AuthenticationProvider & Bean #PostConstruct ordering - spring

Question

For a login page, I have an authentication method as:
#Component(value = "customSpringAuthentication")
public class CustomSpringAuthentication implements AuthenticationProvider {
#SuppressWarnings({ "serial", "deprecation" })
#Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
...
return authUser;
}
}
Also I have a bean, which is called after authentication:
#Component(value = "loggedinUserBean")
#Scope("session")
public class LoggedinUserBean {
private AuthUser authUser;
private boolean isAdminUser = false;
#PostConstruct
public void initModel() {
....
authUser = (AuthUser) SecurityContextHolder.getContext().getAuthentication();
....
}
}
My question is when I am trying to access "authUser" in initmodel()method, it is null.
I know that authenticate method did not return null. But somewhat I realized that initmodel() works few miliseconds before authenticate returns. So that it can't get authetication object properly. How can I ensure/define ordering that without authenticate() returns loggedinuser is not initalized?

Answer 1

To actually answer your question, the initModel() method will be run immediately after your LoggedinUserBean object is created. This doesn't mean that its initialised. Initialisation and creation are two separate things. When an object is created, the JVM allocates memory for that object and all its fields. All the fields are null because they don't have values but the memory is set aside for you to populate the fields. Initialisation means that authUser will not be null because you have given it a value and you will only give it a value when authenticate() is called. As long as you aren't setting authUser anywhere else, then you are fine.
TL;DR: Its already guaranteed by Spring Security that your authUser is null until the user successfully authenticates using one of your authentication providers. If authUser remains null after then entire springSecurityFilterChain has been tried then the login attempt has failed.