title: Problem using HttpServletRequest authenticate() within JSF lifecycle
body: <p>I'm trying to use HttpServletRequest authenticate within a JSF managed bean to implement fine-grained authentication, depending on the particular object requested.</p>
  
  <p>When I call authenticate within a preRenderView event listener, if authenticate causes a redirect to the login page, an exception is thrown.  I can't call responseComplete after the call to authenticate, because FacesContext.getCurrentInstance returns null.  Is it possible to call authenticate() at all in JSF, or do I have to use a ServletFilter? HttpServletRequest login and logout work within JSF, so I think it's reasonable to assume authenticate should work. Is this a bug in Mojarra JSF?</p>
  
  <p>Here is my code:</p>
  
  <p>The page where event listener is registered:</p>
  
  <pre><code>&lt;ui:composition template="/template.xhtml"
  xmlns:ui="http://java.sun.com/jsf/facelets"
   xmlns:h="http://java.sun.com/jsf/html"
   xmlns:f="http://java.sun.com/jsf/core"
   xmlns:ice="http://www.icesoft.com/icefaces/component"&gt;
  &lt;ui:param name="pageTitle" value="Text Clustering Home Page"/&gt;
  &lt;ui:define name="metadata"&gt;
  &lt;f:metadata&gt;
  
     &lt;f:event type="preRenderView" listener="#{permissionBean.preRender}"/&gt;
  &lt;/f:metadata&gt;
  &lt;/ui:define&gt;
  &lt;ui:define name="body"&gt;
  
        Text Clustering Home Page
        &lt;h:form&gt;
            &lt;h:panelGrid columns="1"&gt;
                &lt;ice:outputText rendered="#{loginService.loggedIn}" value="Logged in User: #{loginService.currentUser.username}"/&gt;
                &lt;h:link rendered="#{!loginService.loggedIn}" value="Register" outcome="Register"/&gt;
  
                &lt;h:commandLink value="Logout" rendered="#{loginService.loggedIn}" action="#{loginService.logout}"/&gt;
                &lt;h:link value="Login" rendered="#{!loginService.loggedIn}" outcome="Login"/&gt;
            &lt;/h:panelGrid&gt; 
        &lt;/h:form&gt;
  </code></pre>
  
  <p>
  </p>
  
  <p>The bean that contains the listener:</p>
  
  <pre><code>@Named
  @RequestScoped
  public class PermissionBean implements java.io.Serializable {
  
  public void preRender(CompenentSystemEvent event) {
      HttpServletRequest request = (HttpServletRequest)FacesContext.getCurrentInstance().getExternalContext().getRequest();
    HttpServletResponse response = (HttpServletResponse)FacesContext.getCurrentInstance().getExternalContext().getResponse();
    try {
  
        if (!request.authenticate(response)) {
            System.out.println("After authenticate, context = " +FacesContext.getCurrentInstance());
            if (FacesContext.getCurrentInstance()!=null) {                   
              FacesContext.getCurrentInstance().responseComplete();
            }
         }          
  
    } catch (Exception e) {  // may throw ServletException or IOException
        System.out.println("EXCEPTION calling authenticate");                
        e.printStackTrace();
    }                
  }
  
  }
  </code></pre>
  
  <p>The call to authenticate() doesn't throw an exception, but if it returns false, then FacesContext.getCurrentInstance() also returns null, and after the method exits 
  I get this error:</p>
  
  <pre><code>javax.enterprise.resource.webcontainer.jsf.context|_ThreadID=23;_Thread
  Name=Thread-3;|Exception when handling error trying to reset the
  response.
  java.lang.NullPointerException
  at
  com.sun.faces.facelets.tag.jsf.core.DeclarativeSystemEventListener.processEvent(EventHandler.java:126    )
  </code></pre>
  
  <p>Thanks,
  Ellen</p>