code: @Override
  	public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
  			throws IOException {
  		final String requestURI = request.getRequestURI();
  		UserAuthentication userAuth = null;
  		User user = null;
  
  		if (requestURI.endsWith(OPENID_ACTION)) {
  			Authentication oidAuth = super.attemptAuthentication(request, response);
  
  			if (oidAuth == null) {
  				// hang on... redirecting to openid provider
  				return null;
  			} else {
  				//success!
  				AuthenticatedUserDetails userDetails = (AuthenticatedUserDetails) oidAuth.getPrincipal();
  				userAuth = new UserAuthentication(userDetails);
  				user = userDetails.getUser();
  			}
  		}
  
  		return SecurityUtils.checkIfActive(userAuth, user, true);
  	}
docs: Handles an authentication request.
  @param request HTTP request
  @param response HTTP response
  @return an authentication object that contains the principal object if successful.
  @throws IOException ex