User Granted Authorities are always : ROLE_ANONYMOUS?

Question

I am using the following method to make a programmatic login after registration

private void autoLogin(User user,
            HttpServletRequest request)
    {

GrantedAuthority[] grantedAuthorities = new GrantedAuthority[] { new GrantedAuthorityImpl(
                "ROLE_ADMIN") };

        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(
                user.getUsername(), user.getPassword(),grantedAuthorities);

        // generate session if one doesn't exist
        request.getSession();

        token.setDetails(new WebAuthenticationDetails(request));
        Authentication authenticatedUser = authenticationManager.authenticate(token);

        SecurityContextHolder.getContext().setAuthentication(authenticatedUser);
    }

the user is authenticated but always has the ROLE_ANONYMOUS I don't know why ? any ideas ?

Solution

This behaviour looks very strange. Javi suggests to persist security context into session manually, but it should be done automatically by Spring Security's SecurityContextPersistenceFilter.

One possible cause I can imagine is filters = "none" in <intercept-url> of your registration processing page.

filters = "none" disables all security filters for the specified URL. As you can see, it may interfere with other features of Spring Security. So, the better approach is to keep filters enabled, but to configure them to allow access for all users. You have several options:

• With old syntax of access attribute (i.e. without <http use-expressions = "true" ...>):
  • access = "ROLE_ANONYMOUS" allows access for non-authenticated users, but denies for the authenticated ones
  • To allow access for all users you may write access = "IS_AUTHENTICATED_ANONYMOUSLY, IS_AUTHENTICATED_FULLY, IS_AUTHENTICATED_REMEMBERED"
• Using new Spring Expression Language-based syntax (<http use-expressions = "true" ...>) you simply write access = "true" to allow access for all users (but other <intercept-url>s should use this syntax too).

Comments

[Mahmoud Saleh]

thanks man, worked fine for me, but i am curious what is the benefit for that line of code ?

[Javi]

As axtavt says it just sets the security manager in session. I do agree that it should be done automatically but when I tried I had to set it to get it working.

[Mahmoud Saleh]

yes you are right i am using filters = "none" on the register page , what is the difference between it and access = "ROLE_ANONYMOUS" ?

[Mahmoud Saleh]

so if i use access="true" only this means anyone can access the page, but what about the filters are they executed too ? and what about using both access="true" and filters="none" is that possible ?

[axtavt]

@sword101: If you write filters="none", filters are not executed. Otherwise they are executed.

[kamaci]

You say but other <intercept-url>s should use this syntax too however I use access="true" and filters="none" both together and works well. What you mean with that? Does it mean I can not use filters="none" and access="true" at different interceptors if I set <http use-expressions = "true" ...> ?