Spring Security 4 issue using Query Method

Question

I am using the latest spring security 4 version and it introduces a new feature to use the logged in user details directly in the query method using expression language. Here is my spring data repository code:

public interface UserRepository extends JpaRepository<User, Long> {
    @Query("select username from User u where u.username = ?#{ principal?.username }")
    User findByUsername(String username);
}

In the above code, I have an entity User as below: @Entity @Table(name = "users")

public class User { 

    @Id
    @Column(name = "username", nullable = false, unique = true)
    private String username;
    @Column(name = "password", nullable = false)
    @NotNull
    private String password;
    @Column(name = "enabled", nullable = false)
    @NotNull
    private Boolean enabled;

    @Column(name = "role", nullable = false)
    @Enumerated(EnumType.STRING)
    private Role role;
    //getters and setters

Also I have this entry for enabling this feature:

@Bean
public SecurityEvaluationContextExtension securityEvaluationContextExtension() {
    return new SecurityEvaluationContextExtension();
}

When I run the application, I get the error:

Caused by: org.springframework.dao.InvalidDataAccessApiUsageException: Authentication object cannot be null; nested exception is java.lang.IllegalArgumentException: Authentication object cannot be null
    at org.springframework.orm.jpa.EntityManagerFactoryUtils.convertJpaAccessExceptionIfPossible(EntityManagerFactoryUtils.java:381)
    at org.springframework.orm.jpa.vendor.HibernateJpaDialect.translateExceptionIfPossible(HibernateJpaDialect.java:223)
    at org.springframework.orm.jpa.AbstractEntityManagerFactoryBean.translateExceptionIfPossible(AbstractEntityManagerFactoryBean.java:417) 
Caused by: java.lang.IllegalArgumentException: Authentication object cannot be null
    at org.springframework.security.access.expression.SecurityExpressionRoot.<init>(SecurityExpressionRoot.java:46)
    at org.springframework.security.data.repository.query.SecurityEvaluationContextExtension$1.<init>(SecurityEvaluationContextExtension.java:113)
    at org.springframework.security.data.repository.query.SecurityEvaluationContextExtension.getRootObject(SecurityEvaluationContextExtension.java:113)
    at org.springframework.data.repository.query.ExtensionAwareEvaluationContextProvider$EvaluationContextExtensionAdapter.<init>(ExtensionAwareEvaluationContextProvider.java:463)
    at org.springframework.data.repository.query.ExtensionAwareEvaluationContextProvider.toAdapters(ExtensionAwareEvaluationContextProvider.java:210)
    at org.springframework.data.repository.query.ExtensionAwareEvaluationContextProvider.access$000(ExtensionAwareEvaluationContextProvider.java:58)

What could be the issue. Here I am posting to check if there is any issue in using the query method. Can i use like principal.username, is that correct?

Update: When I removed the @Query from repository it works fine. That means its problem with the new spring security 4 using principal.username. Is there anything wrong in this expression?

@Query("select username from User u where u.username = ?#{ principal?.username }")

Avis · Accepted Answer · 2015-09-26 06:04:14Z

1

Pls try this custom class :-

class SecurityEvaluationContextExtension extends  EvaluationContextExtensionSupport  {

  @Override 
  public String getExtensionId() { 
    return "Security"; 
  }

  @Override 
  public SecurityExpressionRoot getRootObject() { 
    Authentication authentication =  SecurityContextHolder.getContext().getAuthentication(); 
    return new SecurityExpressionRoot(authentication){}; 
  } 
}

edited Sep 26, 2015 at 6:04

answered Sep 26, 2015 at 2:45

Avis

2,23520 silver badges28 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Krishna Over a year ago

I have added this custom class. Then also its not working.

Eddy · Accepted Answer · 2016-03-18 14:40:32Z

0

Not sure whether you have solved the issue in the meantime, but I noticed that your query should look like:

select u from User u where u.username = ?#{ principal }

assuming your principal object is the plain username String.

answered Mar 18, 2016 at 14:40

Eddy

1,8232 gold badges23 silver badges39 bronze badges

Comments

Berk · Accepted Answer · 2016-12-28 13:23:37Z

If you created your own SecurityEvaluationContextExtension class, and did not implement getAuthentication() method, you might be getting this exception.

In this link, you can see original SecurityEvaluationContextExtension.java file, that implements all necessary methods.

So, you don't need to implement this class on your own. Instead, you can add below dependency to your pom file to have the original one;

<!-- https://mvnrepository.com/artifact/org.springframework.security/spring-security-data -->
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-data</artifactId>
    <version>4.2.1.RELEASE</version>
</dependency>

If you are using any other dependency manager rather than maven, you can goto related maven repo and get the definition that you want.

I hope this helps.

Collectives™ on Stack Overflow

Spring Security 4 issue using Query Method

3 Answers 3

1 Comment

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related