An Authentication object was not found in the SecurityContex 异常

[daocha]

最近正在使用spring security做函数安全性控制，如果通过访问页面的方式，我查看在调用方法的时候能够顺利进入@PreAuthorize中指定的验证函数返回 true or false 以判断是否具备访问权限。

可是目前我使用Spring 的 @Scheduled 进行一些定期的操作，也就是说在没有session的情况下，没有用户触发系统自己调用方法，可是当系统后台调用这个@Scheduled方法的时候，而在这个方法内部调用了一些通过@PreAuthorize控制了访问权限的方法，这样一来就出现如下异常，无法验证是否具备访问权限。很恼人。。

异常代码如下

org.springframework.security.authentication.AuthenticationCredentialsNotFoundException: An Authentication object was not found in the SecurityContext
	at org.springframework.security.access.intercept.AbstractSecurityInterceptor.credentialsNotFound(AbstractSecurityInterceptor.java:325)
	at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:196)
	at org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:64)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
	at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:110)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
	at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)
	at $Proxy40.refreshGlobalCacheStrategyMetrics(Unknown Source)
	at org.sly.main.server.service.system.scheduling.MaintenanceServiceImpl.runRecreateStrategyMetricsCache(MaintenanceServiceImpl.java:85)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
	at java.lang.reflect.Method.invoke(Method.java:597)
	at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:318)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:183)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:150)
	at org.springframework.aop.interceptor.AsyncExecutionInterceptor$1.call(AsyncExecutionInterceptor.java:80)
	at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
	at java.util.concurrent.FutureTask.run(FutureTask.java:138)
	at java.lang.Thread.run(Thread.java:662)

我在网上找了很久，在spring官网也看到这个问题，可是没有给出具体解决方法

http://static.springsource.org/spring-security/site/faq.html#auth-exception-credentials-not-found

摘取了相关的描述如下：

1.5. I get an exception with the message "An Authentication object was not found in the SecurityContext". What's wrong?

This is a another debug level message which occurs the first time an anonymous user attempts to access a protected resource, but when you do not have an AnonymousAuthenticationFilter in your filter chain configuration.

DEBUG [ExceptionTranslationFilter] - Authentication exception occurred; redirecting to authentication entry point
org.springframework.security.AuthenticationCredentialsNotFoundException:
An Authentication object was not found in the SecurityContext
at org.springframework.security.intercept.AbstractSecurityInterceptor.credentialsNotFound(AbstractSecurityInterceptor.java:342)
at org.springframework.security.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:254)


而在另一个页面给出了配置 AnonymousAuthenticationFilter
http://static.springsource.org/spring-security/site/docs/3.0.x/reference/anonymous.html

说是要这么配置

<bean id="anonymousAuthFilter"
    class="org.springframework.security.web.authentication.AnonymousAuthenticationFilter">
  <property name="key" value="foobar"/>
  <property name="userAttribute" value="anonymousUser,ROLE_ANONYMOUS"/>
</bean>

<bean id="anonymousAuthenticationProvider"
    class="org.springframework.security.authentication.AnonymousAuthenticationProvider">
  <property name="key" value="foobar"/>
</bean>

于是乎，我就在我的 application-security.xml 中做了如下配置，但是没有任何效果

	<beans:bean id="springSecurityFilterChain"
		class="org.springframework.security.web.FilterChainProxy">
		<security:filter-chain-map path-type="ant">
			<security:filter-chain pattern="/**"
				filters="anonymousAuthFilter" />
		</security:filter-chain-map>
	</beans:bean>
	<!-- ///////////////////////////////////////// -->
	<!-- ////for AnonymousAuthenticationFilter//// -->
	<!-- ///////////////////////////////////////// -->
	<beans:bean id="anonymousAuthFilter"
		class="org.springframework.security.web.authentication.AnonymousAuthenticationFilter">
		<beans:property name="key" value="foobar" />
		<beans:property name="userAttribute" value="anonymousUser,ROLE_ANONYMOUS" />
	</beans:bean>

	<beans:bean id="anonymousAuthenticationProvider"
		class="org.springframework.security.authentication.AnonymousAuthenticationProvider">
		<beans:property name="key" value="foobar" />
	</beans:bean>

[blessson]

我这也碰到了相同的问题，有没有人可以解决啊，急啊！！！

[ylei.yanglei]

An Authentication object was not found in the SecurityContext。
没有在Security上下文中找到认证信息！

在spring security进行处理前，会经过一条过虑链处理（一系列filter），每个过滤器会进行一些必要的处理，其中就有一个将认证信息（当前用户认证信息）放入到SecurityContext（应该是个线程变量）中，后续才可以用这些信息进行鉴权处理（如lz描述的处理@PreAuthorize声明的方法）。

按照lz的说法，由 @Scheduled 进行一些定期的操作，这样是不会进过虑链处理，当然不会有Authentication，所以出错！
所以你应该考虑在由@Scheduled触发的线程中将Authentication放入到SecurityContext中！

[daocha]

[Quote=引用 2 楼 的回复:]

An Authentication object was not found in the SecurityContext。
没有在Security上下文中找到认证信息！

在spring security进行处理前，会经过一条过虑链处理（一系列filter），每个过滤器会进行一些必要的处理，其中就有一个将认证信息（当前用户认证信息）放入到SecurityContext（应该是个线程变量）……
[/Quote]

虽然已经自行解决，但是思路与你的是一致的，人工模拟了一下authentication，用一个保留用户名和密码登录了

[听听米]

楼主如何解决的，求解释