);
} else {
this.redirectToLoginPage(httpRequest, httpResponse);
}

return;
}

chain.doFilter(new FederatedHttpServletRequest(httpRequest, principal), response);
}
```

This is the method that calls the authenticate with a different signature now. This is part of the filter

```java
protected FederatedPrincipal authenticateWithToken(HttpServletRequest request, HttpServletResponse response) throws IOException {
String token = request.getParameter("wresult").toString();

if (token == null) {
response.sendError(400, "You were supposed to send a wresult parameter with a token");
}

FederatedLoginManager loginManager = FederatedLoginManager.fromRequest(request, null);

try {
FederatedPrincipal principal = loginManager.authenticate(token, response);
return principal;
} catch (FederationException e) {
response.sendError(500, "Oops and error occurred validating the token.");
}

return null;
}
```