Injecting authenticated user into Spring MVC @Controllers

Rafal BorowiecSeptember 16th, 2016Last Updated: September 15th, 2016

1 186 2 minutes read

Injecting injecting authenticated user into Spring MVC handler method can be done with @AuthenticationPrincipal annotation and AuthenticationPrincipalArgumentResolver that is an implementation of Spring MVS MethodArgumentResolver. AuthenticationPrincipalArgumentResolver is registered by default with web security configuration (e.g. when you enable security with @EnableWebSecurity).

1. Custom `UserDetails`

Let’s assume we have our custom UserDetails implementation:

import org.springframework.security.core.GrantedAuthority;
import pl.codeleak.surveyapp.entities.Member;

import java.util.Collection;

public class AccountDetails
    extends org.springframework.security.core.userdetails.User {

    private final Account account;

    public AccountDetails(Account account,
                          Collection<? extends GrantedAuthority> authorities) {
        super(account.getMember().getEmail(), account.getPassword(), authorities);
        this.account = account;
    }

    public Account getAccount() {
        return account;
    }

    public Member getMember() {
        return account.getMember();
    }
}

AccountDetails has two additional methods that allow accessing a related account and member information. AccountDetails is then used by our own UserDetailsService implementation that is later used by Spring Security DAO Authentication Manager to authenticate users.

Note: Spring Security configuration is out of the scope of this article.

2. Injecting `AccountDetails`

The most basic use of @AuthenticationPrincipal annotation is to inject UserDetails. In our scenario we want AccountDetails to be injected. In order to do so simply put @AuthenticationPrincipal annotated argument to Spring MVC handler method:

@RequestMapping(value = {"", "/", "index.html"})
public String index(@AuthenticationPrincipal AccountDetails accountDetails) {
    return "index";
}

In case the authenticated user does not exist accountDetails will evaluate to null. In case user is authenticated – accountDetails will evaluate to a valid object.

Note: As of Spring 4.0 you should use org.springframework.security.core.annotation.AuthenticationPrincipal

3. Using `expression` to inject `AccountDetails` properties

AccountDetails has two additional methods the get the account and member objects. If we want to inject them directly into the handler method we can use expression property of @AuthenticatedPricipal annotation:

@RequestMapping(value = {"", "/", "index.html"})
public String index(@AuthenticationPrincipal(expression = "account") Account account) {
    return "index";
}

@RequestMapping(value = {"", "/", "index.html"})
public String index(@AuthenticationPrincipal(expression = "member") Member member) {
    return "index";
}

The expression defines a SpEL expression that will be used when injecting the argument. Pretty handy.

4. ‘Extending’ `@AuthenticationPrincipal` annotation

Instead of repeating in handler methods @AuthenticationPrincipal(expression = "account") Account account we may create a meta annotation and use it in our @Controllers:

@Target({ElementType.PARAMETER})
@Retention(RetentionPolicy.RUNTIME)
@AuthenticationPrincipal(expression = "account")
public @interface LoggedInAccount {

}

5. `@AuthenticationPrincipal` in Spring Security 3.2 and Spring Security 4+

Spring Security 3.2 – org.springframework.security.web.bind.annotation.AuthenticationPrincipal
Spring Security 4.0 – org.springframework.security.core.annotation.AuthenticationPrincipal

Reference:

Injecting authenticated user into Spring MVC @Controllers from our JCG partner Rafal Borowiec at the Codeleak.pl blog.