HttpServletRequest hreq = 

                        (HttpServletRequest) request.getRequest();

import org.apache.catalina.Realm;

     * Attempts reauthentication to the given <code>Realm</code> using

     * the credentials associated with the single sign-on session

     * identified by argument <code>ssoId</code>.

     * <p>

     * If reauthentication is successful, the <code>Principal</code> and

     * authorization type associated with the SSO session will be bound

     * to the given <code>HttpRequest</code> object via calls to 

     * {@link HttpRequest#setAuthType HttpRequest.setAuthType()} and 

     * {@link HttpRequest#setUserPrincipal HttpRequest.setUserPrincipal()}

     * </p>

     *

     * @param ssoId     identifier of SingleSignOn session with which the

     *                  caller is associated

     * @param realm     Realm implementation against which the caller is to

     *                  be authenticated

     * @param request   the request that needs to be authenticated

     * 

     * @return  <code>true</code> if reauthentication was successful,

     *          <code>false</code> otherwise.

     */

    protected boolean reauthenticate(String ssoId, Realm realm,

                                  HttpRequest request) {

        if (ssoId == null || realm == null)

            return false;

        boolean reauthenticated = false;

        SingleSignOnEntry entry = lookup(ssoId);

        if (entry != null && entry.getCanReauthenticate()) {

            String username = entry.getUsername();

            if (username != null) {

                Principal reauthPrincipal =

                        realm.authenticate(username, entry.getPassword());                

                if (reauthPrincipal != null) {                    

                    reauthenticated = true;                    

                    // Bind the authorization credentials to the request

                    request.setAuthType(entry.getAuthType());

                    request.setUserPrincipal(reauthPrincipal);

                }

            }

        }

        return reauthenticated;

    }

    /**

     * Updates any <code>SingleSignOnEntry</code> found under key

     * <code>ssoId</code> with the given authentication data.

     * <p>

     * The purpose of this method is to allow an SSO entry that was

     * established without a username/password combination (i.e. established

     * following DIGEST or CLIENT-CERT authentication) to be updated with

     * a username and password if one becomes available through a subsequent

     * BASIC or FORM authentication.  The SSO entry will then be usable for

     * reauthentication.

     * <p>

     * <b>NOTE:</b> Only updates the SSO entry if a call to

     * <code>SingleSignOnEntry.getCanReauthenticate()</code> returns

     * <code>false</code>; otherwise, it is assumed that the SSO entry already

     * has sufficient information to allow reauthentication and that no update

     * is needed.

     *

     * @param ssoId     identifier of Single sign to be updated

     * @param principal the <code>Principal</code> returned by the latest

     *                  call to <code>Realm.authenticate</code>.

     * @param authType  the type of authenticator used (BASIC, CLIENT-CERT,

     *                  DIGEST or FORM)

     * @param username  the username (if any) used for the authentication

     * @param password  the password (if any) used for the authentication

     */

    protected void update(String ssoId, Principal principal, String authType,

                          String username, String password) {

        SingleSignOnEntry sso = lookup(ssoId);

        if (sso != null && !sso.getCanReauthenticate()) {

            if (debug >= 1)

                log("Update sso id " + ssoId + " to auth type " + authType);

            synchronized(sso) {

                sso.updateCredentials(principal, authType, username, password);

            }

        }

    }

    /**