Get UserDetails Object from Security Context in Spring MVC Controller

Question

I am using Spring Security 3 and Spring MVC 3.05.

I would like to print the username of the current user, how can I get UserDetails in my controller?

@RequestMapping(value="/index.html", method=RequestMethod.GET) public ModelAndView indexView(){ UserDetails user = ? mv.addObject("username", user.getUsername()); ModelAndView mv = new ModelAndView("index"); return mv; } 

Answer 1

If you already know for sure that the user is logged in (in your example, if /index.html is protected):

 UserDetails userDetails = (UserDetails)SecurityContextHolder.getContext().getAuthentication().getPrincipal(); 

To check if a user is logged in first, make sure that the current Authentication not AnonymousAuthenticationToken .

 Authentication auth = SecurityContextHolder.getContext().getAuthentication(); if (!(auth instanceof AnonymousAuthenticationToken)) { // userDetails = auth.getPrincipal() } 

Answer 2

Let Spring 3 injection take care of this.

Thanks to tsunade21 the easiest way:

  @RequestMapping(method = RequestMethod.GET) public ModelAndView anyMethodNameGoesHere(Principal principal) { final String loggedInUserName = principal.getName(); } 

Answer 3

If you just want to print the username on the pages, you might like this solution. It is free from object casting and works without Spring Security too:

 @RequestMapping(value = "/index.html", method = RequestMethod.GET) public ModelAndView indexView(HttpServletRequest request) { ModelAndView mv = new ModelAndView("index"); String userName = "not logged in"; // Any default user name Principal principal = request.getUserPrincipal(); if (principal != null) { userName = principal.getName(); } mv.addObject("username", userName); // By adding a little code (same way) you can check if user has any // roles you need, for example: boolean fAdmin = request.isUserInRole("ROLE_ADMIN"); mv.addObject("isAdmin", fAdmin); return mv; } 

Note. Added parameter HttpServletRequest request .

This works fine because Spring introduces its own objects (wrappers) for HttpServletRequest, Principal, etc., so you can use standard java methods to retrieve user information.

Answer 4

if you use spring protection then you can get the current logged in user

 Authentication auth = SecurityContextHolder.getContext().getAuthentication(); String name = auth.getName(); //get logged in username 

Answer 5

This is another solution (Spring Security 3):

 public String getLoggedUser() throws Exception { String name = SecurityContextHolder.getContext().getAuthentication().getName(); return (!name.equals("anonymousUser")) ? name : null; }