LoginController present in package

org.springframework.extensions.surf.mvc

is the entry point for setting the user related data.
Using this we can do anything.
public ModelAndView handleRequestInternal(HttpServletRequest request, HttpServletResponse response) throws Exception
{
request.setCharacterEncoding("UTF-8");

String username = (String) request.getParameter("username");
String password = (String) request.getParameter("password");
String successPage = (String) request.getParameter("success");
String failurePage = (String) request.getParameter("failure");

boolean success = false;
try
{
// check whether there is already a user logged in
HttpSession session = request.getSession(false);
if (session != null)
{
// destroy old session and log out the current user
AuthenticationUtil.logout(request, response);
}

UserFactory userFactory = FrameworkUtil.getServiceRegistry().getUserFactory();

// see if we can authenticate the user
boolean authenticated = userFactory.authenticate(request, username, password);
if (authenticated)
{
// this will fully reset all connector sessions
RequestContext context = FrameworkUtil.getCurrentRequestContext();
AuthenticationUtil.login(request, response, username, false);

// mark the fact that we succeeded
success = true;
}
}
catch (Throwable err)
{
throw new ServletException(err);
}

// If they succeeded in logging in, redirect to the success page
// Otherwise, redirect to the failure page
if (success)
{
if (successPage != null)
{
response.sendRedirect(successPage);
}
else
{
response.sendRedirect(request.getContextPath());
}
}
else
{
// inval


_______________________________________

AuthenticationUtil in the org.springframework.extensions.surf.site has the code for handling the user and cookies, which will be used for the future calls