title: Pre-authentication in Spring Security + LDAP
body: <p>Here is what I want to achieve:</p>
  
  <p>I am using Websphere and I want to rely on the container to do the authentication (using Kerberos+SPNEGO).  When it come to Spring Security, I want to rely on the pre-authentication, and use LDAP to retrieve user details (roles etc) for authorization checking.</p>
  
  <p>Here is the part of Spring app context config I have (tried to only include related parts)</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;s:global-method-security secured-annotations="enabled" pre-post-annotations="enabled" proxy-target-class="true" /&gt;
  
  &lt;bean id="springSecurityFilterChain" class="org.springframework.security.web.FilterChainProxy"&gt;
      &lt;s:filter-chain-map path-type="ant"&gt;
          &lt;s:filter-chain pattern="/**"
              filters="securityContextPersistenceFilter,preAuthenticatedFilter" /&gt;
      &lt;/s:filter-chain-map&gt;
  &lt;/bean&gt;
  
  
  &lt;s:http use-expressions="true" create-session="stateless" auto-config="true"&gt;
  &lt;!--
      &lt;s:http-basic /&gt;
  --&gt;
  &lt;/s:http&gt;
  
  &lt;bean id="securityContextPersistenceFilter" 
          class="org.springframework.security.web.context.SecurityContextPersistenceFilter"&gt;
      &lt;property name='securityContextRepository'&gt;
          &lt;bean class='org.springframework.security.web.context.HttpSessionSecurityContextRepository'&gt;
              &lt;property name='allowSessionCreation' value='true' /&gt;
          &lt;/bean&gt;
      &lt;/property&gt;
  &lt;/bean&gt;
  
  
  &lt;bean id="preAuthenticatedFilter"
          class="org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter"&gt;
      &lt;property name="authenticationManager" ref="authenticationManager" /&gt;
  &lt;/bean&gt;
  
  &lt;s:authentication-manager alias="authenticationManager"&gt;
      &lt;s:authentication-provider ref="preAuthenticatedAuthenticationProvider"   /&gt;
  &lt;/s:authentication-manager&gt;
  
  &lt;bean id="preAuthenticatedAuthenticationProvider" 
          class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider"&gt;
      &lt;property name="preAuthenticatedUserDetailsService" &gt;
          &lt;bean class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper" &gt;
              &lt;property name="userDetailsService" ref="userDetailsService" /&gt;
          &lt;/bean&gt;
      &lt;/property&gt;
  &lt;/bean&gt;
  
  
  &lt;bean id="userDetailsService" class="org.springframework.security.ldap.userdetails.LdapUserDetailsService" &gt;
      &lt;constructor-arg index="0" ref="ldapUserSearch"/&gt;
      &lt;constructor-arg index="1" ref="ldapAuthoritiesPopulator"/&gt;
      &lt;property name="userDetailsMapper" &gt;
          &lt;bean class="com.foo.MyUserDetailsMapper" /&gt;
      &lt;/property&gt;
  &lt;/bean&gt;
  
  &lt;bean id="ldapContextSource"
      class="org.springframework.security.ldap.DefaultSpringSecurityContextSource"&gt;
      &lt;!-- some setting skipped here --&gt;
  &lt;/bean&gt;
  
  &lt;bean id="ldapUserSearch" class="org.springframework.security.ldap.search.FilterBasedLdapUserSearch"&gt;
      &lt;!-- some setting skipped here --&gt;
  &lt;/bean&gt;
  
  &lt;bean id="ldapAuthoritiesPopulator"
      class="org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator"&gt;
      &lt;!-- some setting skipped here --&gt;
  &lt;/bean&gt;
  
  &lt;bean id="ldapTemplate" class="org.springframework.ldap.core.simple.SimpleLdapTemplate"&gt;
      &lt;constructor-arg ref="ldapContextSource" /&gt;
  &lt;/bean&gt;
  </code></pre>
  
  <p>It mostly worked, I can see correct user name and role coming in for my custom <code>UserDetailsMapper</code> (com.foo.MyUserDetailsMapper) which comes from LDAP, and inside that I am returning a new <code>UserDetails</code> with updated roles.</p>
  
  <p>The problem is, in my controller, when I tried to do</p>
  
  <pre><code>SecurityContextHolder.getContext().getAuthentication()
  </code></pre>
  
  <p>It is returning null. (For which works before I change to pre-authentication)</p>
  
  <p>Is there anything I missed?</p>