Question

My setup :

In a Spring MVC 3.1 application, I have a Spring Security protected service :

@PreAuthorize("isAnonymous()") // ("hasRole('USER')") doesn't work either
public interface UserService extends UserDetailsService, PasswordEncoder

I’m trying to use this service from the init() method of a bean declared in my context :

<bean class="com.xxx.scripts.FillDbWithInitialValues" init-method="contextInit" />

The class :

public class FillDbWithInitialValues
{
    @Autowired
    UserService userService;

    public void contextInit()
    {
        User test = userService.getUser(1);
    }
}

Extract of my security.xml file :

<sec:global-method-security pre-post-annotations="enabled" />   

<sec:http auto-config="true" use-expressions="true">
    (...)
</sec:http>

<sec:authentication-manager alias="authManager">
    <sec:authentication-provider user-service-ref="userService">
        <sec:password-encoder ref="userService" />
    </sec:authentication-provider>
</sec:authentication-manager>

The problem :

When I start the application, I get an exception :

org.springframework.security.authentication.AuthenticationCredentialsNotFoundException: An Authentication object was not found in the SecurityContext

Why is this happening?
How can my bean be “authenticated” so it can use the service?

Answer 1

If there’s no user authenticated there’s no way of checking his roles. If you want that bean to be authenticated before calling the method i think you could try something in this way:

SecurityContextHolder.getContext().setAuthentication(new user here);  
User test = userService.getUser(1);