How to get the current logged in user object from spring security?

Question

I am using Spring security version 3.1.4.RELEASE. How can I access the current logged in user object?

SecurityContextHolder.getContext().getAuthentication().getPrinciple() 

returns user name, not user object. So how can I use the returned Username and get the UserDetails object?

I have tried the following code:

public UserDetails getLoggedInUser(){      final Authentication auth = SecurityContextHolder.getContext().getAuthentication();     if (auth != null && auth.isAuthenticated() && !(auth instanceof AnonymousAuthenticationToken))     {         if(auth.getDetails() !=null)             System.out.println(auth.getDetails().getClass());         if( auth.getDetails() instanceof UserDetails)         {             System.out.println("UserDetails");         }         else         {             System.out.println("!UserDetails");         }     }     return null; } 

Following is the result:

[2015-08-17 19:44:46.738] INFO  http-bio-8443-exec-423   System.out    class org.springframework.security.web.authentication.WebAuthenticationDetails  [2015-08-17 19:44:46.738] INFO  http-bio-8443-exec-423   System.out    !UserDetails 

AuthenticationFilter class as follows:

public class CustomUsernamePasswordAuthenticationFilter extends AbstractAuthenticationProcessingFilter {     public static final String SPRING_SECURITY_FORM_USERNAME_KEY = "j_username";     public static final String SPRING_SECURITY_FORM_PASSWORD_KEY = "j_password";     public static final String SPRING_SECURITY_LAST_USERNAME_KEY = "SPRING_SECURITY_LAST_USERNAME";     private String usernameParameter = SPRING_SECURITY_FORM_USERNAME_KEY;     private String passwordParameter = SPRING_SECURITY_FORM_PASSWORD_KEY;     private boolean postOnly = true;      public CustomUsernamePasswordAuthenticationFilter() {         super("/j_spring_security_check");     }      public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {         if (postOnly && !request.getMethod().equals("POST")) {             throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());         }          String username = obtainUsername(request);         String password = obtainPassword(request);         if (username == null) {             username = "";         }         if (password == null) {             password = "";         }         username = username.trim();         UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);          // Allow subclasses to set the "details" property         setDetails(request, authRequest);         if(this.getAuthenticationManager()==null){             logger.info("Authentication manager is null.");         } else {             logger.info("Authentication manager was "+this.getAuthenticationManager().getClass().getName());          }         return this.getAuthenticationManager().authenticate(authRequest);     }      protected String obtainPassword(HttpServletRequest request) {         return request.getParameter(passwordParameter);     }      protected String obtainUsername(HttpServletRequest request) {         return request.getParameter(usernameParameter);     }      protected void setDetails(HttpServletRequest request, UsernamePasswordAuthenticationToken authRequest) {         authRequest.setDetails(authenticationDetailsSource.buildDetails(request));     }      public void setUsernameParameter(String usernameParameter) {         this.usernameParameter = usernameParameter;     }      public void setPasswordParameter(String passwordParameter) {         this.passwordParameter = passwordParameter;     }      public void setPostOnly(boolean postOnly) {         this.postOnly = postOnly;     }      public final String getUsernameParameter() {         return usernameParameter;     }      public final String getPasswordParameter() {         return passwordParameter;     } } 

AuthenticationProvider as follows:

@Component public class CustomAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {     private MyUserDetailsService userDetailsService;      public MyUserDetailsService getUserDetailsService() {         return userDetailsService;     }      public void setUserDetailsService(MyUserDetailsService userDetailsService) {         this.userDetailsService = userDetailsService;     }      @Override     protected void additionalAuthenticationChecks(UserDetails arg0,             UsernamePasswordAuthenticationToken arg1)             throws AuthenticationException {      }      @Override     protected UserDetails retrieveUser(String arg0,             UsernamePasswordAuthenticationToken arg1)             throws AuthenticationException {         return userDetailsService.loadUserByUsername(arg0);     } } 

UserDetails class as follows:

    public class MyUserDetailsService implements UserDetailsService {            private final Map<String, UserDetails> usersList;      public MyUserDetailsService() {         Collection<GrantedAuthority> authorityList;         final SimpleGrantedAuthority supervisorAuthority = new SimpleGrantedAuthority("supervisor");         final SimpleGrantedAuthority userAuthority = new SimpleGrantedAuthority("user");         usersList = new TreeMap<String, UserDetails>();          authorityList = new ArrayList<GrantedAuthority>();         authorityList.add(supervisorAuthority);         authorityList.add(userAuthority);         usersList.put("admin", new User("admin", "admin", authorityList));          authorityList = new ArrayList<GrantedAuthority>();         authorityList.add(userAuthority);         usersList.put("peter", new User("peter", "password123", authorityList));          //probably don't use this in production         for(Map.Entry<String, UserDetails> user : usersList.entrySet()){             logger.info(user.getValue().toString());         }     }      @Override     public UserDetails loadUserByUsername(String username)throws UsernameNotFoundException {         UserDetails ud = usersList.get(username);         if (ud != null) {             logger.info("loadUserByUsername: found match, returning "                     + ud.getUsername() + ":" + ud.getPassword() + ":"                     + ud.getAuthorities().toString());             return new User(ud.getUsername(), ud.getPassword(),                     ud.getAuthorities());         }          logger.info("loadUserByUsername: did not find match, throwing UsernameNotFoundException");         throw new UsernameNotFoundException(username);     } } 

Answer 1

SecurityContextHolder.getContext().getAuthentication().getPrincipal(); 

Returns the current user object. This can be User, UserDetails or your custom user object. You will need to cast the return object to UserDetails or your own user object if it is a custom one.

OR you can inject Authentication or Principal directly in to your controllers. Principle is your UserDetails/custom user object.

Note: UserDetails is an interface