User Granted Authorities are always : ROLE_ANONYMOUS ??

Question

i am using the following method to make a programmatic login after registration

private void autoLogin(User user,
            HttpServletRequest request)
    {

GrantedAuthority[] grantedAuthorities = new GrantedAuthority[] { new GrantedAuthorityImpl(
                "ROLE_ADMIN") };

        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(
                user.getUsername(), user.getPassword(),grantedAuthorities);

        // generate session if one doesn't exist
        request.getSession();

        token.setDetails(new WebAuthenticationDetails(request));
        Authentication authenticatedUser = authenticationManager.authenticate(token);

        SecurityContextHolder.getContext().setAuthentication(authenticatedUser);
    }

the user is authenticated but always has the ROLE_ANONYMOUS i don't know why ? any ideas ?

Answer 1

I had a similar issue and I had to set manually to the session this after doing the authentication.

request.getSession().setAttribute(HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY, SecurityContextHolder.getContext());

Try it.

Answer 2

This behaviour looks very strange. Javi suggests to persist security context into session manually, but it should be done automatically by Spring Security's SecurityContextPersistenceFilter.

One possible cause I can imagine is filters = "none" in <intercept-url> of your registration processing page.

filters = "none" disables all security filters for the specified URL. As you can see, it may interfere with other features of Spring Security. So, the better approach is to keep filters enabled, but to configure them to allow access for all users. You have several options:

• With old syntax of access attribute (i.e. without <http use-expressions = "true" ...>):
  • access = "ROLE_ANONYMOUS" allows access for non-authenticated users, but denies for the authenticated ones
  • To allow access for all users you may write access = "IS_AUTHENTICATED_ANONYMOUSLY, IS_AUTHENTICATED_FULLY, IS_AUTHENTICATED_REMEMBERED"
• Using new Spring Expression Language-based syntax (<http use-expressions = "true" ...>) you simply write access = "true" to allow access for all users (but other <intercept-url>s should use this syntax too).