Spring security @notation for IS_AUTHENTICATED_FULLY?

Question

I am simply trying to allow a user access to a method if they are authenticated, but nothing I am doing seems to work. Is there a way to just check if the user has been authenticated? The following still denies the user even when authenticated... Is there a built in role for an authenticated user?

@RequestMapping("/secure")
@PreAuthorize("hasRole('IS_AUTHENTICATED_FULLY')")
public String secure(ModelMap map){
    return("secure");
}

Answer 1

hasRole('ROLE_USER') is the traditional name for any user who is authenticated. You would typically use ROLE_ANONYMOUS for parts where you don't care if the person is authenticated or not.

(Added later:)

I think you will need to implement a custom AccessDecisionVoter that will always vote ACCESS_GRANTED whenever the parameter authentication has isAuthenticated() true, and the CONFIG_ATTRIBUTE is ROLE_USER or similar.

There is further discussion of this in this forum discussion, giving details of a web.xml and other config.

Answer 2

In your custom UserDetailService implementation just add the Role "IS_AUTHENTICATED_FULLY" to the User object before it's returned.

Answer 3

This is what I have ended up using:

@PreAuthorize("isAuthenticated()")