Inject request principal with Spring framework

[sapessi]

The request principal is not automatically injected using the Spring framework.

@RequestMapping(value = "/word-cloud",
            method = RequestMethod.GET,
            produces = MediaType.APPLICATION_JSON_VALUE)
    public @ResponseBody
    WordCloud getWordCloudForTopicId(@RequestParam params,
                                     Principal principal) {

[sapessi]

I looked into this. Spring is doing the right thing and calling the getPrincipal method of the HttpServletRequest object. By default, the framework uses the AwsProxySecurityContext object to retrieve the user principal. The object only supports the authorization types supported by API Gateway, it does not recognize a user principal from the request: https://github.com/awslabs/aws-serverless-java-container/blob/master/aws-serverless-java-container-core/src/main/java/com/amazonaws/serverless/proxy/internal/jaxrs/AwsProxySecurityContext.java#L65

Where did you expect the user principal to come from?

[sapessi]

Confirmed 0.5-SNAPSHOT behaves as expected for Cognito User Pools. One additional note:

one thing to consider may to follow the default in Spring, I believe it will return a Principal with named anonymousUser with a single ROLE_ANONYMOUS authority
for the first case
instead of null

[sapessi]

Any updates on this? If there is no feature request here, I will close this item.

[sapessi]

Comment from Gitter chat:
one thing to consider may to follow the default in Spring, I believe it will return a Principal with named anonymousUser with a single ROLE_ANONYMOUS authority
for the first case
instead of null

[sapessi]

After looking into this, my decision is that this should not be a change in the framework. according to the servlet specifications, if there is no authenticated user, the getUserPrincipal method should return null: http://docs.oracle.com/javaee/7/api/javax/servlet/http/HttpServletRequest.html#getUserPrincipal--

To retrieve the expected value with spring, the application should leverage the AnonymousAuthenticationFilter