code: public Credential getSingleSignOn(HttpRequest request,
                                        HttpResponse response)
      {
          String ssoID = null;
          Cookie[] cookies = request.getCookies();
          for (int i = 0; i < cookies.length; i++)
          {
              if (cookies[i].getName().equals(SSO_COOKIE_NAME))
              {
                  ssoID = cookies[i].getValue();
                  break;
              }
          }
          if(log.isDebugEnabled())log.debug("get ssoID="+ssoID);
          
          Principal principal=null;
          Credential credential=null;
          synchronized(_ssoId2Principal)
          {
              principal=(Principal)_ssoId2Principal.get(ssoID);
              credential=(Credential)_ssoPrincipal2Credential.get(principal);
          }
          
          if(log.isDebugEnabled())log.debug("SSO principal="+principal);
          
          if (principal!=null && credential!=null)
          {
              if (response.getHttpContext().getRealm().reauthenticate(principal))
              {
                  request.setUserPrincipal(principal);
                  request.setAuthUser(principal.getName());
                  return credential;
              }
              else
              {
                  synchronized(_ssoId2Principal)
                  {
                      _ssoId2Principal.remove(ssoID);
                      _ssoPrincipal2Credential.remove(principal);
                      _ssoUsername2Id.remove(principal.getName());
                  }    
              }
          }
          return null;
      }
docs: /* ------------------------------------------------------------