title: How to show logged in user details on non-secured JSP page after login via Spring Security and CAS?
body: <p>I have a simple web app example.  Some unsecured pages and some secured pages.  </p>
  
  <p>Login is via Spring Security and CAS. Application is mostly working OK - users get directed to CAS login page when requesting a secured resource, login works, and user gets redirected back to the secure page they requested.  User will have various authentication properties - available to be checked with Spring Security taglib : <a href="http://www.springframework.org/security/tags" rel="nofollow">http://www.springframework.org/security/tags</a> - eg: </p>
  
  <pre><code>Authentication class : 
      class   org.springframework.security.web.
      authentication.preauth.PreAuthenticatedAuthenticationToken
  
  Authentication authorities : [ROLE_ADMIN]
  
  Authentication name : admin-user
  
  Authentication authenticated : true
  
  Authentication principal : 
      org.springframework.security.core.userdetails.User@bf0d4bda:
      Username: admin-user; 
      Password: [PROTECTED]; 
      Enabled: true; 
      AccountNonExpired: true;   
      credentialsNonExpired: true; 
      AccountNonLocked: true; 
      Granted Authorities: ROLE_ADMIN
  </code></pre>
  
  <p>However, once that logged-in user visits a non-secured page, then they appear to be seen as having none of these credentials.  Instead, they are see as </p>
  
  <pre><code>Authentication class : class 
      org.springframework.security.authentication.AnonymousAuthenticationToken
  
  Authentication authorities : [ROLE_ANONYMOUS]
  
  Authentication name : anonymousUser
  
  Authentication authenticated : true
  
  Authentication principal : anonymousUser
  </code></pre>
  
  <p>So, this makes it impossible to use the security taglib to show or hide page items on the unsecured pages based on whether or not the user is logged in - eg, can't show a logout button if the user is already logged in: </p>
  
  <pre><code>&lt;sec:authorize access="isAuthenticated()" &gt;
      &lt;a href='&lt;c:url value="/j_spring_security_logout" /&gt;'&gt;logout&lt;/a&gt;
  &lt;/sec:authorize&gt;
  </code></pre>
  
  <p>or show login button if not logged in: </p>
  
  <pre><code>&lt;sec:authorize access="not isAuthenticated()" &gt;
      &lt;a href='&lt;c:url value="/secure/home" /&gt;'&gt;login&lt;/a&gt;
  &lt;/sec:authorize&gt;
  </code></pre>
  
  <p>Logged in user always shows as not authenticated in these pages even when logged in.  So always sees the login button, and never the logout.  When going back to a secured page, there is no problem.  This is not fatal to my app - but the same principle makes it impossible for me to customise the non-secured pages with content only appropriate to logged in users (menus, messages, etc). </p>
  
  <p>Is this normal behaviour with Spring Security + CAS?  Or is there a way to make it work as you would expect?  Perhaps I have misconfigured the filter chains?   </p>
  
  <p>One more thing - I have exeprimented with looking at SPRING_SECURITY_CONTEXT in the session.  At first I thought this would work - this gets popluated with Granted Authorities = ROLE_ADMIN on the unsecured pages.  So, I thought I could use that to detect if a user was logged in and had the correct authority.  However, SPRING_SECURITY_CONTEXT does not get popluated on the very first secured page that gets loaded on the return from CAS - only on subsequent page loads.</p>