Anders Steiner (Migrated from SEC-2548) said:
The AuthenticationSwitchUserEvent is published in attemptSwitchUser method before the Authentication object is placed in the Security Context. The event should be published after line 158 where SecurityContextHolder.getContext().setAuthentication(targetUser); is called.
The issue is also there when trying to exit an user, The event is published in attemptExitUser when it should be published in the doFilter method after line 173.
Anders Steiner (Migrated from SEC-2548) said:
The AuthenticationSwitchUserEvent is published in
attemptSwitchUsermethod before the Authentication object is placed in the Security Context. The event should be published after line 158 whereSecurityContextHolder.getContext().setAuthentication(targetUser);is called.The issue is also there when trying to exit an user, The event is published in
attemptExitUserwhen it should be published in thedoFiltermethod after line 173.