spring Authentication.setAuthenticated(boolean) java.lang.IllegalArgumentException: Cannot set this token to trusted

Question

I have the following code (attempting to log a user in programatically):

List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
authorities.add(new GrantedAuthorityImpl("ROLE_ADMIN"));
...
User tempUser = new User(correctUsername, 
    correctPassword, 
    true, true, true, true, // logging them in...
    authorities // type is List<GrantedAuthority>
);
...
Authentication authentication 
    = new UsernamePasswordAuthenticationToken(tempUser, authorities);
    // I'm using authorities again (List<GrantedAuthority>)
    // is this the right spot for it?
...
// this is the line causing the error
authentication.setAuthenticated(true);

When I try to run that I get the following:

java.lang.IllegalArgumentException: Cannot set this token to trusted - use constructor which takes a GrantedAuthority list instead

Note that I'm using the authorities list of GrantedAuthoritys both in the User and Authentication objects. I'm not sure where I should be using those. I'm trying to replicate the answer for another SO question but am running into the exception posted above. Other similar questions that didn't quite answer my question:

After some searching the closest I've found to an answer was at the forum at springsource.org, and that person's using a deprecated method, but it's a similar approach. How can I log a user in programatically?

the last one; with the comment above it that says 'this is the line causing the error (authentication.setAuthenticated(true);) — Josh
– Josh, Commented Nov 15, 2011 at 14:34

pap · Accepted Answer · 2011-11-15 12:06:25Z

26

You dont have to explicitly call authentication.setAuthenticated(true) (in fact, you are not allowed). The constructor does that for you.

You are, however, invoking the wrong constructor. You should be calling:

Authentication authentication 
    = new UsernamePasswordAuthenticationToken(tempUser, password, authorities);

Check the javadoc for UsernamePasswordAuthenticationToken.

answered Nov 15, 2011 at 12:06

pap

27.7k6 gold badges44 silver badges46 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Josh Over a year ago

Awesome! thanks very much. Could I ask why both the User and UsernamePasswordAuthenticationToken constructors need a list of grantedauthorities? Anyway it works so I'll accept this when I can

pap Over a year ago

It's two levels of abstraction that happen to collide here. UsernamePasswordAuthenticationToken is concrete version of a an entity that may or may not be authenticated (Authentication). A User is an implementation of a Principal (details of a user) existing independently of any authentication status.

Mike R Over a year ago

Ran into same issue, assumed that I needed to explicitly call setAuthenticated() method.

Lawrence Paje Over a year ago

So meaning after invoking Authentication authentication = new UsernamePasswordAuthenticationToken(tempUser, password, authorities); I can call authentication.isAuthenticated(), which is expected to return TRUE?

hello_earth Over a year ago

note that user and password should not be null, otherwise isAuthenticated will return false even after calling the constructor with correct authorities

Collectives™ on Stack Overflow

spring Authentication.setAuthenticated(boolean) java.lang.IllegalArgumentException: Cannot set this token to trusted

1 Answer 1

5 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

5 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related