loginmodules/password/pwcommon/src/main/java/org/beiter/michael/authn/jaas/loginmodules/password/common/PasswordLoginModule.java
@Override
    // Check is broken [LOG.info()]: PMD reports issues although log stmt is guarded. @todo revisit when upgrading PMD.
    @SuppressWarnings("PMD.GuardLogStatementJavaUtil")
    public final boolean commit()
            throws LoginException {

        LOG.debug("Committing authentication");

        if (pendingSubject == null) {
            // the login method of this module has failed earlier, hence we do not need to clean up anything
            // return 'false' to indicate that this module's login and/or commit method failed
            // As the login method failed, the state of the module has already been cleared and we do not know
            // the username / domain anymore. Hence no auditing / message queue notification, and not verbose logging.

            LOG.debug("Not committing authentication, as the authentication has failed earlier (login method)");

            return false;
        } else {
            // The login has succeeded!
            // Store the principals from the pending subject both in the 'subject' object (because this is what JAAS
            // will use later on), but also create a new 'committedSubject' object that this module uses to a) keep
            // state and b) being able to remove the principals later

            LOG.debug("Committing authentication: '" + username + "@" + domain + "'");

            if (committedSubject == null) {
                committedSubject = new Subject();
            } else {

                // cache the username and domain, for they will be purged by "cleanState()"
                final String tempUsername = username;
                final String tempDomain = domain;

                cleanState();

                final String baseError = new StringBuilder().
                        append("Login post-processing failed for '").
                        append(tempUsername).
                        append("@").
                        append(tempDomain).
                        toString();
                AuditHelper.auditEvent(audit, tempDomain, tempUsername, Events.AUTHN_ERROR,
                        baseError + "', but cannot audit login attempt");
                MessageHelper.postMessage(messageQ, tempDomain, tempUsername, Events.AUTHN_ERROR,
                        baseError + "', but cannot post MQ login attempt event");

                final String error = "Expected the committed subject to be 'null' (yes, really <null>), but this was "
                        + "not the case! Has the commit method been called multiple times on the same object instance?";
                LOG.warn(error);
                throw new LoginException(error);
            }

            for (final Principal p : pendingSubject.getPrincipals()) {

                // 1. Add the principals to the 'subject' object
                if (!pSubject.getPrincipals().contains(p)) {
                    LOG.debug("Added principal " + p.getName() + " to subject");
                    pSubject.getPrincipals().add(p);
                }

                // 2. Add the principals to the 'committedSubject' object
                if (!committedSubject.getPrincipals().contains(p)) {
                    LOG.debug("Added principal " + p.getName() + " to committed subject");
                    committedSubject.getPrincipals().add(p);
                }
            }

            final String baseError = new StringBuilder().
                    append("Login succeeded for '").
                    append(username).
                    append("@").
                    append(domain).
                    toString();
            AuditHelper.auditEvent(audit, domain, username, Events.AUTHN_SUCCESS,
                    baseError + "', but cannot audit login success, and hence fail the operation");
            MessageHelper.postMessage(messageQ, domain, username, Events.AUTHN_SUCCESS,
                    baseError + "', but cannot post MQ login success event, and hence fail the operation");

            // string concatenation is only executed if log level is actually enabled
            if (LOG.isInfoEnabled()) {
                LOG.info("Authentication committed for '" + username + "@" + domain + "'");
            }

            // do not clean the state here, as we may still need it in case of an abort()
            return true;
        }
    }
@Override
    // Check is broken [LOG.info()]: PMD reports issues although log stmt is guarded. @todo revisit when upgrading PMD.
    @SuppressWarnings("PMD.GuardLogStatementJavaUtil")
    public final boolean commit()
            throws LoginException {

        LOG.debug("Committing authentication");

        if (pendingSubject == null) {
            // the login method of this module has failed earlier, hence we do not need to clean up anything
            // return 'false' to indicate that this module's login and/or commit method failed
            // As the login method failed, the state of the module has already been cleared and we do not know
            // the username / domain anymore. Hence no auditing / message queue notification, and not verbose logging.

            LOG.debug("Not committing authentication, as the authentication has failed earlier (login method)");

            return false;
        } else {
            // The login has succeeded!
            // Store the principals from the pending subject both in the 'subject' object (because this is what JAAS
            // will use later on), but also create a new 'committedSubject' object that this module uses to a) keep
            // state and b) being able to remove the principals later

            LOG.debug("Committing authentication: '" + username + "@" + domain + "'");

            if (committedSubject == null) {
                committedSubject = new Subject();
            } else {

                // cache the username and domain, for they will be purged by "cleanState()"
                final String tempUsername = username;
                final String tempDomain = domain;

                cleanState();

                final String baseError = new StringBuilder().
                        append("Login post-processing failed for '").
                        append(tempUsername).
                        append("@").
                        append(tempDomain).
                        toString();
                AuditHelper.auditEvent(audit, tempDomain, tempUsername, Events.AUTHN_ERROR,
                        baseError + "', but cannot audit login attempt");
                MessageHelper.postMessage(messageQ, tempDomain, tempUsername, Events.AUTHN_ERROR,
                        baseError + "', but cannot post MQ login attempt event");

                final String error = "Expected the committed subject to be 'null' (yes, really <null>), but this was "
                        + "not the case! Has the commit method been called multiple times on the same object instance?";
                LOG.warn(error);
                throw new LoginException(error);
            }

            for (final Principal p : pendingSubject.getPrincipals()) {

                // 1. Add the principals to the 'subject' object
                if (!pSubject.getPrincipals().contains(p)) {
                    LOG.debug("Added principal " + p.getName() + " to subject");
                    pSubject.getPrincipals().add(p);
                }

                // 2. Add the principals to the 'committedSubject' object
                if (!committedSubject.getPrincipals().contains(p)) {
                    LOG.debug("Added principal " + p.getName() + " to committed subject");
                    committedSubject.getPrincipals().add(p);
                }
            }

            final String baseError = new StringBuilder().
                    append("Login succeeded for '").
                    append(username).
                    append("@").
                    append(domain).
                    toString();
            AuditHelper.auditEvent(audit, domain, username, Events.AUTHN_SUCCESS,
                    baseError + "', but cannot audit login success, and hence fail the operation");
            MessageHelper.postMessage(messageQ, domain, username, Events.AUTHN_SUCCESS,
                    baseError + "', but cannot post MQ login success event, and hence fail the operation");

            // string concatenation is only executed if log level is actually enabled
            if (LOG.isInfoEnabled()) {
                LOG.info("Authentication committed for '" + username + "@" + domain + "'");
            }

            // do not clean the state here, as we may still need it in case of an abort()
            return true;
        }
    }
{@inheritDoc}