@Override
    public Object preInvoke(HttpServletRequest req, HttpServletResponse resp, String servletName, boolean enforceSecurity) throws SecurityViolationException, IOException {

        Subject invokedSubject = subjectManager.getInvocationSubject();
        Subject receivedSubject = subjectManager.getCallerSubject();

        WebSecurityContext webSecurityContext = new WebSecurityContext(invokedSubject, receivedSubject);
        setUnauthenticatedSubjectIfNeeded(invokedSubject, receivedSubject);

        if (req != null) {
            SRTServletRequestUtils.setPrivateAttribute(req, SECURITY_CONTEXT, webSecurityContext);
        }

        if (enforceSecurity) {
            // Authentication and authorization are not required
            // for servlet init or destroy and, per spec, should
            // not be done for forward or include paths.
            if (req != null) {
                performSecurityChecks(req, resp, receivedSubject, webSecurityContext);
            }

            if (req != null) {
                extraAuditData.put("HTTP_SERVLET_REQUEST", req);
            }
            //auditManager.setHttpServletRequest(req);

            performDelegation(servletName);

            syncToOSThread(webSecurityContext);
        }

        return webSecurityContext;
    }
@ Override public Object preInvoke ( HttpServletRequest req , HttpServletResponse resp , String servletName , boolean enforceSecurity ) throws SecurityViolationException , IOException { Subject invokedSubject = subjectManager . getInvocationSubject ( ) ; Subject receivedSubject = subjectManager . getCallerSubject ( ) ; WebSecurityContext webSecurityContext = new WebSecurityContext ( invokedSubject , receivedSubject ) ; setUnauthenticatedSubjectIfNeeded ( invokedSubject , receivedSubject ) ; if ( req != null ) { SRTServletRequestUtils . setPrivateAttribute ( req , SECURITY_CONTEXT , webSecurityContext ) ; } if ( enforceSecurity ) { if ( req != null ) { performSecurityChecks ( req , resp , receivedSubject , webSecurityContext ) ; } if ( req != null ) { extraAuditData . put ( "HTTP_SERVLET_REQUEST" , req ) ; } performDelegation ( servletName ) ; syncToOSThread ( webSecurityContext ) ; } return webSecurityContext ; }
This preInvoke is called for every request and when processing
AsyncErrorHandling. It is also called (passing in false for
<code>enforceSecurity</code>) for static files to check whether
the user has access to the file on the zOS file system.
<p>
preInvoke also handles runAs delegation.
<p> {@inheritDoc}