Error executing @Query if SecurityEvaluationContextExtension is defined and no user is logged in although principal is not used in query. [DATAJPA-1357]

Stefano Bertini opened DATAJPA-1357 and commented

I have an update method in a repository and the method is annotated with @Query. A SecurityEvaluationContextExtension bean is defined in the context. I need to execute the @Query method in a task that runs in a @Scheduled method. As no Authentication is defined when the scheduled method is executed, I get this exception:

org.springframework.dao.InvalidDataAccessApiUsageException: Authentication object cannot be null; nested exception is java.lang.IllegalArgumentException: Authentication object cannot be null at
  org.springframework.orm.jpa.EntityManagerFactoryUtils.convertJpaAccessExceptionIfPossible(EntityManagerFactoryUtils.java:384) at
  org.springframework.orm.jpa.vendor.HibernateJpaDialect.translateExceptionIfPossible(HibernateJpaDialect.java:246) at 
  org.springframework.orm.jpa.AbstractEntityManagerFactoryBean.translateExceptionIfPossible(AbstractEntityManagerFactoryBean.java:525) at 
  org.springframework.dao.support.ChainedPersistenceExceptionTranslator.translateExceptionIfPossible(ChainedPersistenceExceptionTranslator.java:59) at 
  org.springframework.dao.support.DataAccessUtils.translateIfNecessary(DataAccessUtils.java:209) at 
  org.springframework.dao.support.PersistenceExceptionTranslationInterceptor.invoke(PersistenceExceptionTranslationInterceptor.java:147) at 
  org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) at 
  org.springframework.data.jpa.repository.support.CrudMethodMetadataPostProcessor$CrudMethodMetadataPopulatingMethodInterceptor.invoke(CrudMethodMetadataPostProcessor.java:133) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) at 
  org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:92) at 
  org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) at 
  org.springframework.data.repository.core.support.SurroundingTransactionDetectorMethodInterceptor.invoke(SurroundingTransactionDetectorMethodInterceptor.java:57) at 
  org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) at 
  org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:213) at 
  com.sun.proxy.$Proxy162.myqueryannotatedmethod(Unknown Source)

As a workaround, in the @Scheduled method I put a fake Authentication into the SecurityContext, but I would like to know if there is a better solution.

SecurityContext context = SecurityContextHolder.getContext();
Authentication authentication = new SomeKindOfAuthentication();
context.setAuthentication(authentication);

---

Affects: 1.6.6 (Dijkstra SR6)

2 votes, 6 watchers

[xaxoxavi]

I have the same issue. When I call the query method from a scheduled task.

[jamesdh]

Experiencing this with a JpaRepository interface annotated with @RepositoryRestResource that contains a single custom @Query native query. When trying to use any kind of expression in the query, this issue reproduces itself:

@RepositoryRestResource
public interface ExampleRepository extends JpaRepository<Example, UUID> {

    @Query(nativeQuery = true, value = """
           SELECT * FROM example d
           WHERE d.alternate_id = :npi
           AND d.type_source = :#{#source.name()}
           AND d.type_name = :typeName
           ORDER BY d.created_at DESC
           LIMIT 1
        """)
    Optional<Example> findFirstByCurrentMonth(Long npi, ExampleSource source, String typeName);
}

…results in:

java.lang.IllegalArgumentException: Authentication object cannot be null 

Converting source to a simple String and changing the comparator to AND d.type_source = :source allows it to pass, so it appears using SpEL in your query in any fashion causes this. However, I have a hard time believing it’s just that since I’d expect this to be a much more active issue if that were the case.