Question

I have the requirement that every user can change his own user name while he stays logged in. The problem is how to update the username (Principal) in Spring Security`s Authentication Token?

(I have to update it, because I use the prinicpal name from the Authentication Token to identify the user in some business use cases.)

I use form based and cookie rememeber me based login so my Authentication Tokens are UsernamePaswordAuthenticationToken and RememberMeAuthenticationToken. Both have a field principal where the login name is stored. Unfortunately this variable is final, so I can not change its value.

Does anybody has an idea how Spring Security recomends to change the Principal in the Authentication Token?

My current workarround is that I replaced the UsernamePaswordAuthenticationToken and RememberMeAuthenticationToken with subclasses that have an additional not final principal field and override the getPrincipal() method to return this additional principal instead of the original one. Then I have also subclassed the two classes that generate this tokens to create my tokens instead of the original one. — But I feel that this is a big hack.

Answer 1

Why go with token i.e. Authentication subclasses? Doesn’t Authentication.getPrincipal() return an instance of UserDetails in your case?

If you supplied your own UserDetails implementation (one with a setUsername() method) while authenticating you’re home free if I understand your case correctly.