An Authentication object was not found in the SecurityContext

Question

1. I have an application exporting web services, with a configured Spring Security SecurityFilterChain (with SecurityContextPersistenceFilter among others, which is required for the rest).
2. My application also uses Spring Security to secure method invocations.

I have following error when method security is triggered:

org.springframework.security.authentication.AuthenticationCredentialsNotFoundException: An Authentication object was not found in the SecurityContext

The 2nd part requires an Authentication in SecurityContextHolder as showed in org.springframework.security.access.intercept.AbstractSecurityInterceptor (line 195):

SecurityContextHolder.getContext().getAuthentication();

But, SecurityContextPersistenceFilter removes it before method invocation is triggered, as shown in org.springframework.security.web.context.SecurityContextPersistenceFilter (line 84)

SecurityContextHolder.clearContext();

What can I do to have this object in SecurityContextHolder when method invocation is triggered?

Thank you in advance.

I'm using Spring Security 3.0.8-RELEASE

Answer 1

OK, my application is placed over Apache CXF DOSGi 1.4 to generate REST endpoints. Apache CXF interceptors cause an unexpected behaviour and SecurityContextHolder.clearContext() is called before finishing the request processing.

More information about this bug can be found here.