LoginModulePlugin and AuthenticationHandler

[Ian Boston <ie...@tfd.co.uk>]

Hi,

Short question:
What is the best way to do form based login in the current Sling Trunk ?

Long Question:

I am trying to create a Form based login, that stores the fact the  
user has logged in in the http session, using the  
AuthenticationHandler mechanism in trunk, but I am having trouble  
doing this *without* storing the password.

What I want to achieve is:
UI goes to a URL and performs login,
The AuthenticationHandler produces SimpleCredentials that are used by  
the PluggableDefaultLoginModule to authenticate against the internal  
user manager.

All of that is Ok,

but I also want to store something in http session that records who  
the user is so that on subsequent request the request can be  
associated with the user. (without the browser providing additional  
authentication information, and without storing the password)

The problem I am encountering is that I have no hook into the  
PluggableDefaultLoginModule that allows me to see if the first  
authentication operation was sucessful, so I cant tell if I should  
perform the association or not. Short of storing the password plain  
text (which is against everything I believe in) the only way I can see  
is to directly use SimpleCredentialsAuthentication, which completely  
defeats the purpose of  the AuthenticationHandler and the  
LoginModulePlugin.

BTW, the structure of AuthenticationHandler and LoginModulePlugin are  
perfectly Ok if the handler takes complete responsibility for all  
aspects of authentication (as with the OpenIDAuthenticationHandler),  
but as soon as there is any dependency on the internal authentication,  
I cant see how to do it cleanly.

I hope that makes sense, any pointers, gratefully received.
Thanks
Ian