How to retrieve UserDetails with Spring Security 3?

Question

www.someurl.com - public access not intercepted by Spring Security 3.
www.someurl.com/admin  - intercepted by Spring Security 3. Works fine.

I log into a page under www.someurl.com/admin. Then I change the url to www.someurl.com in the same window tab. I am working within the same http session so I expect to be able to retrieve user login details.

The public url request is handled by a dedicated controller. Within this controller, I have a wired user service. The implementer of this service is attempting to retrieve credentials but can't - Authentication object is null.

Authentication a=SecurityContextHolder.getContext().getAuthentication();
userDetails=(UserDetails) a.getPrincipal();

=== UPDATE =========================

When I inspect the HttpSession in the public url request controller, I see this attribute:

{SPRING_SECURITY_CONTEXT=org.springframework.security.core.context.SecurityContextImpl@ed20eaf7: Authentication: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@ed20eaf7: Principal: org.springframework.security.core.userdetails.User@586034f: Username: admin; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ADMINISTRATOR,AUTHOR,EDITOR,READER; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@380f4: RemoteIpAddress: 127.0.0.1; SessionId: 43A582157C5813018632ACDD7499CF7D; Granted Authorities: ADMINISTRATOR, AUTHOR, EDITOR, READER}

The code looks okay - are you sure that you have spring security configured to intercept the www.someurl.com url? — John Farrelly

John Farrelly John Farrelly · Accepted Answer · 2013-01-05T18:57:58

If you want to get security details like you are, Spring Security must intercept the url, otherwise there won't be any security information. You can add the following to your spring security config:

<security:http pattern="/" security='none' />

This means that spring security will let everyone see the root url (whether logged in or not), but spring security will process the url, meaning your controller against the root url will be able to get the current user login details from SecurityContextHolder

How to retrieve UserDetails with Spring Security 3?

1 Answers