Spring security @notation for IS_AUTHENTICATED_FULLY?

Question

I am simply trying to allow a user access to a method if they are authenticated, but nothing I am doing seems to work. Is there a way to just check if the user has been authenticated? The following still denies the user even when authenticated... Is there a built in role for an authenticated user?

@RequestMapping("/secure")
@PreAuthorize("hasRole('IS_AUTHENTICATED_FULLY')")
public String secure(ModelMap map){
    return("secure");
}

Answer 1

IS_AUTHENTICATED_FULLY is not a role - it is a pre-defined credential (aka 'magic' string) recognized by the AuthenticatedVoter to indicate that you have logged in. This voter also supports anonymous and remember-me login.

Roles are processed by the RoleVoter which recognizes any sting starting with "ROLE_" (prefix is configurable). Thus hasRole('IS_AUTHENTICATED_FULLY') doesn't work because it's not a role. @RolesAllowed("IS_AUTHENTICATED_FULLY") wouldn't work for the same reason.

When using Spring expression language, the correct expression is:

 @PreAuthorize("isAuthenticated()")

Alternatively, you can use:

 @Secured("IS_AUTHENTICATED_FULLY")

No custom classes are required - both voters are enabled by default.

Answer 2

This is what I have ended up using:

@PreAuthorize("isAuthenticated()")