code: @Override
  	public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
  			throws IOException {
  		final String requestURI = request.getRequestURI();
  		UserAuthentication userAuth = null;
  
  		if (requestURI.endsWith(FACEBOOK_ACTION)) {
  			String authCode = request.getParameter("code");
  			if (!StringUtils.isBlank(authCode)) {
  				String appid = SecurityUtils.getAppidFromAuthRequest(request);
  				String redirectURI = SecurityUtils.getRedirectUrl(request);
  				App app = Para.getDAO().read(App.id(appid == null ? Config.getRootAppIdentifier() : appid));
  				String[] keys = SecurityUtils.getOAuthKeysForApp(app, Config.FB_PREFIX);
  				String url = Utils.formatMessage(TOKEN_URL, authCode, redirectURI, keys[0], keys[1]);
  				try {
  					HttpGet tokenPost = new HttpGet(url);
  					String accessToken = parseAccessToken(httpclient.execute(tokenPost));
  					if (accessToken != null) {
  						userAuth = getOrCreateUser(app, accessToken);
  					}
  				} catch (Exception e) {
  					logger.warn("Facebook auth request failed: GET " + url, e);
  				}
  			}
  		}
  
  		return SecurityUtils.checkIfActive(userAuth, SecurityUtils.getAuthenticatedUser(userAuth), true);
  	}
docs: Handles an authentication request.
  @param request HTTP request
  @param response HTTP response
  @return an authentication object that contains the principal object if successful.
  @throws IOException ex