User Granted Authorities are always : ROLE_ANONYMOUS?

Question

I am using the following method to make a programmatic login after registration

private void autoLogin(User user,
            HttpServletRequest request)
    {

GrantedAuthority[] grantedAuthorities = new GrantedAuthority[] { new GrantedAuthorityImpl(
                "ROLE_ADMIN") };

        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(
                user.getUsername(), user.getPassword(),grantedAuthorities);

        // generate session if one doesn't exist
        request.getSession();

        token.setDetails(new WebAuthenticationDetails(request));
        Authentication authenticatedUser = authenticationManager.authenticate(token);

        SecurityContextHolder.getContext().setAuthentication(authenticatedUser);
    }

the user is authenticated but always has the ROLE_ANONYMOUS I don't know why ? any ideas ?

i think that this is because the page requries a ROLE_ADMIN principal and the user role after authentication is anonymous, any one knows how to make the user principal an admin when logging ? — Mahmoud Saleh, Oct 13 '10 at 12:14

axtavt · Accepted Answer · 2010-10-13T16:14:57.807

10

This behaviour looks very strange. Javi suggests to persist security context into session manually, but it should be done automatically by Spring Security's SecurityContextPersistenceFilter.

One possible cause I can imagine is filters = "none" in <intercept-url> of your registration processing page.

filters = "none" disables all security filters for the specified URL. As you can see, it may interfere with other features of Spring Security. So, the better approach is to keep filters enabled, but to configure them to allow access for all users. You have several options:

With old syntax of access attribute (i.e. without <http use-expressions = "true" ...>):
- access = "ROLE_ANONYMOUS" allows access for non-authenticated users, but denies for the authenticated ones
- To allow access for all users you may write access = "IS_AUTHENTICATED_ANONYMOUSLY, IS_AUTHENTICATED_FULLY, IS_AUTHENTICATED_REMEMBERED"
Using new Spring Expression Language-based syntax (<http use-expressions = "true" ...>) you simply write access = "true" to allow access for all users (but other <intercept-url>s should use this syntax too).

edited Oct 13 '10 at 16:14

answered Oct 13 '10 at 14:43

axtavt

239,438
41
511
482

yes you are right i am using filters = "none" on the register page , what is the difference between it and access = "ROLE_ANONYMOUS" ? – Mahmoud Saleh Oct 13 '10 at 15:29
so if i use access="true" only this means anyone can access the page, but what about the filters are they executed too ? and what about using both access="true" and filters="none" is that possible ? – Mahmoud Saleh Oct 13 '10 at 17:01
@sword101: If you write `filters="none"`, filters are not executed. Otherwise they are executed. – axtavt Oct 13 '10 at 17:26
1

You say `but other s should use this syntax too` however I use access="true" and filters="none" both together and works well. What you mean with that? Does it mean I can not use filters="none" and access="true" at different interceptors if I set ? – kamaci Sep 12 '11 at 18:27

score 1 · Answer 2 · answered Oct 13 '10 at 12:43

1

I had a similar issue and I had to set manually to the session this after doing the authentication.

request.getSession().setAttribute(HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY, SecurityContextHolder.getContext());

Try it.

answered Oct 13 '10 at 12:43

Javi

19,387
30
102
135

thanks man, worked fine for me, but i am curious what is the benefit for that line of code ? – Mahmoud Saleh Oct 13 '10 at 13:18
As axtavt says it just sets the security manager in session. I do agree that it should be done automatically but when I tried I had to set it to get it working. – Javi Oct 13 '10 at 15:12

User Granted Authorities are always : ROLE_ANONYMOUS?

2 Answers2

Linked