Spring Security: What is the right way to call method secured with @PreAuthorize in background task?

Question

I have a method secured with @PreAuthorize

@PreAuthorize("hasRole('ROLE_ADMIN') and (#action.userId != principal.id)")
public void execute(EditAction action)

Now I need to call this method from a background task. If I simply run this code - I catch an exception:

AuthenticationCredentialsNotFoundException: An Authentication object was not found in the SecurityContext

Seems, I need to set required Authentication to SecurityContext. I can:

Write some custom AuthenticationToken for background tasks.
Use UsernamePasswordAuthenticationToken with fake User.
Don't use secured methods in background tasks.
Any other recommendations ?

What is the right way?

This is not a transparent call - we are using command pattern. Secured method is a method of Handler. By a "background task" I mean a jms MessageListener or some @Scheduled method. I'm calling secured method some way, as I calling it by processing servlet - by dispatching an Action. — Popandopolos, Apr 26 '12 at 11:12

score 2 · Answer 1 · answered Apr 26 '12 at 11:13

You can register an Authentication token yourself in the current thread and session(if used in a web application):

SecurityContextHolder.getContext().setAuthentication(token);
session.put(HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY, SecurityContextHolder.getContext());

You can use the standard UsernamePasswordAuthenticationToken for this as long as you add the appropriate roles.

Madhu Tomy · Accepted Answer · 2019-09-25T17:35:13.993

In this case Manual Workaround is an option:

(1) If this is an independent job,

Create an Authentication object and set it to the security context before the secured method is invoked. Remove the Authentication object from the security context after the secured method is done execution.

public final class AuthenticationUtil {

//Ensures that this class cannot be instantiated
private AuthenticationUtil() {
}

public static void clearAuthentication() {
    SecurityContextHolder.getContext().setAuthentication(null);
}

public static void configureAuthentication(String role) {
    Collection<GrantedAuthority> authorities = AuthorityUtils.createAuthorityList(role);
    Authentication authentication = new UsernamePasswordAuthenticationToken(
            "user",
            role,
            authorities
    );
    SecurityContextHolder.getContext().setAuthentication(authentication);
}

So it would look like

AuthenticationUtil.configureAuthentication(role);
// Call to the secured method 
AuthenticationUtil.clearAuthentication();

(2) For web application, where we can't make authentication object as null, don't call

AuthenticationUtil.configureAuthentication(role);
// call to the secured method

Spring Security: What is the right way to call method secured with @PreAuthorize in background task?

2 Answers2