DelegatingNegotiateSecurityFilter is not using the customAuthentication returned from the delegated authentication manager for the call to the success handler.

[mstittle]

DelegatingNegotiateSecurityFilter is not using the customAuthentication returned from the delegated authentication manager for the call to the success handler.

protected boolean setAuthentication(final HttpServletRequest request, final HttpServletResponse response,
            final Authentication authentication) {
        try {
            if (this.authenticationManager != null) {
                DelegatingNegotiateSecurityFilter.LOGGER.debug("Delegating to custom authenticationmanager");
                final Authentication customAuthentication = this.authenticationManager.authenticate(authentication);
                SecurityContextHolder.getContext().setAuthentication(customAuthentication);
            }
            if (this.authenticationSuccessHandler != null) {
                try {
                    this.authenticationSuccessHandler.onAuthenticationSuccess(request, response, authentication);
                } catch (final IOException | ServletException e) {
                    DelegatingNegotiateSecurityFilter.LOGGER.warn("Error calling authenticationSuccessHandler: {}",
                            e.getMessage());
                    DelegatingNegotiateSecurityFilter.LOGGER.trace("", e);
                    return false;
                }
            }`

[hazendaz]

@mstittle Can you be a little more explicit as to what the issue is? For example, if that is our source code, please indicate exactly what lines are wrong. Also, PR would be welcome.

[mstittle]

the authentication manager delegate is invoked with the authentication object passed to setAuthentication(). The authentication manager delegate creates a new custom authentication object with different roles (per my custom logic). This is returned as the customAuthentication instance which is passed to the SecurityContextHolder.getContext().setAuthentication(customAuthentication);

I also have a authenticationSuccessHandler configured but per the source code above this is not passed the customAuthentication rather the original authentication instance hence the authenticationSuccessHandler is working from the original authentication object and roles. My handler is looking for the custom roles but in the this case they won't be present. Make sense?

[hazendaz]

Yes, any chance you can raise a pull request on this? I'm a bit tied up with another project so won't be able to get to this soon and I know a number of folks are waiting for next official release. So would be wonderful to get a fix in time to make the release. The release itself is all but done so fixing this would be a big plus ;)

[cmolodo]

I've run into this issue as well. I'll create a pull request to fix.

[hazendaz]

solved in #956