An Authentication object was not found in the SecurityContext

Question

1. I have an application exporting web services, with a configured Spring Security SecurityFilterChain (with SecurityContextPersistenceFilter among others, which is required for the rest).
2. My application also uses Spring Security to secure method invocations.

I have following error when method security is triggered:

org.springframework.security.authentication.AuthenticationCredentialsNotFoundException: An Authentication object was not found in the SecurityContext

The 2nd part requires an Authentication in SecurityContextHolder as showed in org.springframework.security.access.intercept.AbstractSecurityInterceptor (line 195):

SecurityContextHolder.getContext().getAuthentication();

But, SecurityContextPersistenceFilter removes it before method invocation is triggered, as shown in org.springframework.security.web.context.SecurityContextPersistenceFilter (line 84)

SecurityContextHolder.clearContext();

What can I do to have this object in SecurityContextHolder when method invocation is triggered?

Thank you in advance.

I'm using Spring Security 3.0.8-RELEASE

Answer 1

SecurityContextHolder.clearContext() will be called only after request processing completion. So normally all your application logic code will be executed before this line, and there is no problem at all. But the problem may be present if you execute some new thread in your code (by default security context will be not propogated). If this is your case then you can try to force context propogation to child thread. If you use only one thread then make sure that all your code is covered by spring security filter chain (may be you have some custom filter that executed around spring security filter chain?).

Answer 2

OK, my application is placed over Apache CXF DOSGi 1.4 to generate REST endpoints. Apache CXF interceptors cause an unexpected behaviour and SecurityContextHolder.clearContext() is called before finishing the request processing.

More information about this bug can be found here.