Question

When using spring security, specifically with @notation; what is the proper way to access the principal in a Controller? Lets say the following is my controller, but I would like to access the principal in the secure() method somewhere…

@Controller
public class LoginController {

    @RequestMapping(value = "/login", method = RequestMethod.GET)
    public String login(ModelMap map, @RequestParam(value="fail" , required=false) String fail){
        map.addAttribute("title", "Login: AD Credentials");
        if(fail != null){
            map.addAttribute("error", "Invalid credentials");
        }
        return("login");
    }

    @RequestMapping("/secure")
    @PreAuthorize("isAuthenticated()")
    public String secure(ModelMap map, String principal){
        System.out.println(principal);
        return("secure");
    }


}

Answer 1

The easiest is SecurityContextHolder.getContext().getAuthentication().getPrincipal(). Works via thread-local pattern.