package org.springframework.security.providers.preauth;

import org.springframework.security.providers.AuthenticationProvider;
import org.springframework.security.Authentication;
import org.springframework.security.AuthenticationException;
import org.springframework.security.userdetails.UserDetails;
import org.springframework.security.userdetails.UserDetailsChecker;
import org.springframework.security.userdetails.checker.AccountStatusUserDetailsChecker;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.core.Ordered;
import org.springframework.util.Assert;

/**
 * <p>
 * Processes a pre-authenticated authentication request. The request will
 * typically originate from a {@link org.springframework.security.ui.preauth.AbstractPreAuthenticatedProcessingFilter}
 * subclass.
 *
 * <p>
 * This authentication provider will not perform any checks on authentication
 * requests, as they should already be pre- authenticated. However, the
 * AuthenticationUserDetailsService implementation may still throw a UsernameNotFoundException, for example.
 *
 * @author Ruud Senden
 * @version $Id$
 * @since 2.0
 */
public class PreAuthenticatedAuthenticationProvider implements AuthenticationProvider, InitializingBean, Ordered {
    private static final Log logger = LogFactory.getLog(PreAuthenticatedAuthenticationProvider.class);

    private AuthenticationUserDetailsService preAuthenticatedUserDetailsService = null;
    private UserDetailsChecker userDetailsChecker = new AccountStatusUserDetailsChecker();    

    private int order = -1; // default: same as non-ordered

    /**
     * Check whether all required properties have been set.
     */
    public void afterPropertiesSet() {
        Assert.notNull(preAuthenticatedUserDetailsService, "A AuthenticationUserDetailsService must be set");
    }

    /**
     * Authenticate the given PreAuthenticatedAuthenticationToken.
     * <p>
     * If the principal contained in the authentication object is null, the request will be ignored to allow other
     * providers to authenticate it.
     */
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        if (!supports(authentication.getClass())) {
            return null;
        }

        if (logger.isDebugEnabled()) {
            logger.debug("PreAuthenticated authentication request: " + authentication);
        }

        if(authentication.getPrincipal() == null) {
            logger.debug("No pre-authenticated principal found in request.");
            return null;
        }

        UserDetails ud = preAuthenticatedUserDetailsService.loadUserDetails(authentication);

        userDetailsChecker.check(ud);

        PreAuthenticatedAuthenticationToken result =
                new PreAuthenticatedAuthenticationToken(ud, authentication.getCredentials(), ud.getAuthorities());
        result.setDetails(authentication.getDetails());

        return result;

    }

    /**
     * Indicate that this provider only supports PreAuthenticatedAuthenticationToken (sub)classes.
     */
    public boolean supports(Class authentication) {
        return PreAuthenticatedAuthenticationToken.class.isAssignableFrom(authentication);
    }

    /**
     * Set the AuthenticatedUserDetailsServices to be used.
     *
     * @param aPreAuthenticatedUserDetailsService
     */
    public void setPreAuthenticatedUserDetailsService(AuthenticationUserDetailsService aPreAuthenticatedUserDetailsService) {
        this.preAuthenticatedUserDetailsService = aPreAuthenticatedUserDetailsService;
    }

    public int getOrder() {
        return order;
    }

    public void setOrder(int i) {
        order = i;
    }
}

@@ -234,24 +234,86 @@
 Exception;%0D%0A
+import org.springframework.security.BadCredentialsException;%0D%0A
 import org.s
@@ -1719,19 +1719,78 @@
 cker(); 
+%0D%0A
    
+ private boolean throwExceptionWhenTokenRejected = false;
 %0D%0A%0D%0A    
@@ -2028,16 +2028,17 @@
 vice, %22A
+n
  Authent
@@ -2688,16 +2688,17 @@
       if
+ 
 (authent
@@ -2827,33 +2827,589 @@
     
-return null;%0D%0A        %7D%0D%0A
+%0D%0A            if (throwExceptionWhenTokenRejected) %7B%0D%0A                throw new BadCredentialsException(%22No pre-authenticated principal found in request.%22);%0D%0A            %7D%0D%0A            return null;%0D%0A        %7D%0D%0A%0D%0A        if (authentication.getCredentials() == null) %7B%0D%0A            logger.debug(%22No pre-authenticated credentials found in request.%22);%0D%0A%0D%0A            if (throwExceptionWhenTokenRejected) %7B%0D%0A                throw new BadCredentialsException(%22No pre-authenticated credentials found in request.%22);%0D%0A            %7D            %0D%0A            return null;%0D%0A        %7D%0D%0A        
 %0D%0A  
@@ -4563,12 +4563,443 @@
 %0D%0A    %7D%0D
+%0A%0D%0A    /** %0D%0A     * If true, causes the provider to throw a BadCredentialsException if the presented authentication %0D%0A     * request is invalid (contains a null principal or credentials). Otherwise it will just return %0D%0A     * null.  %0D%0A     */    %0D%0A    public void setThrowExceptionWhenTokenRejected(boolean throwExceptionWhenTokenRejected) %7B%0D%0A        this.throwExceptionWhenTokenRejected = throwExceptionWhenTokenRejected;%0D%0A    %7D%0D
 %0A%7D%0D%0A

Change PreAuthenticatedAuthenticationProvider to reject authentication tokens with null credentials. Also introduced a property "throwExceptionWhenTokenIsRejected" which raises a BadCredentialsException when the toke is invalid.