Spring Security UserDetails Best Practice

Question

I am using my own implementation of the UserDetailsService interface to load a User object from the Database and place it as UserDetail into my SecurityContext. The User object is then a detached Hibernate object.

When I want to access lazy load relations of the authenticated User I need to get it from the SecurityContext and attach it again to the Hibernate session by loading through its ID or merge.

Where to you do that typically in an Spring MVC or Spring WS application? In the Controller which means that I have to inject the UserDAO into it, or do you pass the ID down into the Service layer to load it there?

Answer 1

None of that belongs in the Controller. Put it in the Service layer.

Controller is really part of the view. If you change view technologies, it shouldn't alter the proper operation of the Service. Put it there and inject the Service in the Controller.

DAOs don't belong in Controllers for the same reason.