Error executing @Query if SecurityEvaluationContextExtension is defined and no user is logged in although principal is not used in query. [DATAJPA-1357]

Stefano Bertini opened DATAJPA-1357 and commented

I have an update method in a repository and the method is annotated with @Query. A SecurityEvaluationContextExtension bean is defined in the context. I need to execute the @Query method in a task that runs in a @Scheduled method. As no Authentication is defined when the scheduled method is executed, I get this exception:

org.springframework.dao.InvalidDataAccessApiUsageException: Authentication object cannot be null; nested exception is java.lang.IllegalArgumentException: Authentication object cannot be null at
  org.springframework.orm.jpa.EntityManagerFactoryUtils.convertJpaAccessExceptionIfPossible(EntityManagerFactoryUtils.java:384) at
  org.springframework.orm.jpa.vendor.HibernateJpaDialect.translateExceptionIfPossible(HibernateJpaDialect.java:246) at 
  org.springframework.orm.jpa.AbstractEntityManagerFactoryBean.translateExceptionIfPossible(AbstractEntityManagerFactoryBean.java:525) at 
  org.springframework.dao.support.ChainedPersistenceExceptionTranslator.translateExceptionIfPossible(ChainedPersistenceExceptionTranslator.java:59) at 
  org.springframework.dao.support.DataAccessUtils.translateIfNecessary(DataAccessUtils.java:209) at 
  org.springframework.dao.support.PersistenceExceptionTranslationInterceptor.invoke(PersistenceExceptionTranslationInterceptor.java:147) at 
  org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) at 
  org.springframework.data.jpa.repository.support.CrudMethodMetadataPostProcessor$CrudMethodMetadataPopulatingMethodInterceptor.invoke(CrudMethodMetadataPostProcessor.java:133) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) at 
  org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:92) at 
  org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) at 
  org.springframework.data.repository.core.support.SurroundingTransactionDetectorMethodInterceptor.invoke(SurroundingTransactionDetectorMethodInterceptor.java:57) at 
  org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) at 
  org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:213) at 
  com.sun.proxy.$Proxy162.myqueryannotatedmethod(Unknown Source)

As a workaround, in the @Scheduled method I put a fake Authentication into the SecurityContext, but I would like to know if there is a better solution.

SecurityContext context = SecurityContextHolder.getContext();
Authentication authentication = new SomeKindOfAuthentication();
context.setAuthentication(authentication);

Affects: 1.6.6 (Dijkstra SR6)

2 votes, 6 watchers