Cannot use parameter @Auth in parent resource

We have a root/parent resource “Users”, and a sub-resource “Vehicles”. For example: /users/<id>/vehicles will return the vehicles of the given user.

But before letting sub-resource “Vehicles” handle the request, we want to check if the currently authenticated user has access to data of the given user. The reason is that there will be more than one endpoint in “Vehicles”, and we would like to have one centralised access check in the parent resource “Users”, instead of having to check in every endpoint of sub-resource “Vehicles”.

But when using the @Auth parameter in the parent resource, like so (@Auth User authedUser):

@Path("{userId}/vehicles")
@RolesAllowed(Role.USER)
public Class<VehiclesResource> getVehicles(@Auth User authedUser, @PathParam("userId") Long userId) {
    return VehiclesResource.class;
}

the following exception is thrown: java.lang.IllegalStateException: Cannot inject a custom principal into unauthenticated request

Is there a way to check the authenticated user in the parent resource?

[Gaudon]

Any update on this? I seem to be running into the same issue.

[splatch]

This issue is still valid for 2.0.6. I made my own filter and been struggling with it for half a day thinking that it is something wrong with my code. It turns out that my code is fine.

So to everyone who is still struggling with this one - as a workaround I marked my filter with @PreMatching annotation. It doesn’t look right to me, but works. This bug (or feature) comes from Jersey code which sort filters in such a way that they are called after the sub-resource method chain is being called. There are at least two issues standing in Jersey project for quite long time eclipse-ee4j/jersey#3297 and eclipse-ee4j/jersey#3021.

Anyhow, hope it helps someone in future to solve the problem.