{"id":60162,"date":"2016-09-16T09:08:57","date_gmt":"2016-09-16T06:08:57","guid":{"rendered":"https:\/\/www.javacodegeeks.com\/?p=60162"},"modified":"2016-09-15T13:11:54","modified_gmt":"2016-09-15T10:11:54","slug":"injecting-authenticated-user-spring-mvc-controllers","status":"publish","type":"post","link":"https:\/\/www.javacodegeeks.com\/2016\/09\/injecting-authenticated-user-spring-mvc-controllers.html","title":{"rendered":"Injecting authenticated user into Spring MVC @Controllers"},"content":{"rendered":"

Injecting injecting authenticated user into Spring MVC handler method can be done with @AuthenticationPrincipal<\/code> annotation and AuthenticationPrincipalArgumentResolver<\/code> that is an implementation of Spring MVS MethodArgumentResolver<\/code>. AuthenticationPrincipalArgumentResolver<\/code> is registered by default with web security configuration (e.g. when you enable security with @EnableWebSecurity<\/code>).<\/p>\n

1. Custom UserDetails<\/code><\/h3>\n

Let\u2019s assume we have our custom UserDetails<\/code> implementation:<\/p>\n

import org.springframework.security.core.GrantedAuthority;\r\nimport pl.codeleak.surveyapp.entities.Member;\r\n\r\nimport java.util.Collection;\r\n\r\npublic class AccountDetails\r\n    extends org.springframework.security.core.userdetails.User {\r\n\r\n    private final Account account;\r\n\r\n    public AccountDetails(Account account,\r\n                          Collection<? extends GrantedAuthority> authorities) {\r\n        super(account.getMember().getEmail(), account.getPassword(), authorities);\r\n        this.account = account;\r\n    }\r\n\r\n    public Account getAccount() {\r\n        return account;\r\n    }\r\n\r\n    public Member getMember() {\r\n        return account.getMember();\r\n    }\r\n}<\/pre>\n
AccountDetails<\/code> has two additional methods that allow accessing a related account and member information. AccountDetails<\/code> is then used by our own UserDetailsService<\/code> implementation that is later used by Spring Security DAO Authentication Manager to authenticate users.
 
<\/div> <\/div><\/p>\n
Note: Spring Security configuration is out of the scope of this article.<\/p>\n
2. Injecting AccountDetails<\/code><\/h3>\n
The most basic use of @AuthenticationPrincipal<\/code> annotation is to inject UserDetails. In our scenario we want AccountDetails<\/code> to be injected. In order to do so simply put @AuthenticationPrincipal<\/code> annotated argument to Spring MVC handler method:<\/p>\n
@RequestMapping(value = {\"\", \"\/\", \"index.html\"})\r\npublic String index(@AuthenticationPrincipal AccountDetails accountDetails) {\r\n    return \"index\";\r\n}<\/pre>\n
In case the authenticated user does not exist accountDetails<\/code> will evaluate to null<\/code>. In case user is authenticated – accountDetails<\/code> will evaluate to a valid object.<\/p>\n
Note: As of Spring 4.0 you should use org.springframework.security.core.annotation.AuthenticationPrincipal<\/code><\/p>\n
3. Using expression<\/code> to inject AccountDetails<\/code> properties<\/h3>\n
AccountDetails<\/code> has two additional methods the get the account<\/code> and member<\/code> objects. If we want to inject them directly into the handler method we can use expression<\/code> property of @AuthenticatedPricipal<\/code> annotation:<\/p>\n
@RequestMapping(value = {\"\", \"\/\", \"index.html\"})\r\npublic String index(@AuthenticationPrincipal(expression = \"account\") Account account) {\r\n    return \"index\";\r\n}<\/pre>\n
@RequestMapping(value = {\"\", \"\/\", \"index.html\"})\r\npublic String index(@AuthenticationPrincipal(expression = \"member\") Member member) {\r\n    return \"index\";\r\n}<\/pre>\n
The expression defines a SpEL expression that will be used when injecting the argument. Pretty handy.<\/p>\n
4. \u2018Extending\u2019 @AuthenticationPrincipal<\/code> annotation<\/h3>\n
Instead of repeating in handler methods @AuthenticationPrincipal(expression = \"account\") Account account<\/code> we may create a meta annotation and use it in our @Controller<\/code>s:<\/p>\n
@Target({ElementType.PARAMETER})\r\n@Retention(RetentionPolicy.RUNTIME)\r\n@AuthenticationPrincipal(expression = \"account\")\r\npublic @interface LoggedInAccount {\r\n\r\n}<\/pre>\n
5. @AuthenticationPrincipal<\/code> in Spring Security 3.2 and Spring Security 4+<\/h3>\n