Returns the name of the authenticated principle instead of falling through to the toString() method which may render a string representation of the entire object rather than a username.

Author: sjrd218

web/src/main/java/org/springframework/security/web/servletapi/SecurityContextHolderAwareRequestWrapper.java

@@ -24,6 +24,7 @@
 
 import org.springframework.security.authentication.AuthenticationTrustResolver;
 import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
+import org.springframework.security.core.AuthenticatedPrincipal;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.context.SecurityContextHolder;
@@ -106,6 +107,9 @@ public String getRemoteUser() {
 		if (auth.getPrincipal() instanceof UserDetails) {
 			return ((UserDetails) auth.getPrincipal()).getUsername();
 		}
+		if (auth.getPrincipal() instanceof AuthenticatedPrincipal) {
+			return ((AuthenticatedPrincipal) auth.getPrincipal()).getName();
+		}
 		return auth.getPrincipal().toString();
 	}
 

web/src/test/java/org/springframework/security/web/servletapi/SecurityContextHolderAwareRequestWrapperTests.java

@@ -21,12 +21,17 @@
 
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.security.authentication.TestingAuthenticationToken;
+import org.springframework.security.core.AuthenticatedPrincipal;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.authority.AuthorityUtils;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.core.userdetails.User;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.BDDMockito.given;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
 
 /**
  * Tests {@link SecurityContextHolderAwareRequestWrapper}.
@@ -130,4 +135,18 @@ public void testRolePrefixNotAppliedIfRoleStartsWith() {
 		assertThat(wrapper.isUserInRole("ROLE_FOOBAR")).isTrue();
 	}
 
+	@Test
+	public void testGetRemoteUserStringWithAuthenticatedPrinciple() {
+		String username = "authPrincipleUsername";
+		AuthenticatedPrincipal principal = mock(AuthenticatedPrincipal.class);
+		given(principal.getName()).willReturn(username);
+		Authentication auth = new TestingAuthenticationToken(principal, "user");
+		SecurityContextHolder.getContext().setAuthentication(auth);
+		MockHttpServletRequest request = new MockHttpServletRequest();
+		request.setRequestURI("/");
+		SecurityContextHolderAwareRequestWrapper wrapper = new SecurityContextHolderAwareRequestWrapper(request, "");
+		assertThat(wrapper.getRemoteUser()).isEqualTo(username);
+		verify(principal, times(1)).getName();
+	}
+
 }