in src/main/java/org/apache/sling/auth/core/impl/LoginServlet.java [71:115]
protected void service(SlingHttpServletRequest request, SlingHttpServletResponse response) throws IOException {
// if the request is logged in and the resource is not set (such
// as when requesting /system/sling/login from the browser with the
// browser sending credentials) or the resource is set to the login
// servlet as a result of authenticating after providing credentials
// through the login servlet), redirect to root now assuming we are
// authenticated.
if (request.getAuthType() != null) {
final String resourcePath = AuthUtil.getLoginResource(request, null);
if (isSelf(resourcePath)) {
String redirectTarget = request.getContextPath() + "/";
log.warn("doGet: Redirecting to {} to prevent login loop for resource", redirectTarget);
response.sendRedirect(redirectTarget);
return;
}
}
Authenticator authenticatorRef = this.authenticator;
if (authenticatorRef != null) {
try {
// set the login resource to select the authenticator
AuthUtil.setLoginResourceAttribute(request, null);
authenticatorRef.login(request, response);
return;
} catch (IllegalStateException ise) {
log.error("doGet: Response already committed, cannot login");
return;
} catch (NoAuthenticationHandlerException nahe) {
log.error("doGet: No AuthenticationHandler to login registered");
}
} else {
log.error("doGet: Authenticator service missing, cannot login");
}
// fall back to forbid access
response.sendError(HttpServletResponse.SC_FORBIDDEN, "Cannot login");
}