spring mvc - Why isn't SpringSecurity placing my SecurityContext in the HttpSession? -

my corporate intranet application uses pre-authentication scenario. has 2 filters inserted before springsecurity filter chain. first filter provided corporation. handles logins, passwords, etc. , if recognizes user, puts authentication data in principal in cookies. second translates this, creates userdetails object , authentication token , places in securitycontextholder.

securitycontextholder.getcontext().setauthentication(token); logger.debug("auth token submitted"); 

my log confirms happening:

2015-09-30 13:02:08,998 debug c.a.v.c.s.mypreauthfilter [http-bio-8081-exec-63] auth token submitted 

a few ms later, spring security filter chain comes in , following:

2015-09-30 13:02:09,002 debug o.s.s.w.filterchainproxy [http-bio-8081-exec-63] /index.html @ position 1 of 11 in additional filter chain; firing filter: 'webasyncmanagerintegrationfilter' 2015-09-30 13:02:09,007 debug o.s.s.w.filterchainproxy [http-bio-8081-exec-63] /index.html @ position 2 of 11 in additional filter chain; firing filter: 'securitycontextpersistencefilter' 2015-09-30 13:02:09,008 debug o.s.s.w.c.httpsessionsecuritycontextrepository [http-bio-8081-exec-63] httpsession returned null object spring_security_context 2015-09-30 13:02:09,008 debug o.s.s.w.c.httpsessionsecuritycontextrepository [http-bio-8081-exec-63] no securitycontext available httpsession: org.apache.catalina.session.standardsessionfacade@721c23ce. new 1 created. 

basically, httpsessionsecuritycontextrespository invoked securitycontextpersistencefilter (part of filter chain) , checking session security context, not finding 1 in session, , replacing context placed in securitycontextholder, new empty one, resulting in authentication failure few lines below.

2015-09-30 13:02:09,024 debug o.s.s.w.a.exceptiontranslationfilter [http-bio-8081-exec-63] access denied (user anonymous); redirecting authentication entry point org.springframework.security.access.accessdeniedexception: access denied 

since spring docs don't mention httpsessionsecuritycontextrespository, figure shouldn't mess that.

instead, thought maybe try inserting second filter after spring security filter chain, didn't help. filtersecurityinterceptor (11th item in chain) refused authenticate me, did when second filter before on chain.

what save securitycontext in session , how may defeat behavior of securitycontextpersistencefilter in wiping out security context have set?

i've developed workaround. shouldn't necessary, seems work.

@override public void dofilter(servletrequest request, servletresponse response,         filterchain chain) throws ioexception, servletexception  {  ...     preauthenticatedauthenticationtoken token = ...       logger.debug("auth token placed in securitycontext: \n" + token);     securitycontextholder.getcontext().setauthentication(token);      // make sure session has securitycontext @ point     ensuresessionhassecuritycontext(hreq);      super.dofilter(request,response, chain);      logger.debug("auth token after rest of chain: \n" + securitycontextholder.getcontext()             .getauthentication());  }  private void ensuresessionhassecuritycontext(httpservletrequest hreq) {     httpsession session = hreq.getsession(false);     object securitycontext = session.getattribute(httpsessionsecuritycontextrepository.spring_security_context_key);     if (securitycontext == null) {         logger.debug("no securitycontext found in session, inserting ours");         session.setattribute(httpsessionsecuritycontextrepository.spring_security_context_key, securitycontextholder.getcontext());     }  } 

please debunk solution if appears problematical you. way can think of assure filter chain not whack new authentication, @ time want to, after preauth filter has done job, before spring filter chain takes over.