In @RepositoryRestController AuthenticationPrincipalArgumentResolver (@AuthenticationPrincipal) not involved [DATAREST-1312]

[spring-projects-issues]

Grigory Kislin opened DATAREST-1312 and commented

Test project located at https://github.com/gkislin/spring-data-rest-authentication-principal

Check with  [admin@javaops.ru|mailto:admin@javaops.ru] / admin:

https://github.com/gkislin/spring-data-rest-authentication-principal/blob/master/src/main/java/ru/javaops/bootjava/restaurantvoting/web/VoteController.java#L54

http://localhost:8080/api/votes/current

OK, AuthenticationPrincipalArgumentResolver involved

https://github.com/gkislin/spring-data-rest-authentication-principal/blob/master/src/main/java/ru/javaops/bootjava/restaurantvoting/web/RestaurantController.java#L39

[http://localhost:8080/api/restaurants/3/vote]
java.lang.NullPointerException: nulljava.lang.NullPointerException: null at ru.javaops.bootjava.restaurantvoting.AuthUser.<init>

AuthenticationPrincipalArgumentResolver doesn't involved.
SecurityContextHolder.getContext().getAuthentication() works fine

---

Affects: 3.1.3 (Lovelace SR3)

Reference URL: https://github.com/gkislin/spring-data-rest-authentication-principal

[alturkovic]

Sorry for resurrecting an old issue, but it is still reproducible in Spring Boot 4.0.5.

I managed to get the annotation working manually:

@Configuration
class RepositoryRestSecurityConfiguration : BeanPostProcessor {
    override fun postProcessAfterInitialization(bean: Any, beanName: String): Any {
        if (bean is RequestMappingHandlerAdapter) {
            val current = bean.argumentResolvers ?: mutableListOf()
            if (current.none { it is AuthenticationPrincipalArgumentResolver }) {
                bean.argumentResolvers = listOf(AuthenticationPrincipalArgumentResolver()) + current
            }
        }
        return bean
    }
}

But I expected this to work out of the box, seemed like an unexpected hurdle and I am not even sure if doing it like this is really a good idea.

Are there other preferred ways to get the principal injected instead?