title: How can I check Spring Security for user authentication and get roles from Flex?
body: <p>I'm using Spring, Spring Security, BlazeDS, Flex and spring-flex. </p>
  
  <p>I know that I can call <code>channelSet.login()</code> and <code>channelSet.logout()</code> to hook into Spring Security for authentication. <code>channelSet.authenticated</code> apparently only knows about the current Flex session, as it always starts off as <em>false</em>, until you call <code>channelSet.login()</code>.</p>
  
  <p>What I want to do:</p>
  
  <ol>
    <li> Check from Flex to know if a user is already in a session.</li>
    <li> If so, I want their username and roles.</li>
  </ol>
  
  <p><strong>UPDATE</strong><br>
  I just thought I'd add details of the solution I used from <a href="https://stackoverflow.com/users/41754/brd6644">brd6644</a>'s answer below, so that this might be easier for someone else who looks this up. I used <a href="https://stackoverflow.com/questions/248562/when-using-spring-security-what-is-the-proper-way-to-obtain-current-username-i">this</a> StackOverflow answer to make the <code>SecurityContext</code> injectable. I won't be rewriting the code from that answer in this one, so go look at it for the <code>SecurityContextFacade</code>.</p>
  
  <p><em>securityServiceImpl.java</em></p>
  
  <pre><code>public class SecurityServiceImpl implements SecurityService {
      private SecurityContextFacade securityContextFacade;
  
      @Secured({"ROLE_PEON"})
      public Map&lt;String, Object&gt; getUserDetails() {
          Map&lt;String,Object&gt; userSessionDetails = new HashMap&lt;String, Object&gt;();
  
          SecurityContext context = securityContextFacade.getContext();
          Authentication auth = context.getAuthentication();
          UserDetails userDetails = (UserDetails) auth.getPrincipal();
  
          ArrayList roles = new ArrayList();
          GrantedAuthority[] grantedRoles = userDetails.getAuthorities();
          for (int i = 0; i &lt; grantedRoles.length; i++) {
              roles.add(grantedRoles[i].getAuthority());
          }
  
          userSessionDetails.put("username", userDetails.getUsername());
          userSessionDetails.put("roles", roles);
          return userSessionDetails;
      }
  }
  </code></pre>
  
  <p><br/>
  <em>securityContext.xml</em></p>
  
  <pre><code>&lt;security:http auto-config="true"&gt;
      &lt;!-- Don't authenticate Flex app --&gt;
      &lt;security:intercept-url pattern="/flexAppDir/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /&gt;
      &lt;!-- Don't authenticate remote calls --&gt;
      &lt;security:intercept-url pattern="/messagebroker/amfsecure" access="IS_AUTHENTICATED_ANONYMOUSLY" /&gt;
  &lt;/security:http&gt;
  
  &lt;security:global-method-security secured-annotations="enabled" /&gt;
  
  &lt;bean id="securityService" class="ext.domain.project.service.SecurityServiceImpl"&gt;
      &lt;property name="securityContextFacade" ref="securityContextFacade" /&gt;
  &lt;/bean&gt;
  &lt;bean id="securityContextFacade" class="ext.domain.spring.security.SecurityContextHolderFacade" /&gt;
  </code></pre>
  
  <p><br/>
  <em>flexContext.xml</em></p>
  
  <pre><code>&lt;flex:message-broker&gt;
      &lt;flex:secured /&gt;
  &lt;/flex:message-broker&gt;
  
  &lt;flex:remoting-destination ref="securityService" /&gt;
  &lt;security:http auto-config="true" session-fixation-protection="none"/&gt;
  </code></pre>
  
  <p><br/>
  <em>FlexSecurityTest.mxml</em></p>
  
  <pre><code>&lt;mx:Application ... creationComplete="init()"&gt;
  
      &lt;mx:Script&gt;&lt;![CDATA[
          [Bindable]
          private var userDetails:UserDetails; // custom VO to hold user details
  
          private function init():void {
              security.getUserDetails();
          }
  
          private function showFault(e:FaultEvent):void {
              if (e.fault.faultCode == "Client.Authorization") {
                  Alert.show("You need to log in.");
                  // show the login form
              } else {
                  // submit a ticket
              }
          }
          private function showResult(e:ResultEvent):void {
              userDetails = new UserDetails();
              userDetails.username = e.result.username;
              userDetails.roles = e.result.roles;
              // show user the application
          }
      ]]&gt;&lt;/mx:Script&gt;
  
      &lt;mx:RemoteObject id="security" destination="securityService"&gt;
          &lt;mx:method name="getUserDetails" fault="showFault(event)" result="showResult(event)" /&gt;
      &lt;/mx:RemoteObject&gt;
  
      ...
  &lt;/mx:Application&gt;
  </code></pre>