Resolve AuthenticationPrincipal to empty proxy after migration form WebSecurityConfigurerAdapter

[leonidv]

Sprint Security 5.7.2.

I have simple method with authentication principal and instead of principal get empty object.

    @GetMapping("/me2")
    fun me2(@AuthenticationPrincipal user: User): User {
        return user
    }


interface IUserInfo {
    val id: UserId
    val email: String
    val externalId: String
    val displayName: String
    val avatar: String
    val subscriptionPlan: SubscriptionPlan
}

interface User : IUserInfo {
    val roles: Set<String>
    val domain: String
        get() = this.email.split('@').last()
}

BasicAuthenticationFilter correctly initializes SecurtyContextHolder with values, but a response of the method contains nulls:

{
    "id": null,
    "displayName": null,
    "externalId": null,
    "avatar": null,
    "email": null,
    "roles": null,
    "subscriptionPlan": null,
    "domain": null
}

The problem occurred after migration from WebSecurityConfigurerAdapter to @Bean SecurityFilterChain. Initial configuration: https://github.com/leonidv/ideaelection/blob/websecuirty-updates/backend/src/main/kotlin/idel/infrastructure/security/WebSecurityConfig.kt

Broken configuration: https://github.com/leonidv/ideaelection/blob/websecuirty-updates/backend/src/main/kotlin/idel/infrastructure/security/WebSecurityConfigBroken.kt

I suppose it's duplicate of https://github.com/spring-projects/spring-security/issues/10930

[leonidv]

What I have discovered. If I use WebMvcConfigurerAdapter is give correct order of HandlerMethodArgumentResolverComposite.argumentResolvers. When I switch to use @Bean SecurityFIlterChain, I have incorrect order.

I can use custom Argument Resolver, that correct inserted before ProxyingHandlerMethodArgumentResolver

[rwinch]

Thank you for the report. Can you please provide a complete sample on how to reproduce?

[spring-projects-issues]

If you would like us to look at this issue, please provide the requested information. If the information is not provided within the next 7 days this issue will be closed.

[leonidv]

You can reproduce the bug with my project, it's opensource. This commit contains broken configuration: https://github.com/leonidv/ideaelection/tree/7f6f47fc150ddb624f8a1e49be7df2d3b210ca15

Before start application you should run https://github.com/leonidv/ideaelection/blob/7f6f47fc150ddb624f8a1e49be7df2d3b210ca15/scripts/postgresql-run.sh (it executes postresql via podman)

[rwinch]

Sorry for being unclear. What I'm looking for is:

A link to a GitHub repository with a minimal, reproducible sample.

As outlined in the issue template you filled out.

I doubt that postgresql is necessary to reproduce this issue.

[spring-projects-issues]

If you would like us to look at this issue, please provide the requested information. If the information is not provided within the next 7 days this issue will be closed.

[spring-projects-issues]

Closing due to lack of requested feedback. If you would like us to look at this issue, please provide the requested information and we will re-open the issue.