java Spring Boot @Scheduled + Spring Security @PreAuthorize = RunAs

Posted 2021-05-08

package io.mikael;

import com.google.common.collect.ImmutableList;
import org.springframework.security.authentication.AnonymousAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;

public class RunAs {

    @FunctionalInterface
    public interface RunAsMethod {
        default void run() {
            try {
                runWithException();
            } catch (Exception e) {
                // ignore
            }
        }
        void runWithException() throws Exception;
    }

    public static void runAsAdmin(final RunAsMethod func) {
        final AnonymousAuthenticationToken token = new AnonymousAuthenticationToken("system", "system",
                ImmutableList.of(new SimpleGrantedAuthority("ROLE_ADMIN")));
        final Authentication originalAuthentication = SecurityContextHolder.getContext().getAuthentication();
        SecurityContextHolder.getContext().setAuthentication(token);
        func.run();
        SecurityContextHolder.getContext().setAuthentication(originalAuthentication);
    }

}

@Service
class FooService {
    @Inject FooDao dao;
    
    @Scheduled(fixedRate = 600000L, initialDelay = 60000L)
    public void periodicalTask() throws IOException {
        RunAs.runAsAdmin(() -> {
            dao.save(new Foo(...));
        });
    }
}


@RepositoryRestResource(path = "notices")
public interface FooDao extends JpaRepository<Foo, String> {

    @Override
    @PreAuthorize("hasRole('ROLE_ADMIN')")
    <S extends Foo> S save(S entity);
    
}