Spring Security @AuthenticationPrincipal

In my case, I get a String back (the username) and not the UserDetails object, i.e. you should define the method signature as

public ModelAndView index(@AuthenticationPrincipal String username)

This is not strange, since @AuthenticationPrincipal in effect returns Authentication.getPrincipal() and according to the documentation:

In the case of an authentication request with username and password, this would be the username. Callers are expected to populate the principal for an authentication request.

The AuthenticationManager implementation will often return an Authentication containing richer information as the principal for use by the application. Many of the authentication providers will create a UserDetails object as the principal. See: https://docs.spring.io/spring-security/site/docs/5.0.0.RELEASE/api/

So, I am assuming that your AuthenticationManager implementation is returning just a username

Instead of using @AuthenticationPrincipal you can directly specify your dependency for authenticated user in method argument. something as given below

@RequestMapping(value = "/", method = RequestMethod.GET)
public ModelAndView index(Principal user) {
    ModelAndView mav= new ModelAndView("/web/index");
    mav.addObject("user", user);
    return mav;
} 

This Principal object will be actual object that got authenticated through spring security. Spring will inject this for you when the method will get invoked.

From documentation:

Class AuthenticationPrincipalArgumentResolver will resolve the CustomUser argument using Authentication.getPrincipal() from the SecurityContextHolder. If the Authentication or Authentication.getPrincipal() is null, it will return null. If the types do not match, null will be returned unless AuthenticationPrincipal.errorOnInvalidType() is true in which case a ClassCastException will be thrown.

This simple code works for me:

@RestController
public class ApiController {

  @RequestMapping(method = RequestMethod.GET, path = "/api/public/{id}")
  public ResponseEntity<ApiResponse> getPublicResource(
      @PathVariable Integer id,
      @AuthenticationPrincipal String principal
  ) {

    if (id % 2 == 0) {
      SecurityContext context = SecurityContextHolder.getContext();
      Authentication authentication = context.getAuthentication();
      return ResponseEntity.ok(new ApiResponse(
          authentication.getPrincipal().toString(),
          "this method scrapes principal directly from SpringSecurityContext"));
    }

    return ResponseEntity.ok(new ApiResponse(
        principal.toString(),
        "this method retrieves principal from method argument"));

  }

}

Just check the type of the principal in Authentication object.

You need to check if you are using the correct version of @AuthenticationPrincipal annotation and the correct version of AuthenticationPrincipalArgumentResolver class together.

Prior to 4.0 version of Spring Security you had to use classes:

• org.springframework.security.web.bind.annotation.AuthenticationPrincipal

• org.springframework.security.web.bind.support.AuthenticationPrincipalArgumentResolver

From version 4.0 onwards, you must use:

• org.springframework.security.core.annotation.AuthenticationPrincipal

• org.springframework.security.web.method.annotation.AuthenticationPrincipalArgumentResolver

Look at @AuthenticationPrincipal official docs for configuration examples.

I found another solution, even this is not the canonical one.

In your controller

@RequestMapping(value = "/login", method = RequestMethod.POST, consumes = MediaType.APPLICATION_JSON_VALUE)
@ResponseBody
public ResponseEntity<UserDTO> login(@RequestBody UserDTO user){
    try {
        usersService.authenticate(user.getUsername(), user.getPassword());
        return new ResponseEntity<UserDTO>(user, HttpStatus.OK);
    }
    catch (BadCredentialsException e){
        return new ResponseEntity<UserDTO>(HttpStatus.UNAUTHORIZED);
    }
}

Where the UserDTO os just a form to contains a username and a password

In your CustomUserDetailsService

public void authenticate(String username, String password){
    try{
        User user = new User(username, password);
        Authentication request = new UsernamePasswordAuthenticationToken(user, password, Arrays.asList(WebSecurityConfiguration.USER));
        Authentication result = authenticationManager.authenticate(request);
        SecurityContextHolder.getContext().setAuthentication(result);       
    } catch (InternalAuthenticationServiceException e){
        // treat as a bad credential
    }
}

Implement your own AuthenticationManager

@Component
class DefaultAuthenticationManager implements AuthenticationManager {

@Autowired
private CustomUserDetailsService usersService;

public Authentication authenticate(Authentication auth) throws AuthenticationException {
    UserDetails user = usersService.loadUserByUsername(((User)auth.getPrincipal()).getUsername());
    if (user != null) {
        return new UsernamePasswordAuthenticationToken(user, user.getPassword(), user.getAuthorities());
    }
// Handle bad credentials here  
}
}

What is fundamental is that the Principal in the CustomUserDetailsService#authenticate is an object, not the name of your authenticated user, so that the framework can handle it and then inject through @AuthenticationPrincipal mechanism. This worked for me.

@RequestMapping(method= RequestMethod.GET,value="/authenticate", produces = MediaType.APPLICATION_JSON_VALUE)
public Object authenticate(@AuthenticationPrincipal Object obj) {
    return obj;
}

I have the same problem, I was able to make this work. You could use it with a mapper

@RequestMapping(method = RequestMethod.GET, value = "/authenticate2", produces = MediaType.APPLICATION_JSON_VALUE)
public User authenticate2(@AuthenticationPrincipal Object obj) throws IOException {
    return mapper.readValue(mapper.writeValueAsString(obj), User.class);
}

These worked for me, I hope it would work for anyone in the future

Defining (expression = "userDetails") for the @AuthenticationPrincipal works for me

public ResponseEntity<UserDetails> index(@AuthenticationPrincipal(expression = "userDetails") UserDetails userDetails) {
     return ResponseEntity.ok(userDetails);
}

@RequestMapping(value = "/", method = RequestMethod.GET)
public ModelAndView index(@AuthenticationPrincipal(expression = "user") User user) {
    ModelAndView mav= new ModelAndView("/web/index");
    mav.addObject("user", user);
    return mav;
}

Just put expression = "user" and you are good to go. (If your User entity class name is different, update this accordingly.)

The return type of @AuthenticationPrincipal can be different for different auth methods (Username/password vs Oauth2 for example).

To find out the return type of @AuthenticationPrincipal. See https://stackoverflow.com/a/76435763/5303092

I'm achieving this with an authentication provider that extends AbstractUserDetailsAuthenticationProvider .

In my provider I'm overriding the following method:

protected UserDetails retrieveUser( String username, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {}

and in this method I'm creating my UserDetails implementation and return it. Then I'm able to get it in the controller with the AuthenticationPrincipal annotation.

Even though documentation mentioned about a customUser, I don't think it's possible. Use @AuthenticationPrincipal with java.lang.Object or org.springframework.security.core.userdetails.User as spring controller method parameter type.

If the types do not match, null will be returned unless AuthenticationPrincipal.errorOnInvalidType() is true in which case a ClassCastException will be thrown. Spring API Documentation

You have to ensure that the class which you want to get is implemented UserDetails because the annotation returns this.

I am facing exactly the same issue as you. for some reason, spring security's @EnableWebSecurity not add argumentResolver automatically, you need to add it manual:

<mvc:annotation-driven>
    <mvc:argument-resolvers>
        <bean class="org.springframework.security.web.method.annotation.AuthenticationPrincipalArgumentResolver"/>
    </mvc:argument-resolvers>
</mvc:annotation-driven>