code: private void logAuditEntriesBeforeAuthn(WebReply webReply, Subject receivedSubject, String uriName, WebRequest webRequest) {
          AuthenticationResult authResult;
          if (webReply instanceof PermitReply) {
              authResult = new AuthenticationResult(AuthResult.SUCCESS, receivedSubject, null, null, AuditEvent.OUTCOME_SUCCESS);
          } else {
              authResult = new AuthenticationResult(AuthResult.FAILURE, receivedSubject, null, null, AuditEvent.OUTCOME_FAILURE);
          }
          int statusCode = Integer.valueOf(webReply.getStatusCode());
          Audit.audit(Audit.EventID.SECURITY_AUTHN_01, webRequest, authResult, statusCode);
          Audit.audit(Audit.EventID.SECURITY_AUTHZ_01, webRequest, authResult, uriName, statusCode);
      }
docs: no null check for webReply object, so make sure it is not null upon calling this method.