title: Spring @PreAuthorize passes null to Service
body: <p>I have an issue with <strong>@PreAuthorize</strong> and a sevice that checks if the athenticated user may access the searched item. </p>
  
  <p>The one service <em>callDistributionRequest</em> that gets the item is working fine - <strong>@PreAuthorize</strong> recieves and passes the right <em>distId</em>. The other one <em>updateDistributionRequestExportFileName</em> gets also the right <em>distId</em> and passes it to the <em>distributionRequestService</em>. On the method <em>userBelongsToRecipientOfTheDistributionRequest</em> distId comes as a <strong>null</strong></p>
  
  <p>The Spring RestController with the two web services</p>
  
  <pre><code>@RestController
  @RequestMapping(produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
  public class DistributionRequestRESTController {
  
      @Autowired
      private @Getter @Setter DistributionRequestService distributionRequestService;
  
      private final Logger log = LoggerFactory.getLogger(this.getClass());
      private String logResponse = " - response: ";
  
      @Autowired
      public DistributionRequestRESTController(DistributionRequestService distributionRequestService) {
          this.distributionRequestService = distributionRequestService;
      }
  
      @RequestMapping(value = Consts.URLDISTRIBUTIONREQUEST + Consts.URLDISTREQID)
      public DistributionRequest callDistributionRequest(@PathVariable long distId) {
  
          String loginfo = "get distribution with id: " + distId;
          //log.info(loginfo);
  
          DistributionRequest found = distributionRequestService.findOne(distId);
  
          log.info(loginfo + logResponse + JSONParser.toJsonString(found));
  
          return found;
      }
  
      @RequestMapping(method = RequestMethod.POST, value = Consts.URLDISTRIBUTIONREQUEST + Consts.URLDISTREQID + Consts.URLUPDATE + Consts.URLFILENAME)
      public DistributionRequest updateDistributionRequestExportFileName(
              @PathVariable long distId,
              @RequestBody String fileName,
              @AuthenticationPrincipal UserDetails user) {
  
          String loginfo = user.getUsername() + " try to update filename with : " + fileName;
          //log.info(loginfo);
  
          DistributionRequest updated =
                  distributionRequestService.updateExportFilename(distId, fileName);
  
          log.info(loginfo + logResponse + JSONParser.toJsonString(updated));
  
          return updated;
      }
  
  }
  </code></pre>
  
  <p>The Service interface:</p>
  
  <pre><code>public interface DistributionRequestService {
  
      @PreAuthorize(value = "hasAnyAuthority('USER', 'ADMIN') and @distributionRequestOwnerService.userBelongsToRecipientOfTheDistributionRequest(#distId)")
      DistributionRequest findOne(Long distId);
  
      @PreAuthorize(value = "hasAnyAuthority('USER', 'ADMIN') and @distributionRequestOwnerService.userBelongsToRecipientOfTheDistributionRequest(#distId)")
      DistributionRequest updateExportFilename(Long distId, String filename);
  }
  </code></pre>
  
  <p>And the class that checks if the user may access the searched item</p>
  
  <pre><code>@Service(value = "distributionRequestOwnerService")
  public class DistributionRequestOwnerServiceImpl implements DistributionRequestOwnerService {
  
      @Autowired
      private AccountService accountService;
  
      @Autowired
      private DistributionRequestsRepository distributionRequestsRepository;
  
      @Override
      public boolean userBelongsToRecipientOfTheDistributionRequest(Long distId) {
          return userBelongsToRecipientOfTheDistributionRequest(distId, null);
      }
  
      @Override
      public boolean userBelongsToRecipientOfTheDistributionRequest(Long distributionRequestId, String username) {
          DistributionRequest distributionRequest = distributionRequestsRepository.findOne(distributionRequestId);
  
          ServiceAccount currentUser;
          if (username == null)
              currentUser = accountService.getCurrentUser();
          else
              currentUser = accountService.findByUsername(username);
  
          if (distributionRequest != null
                  &amp;&amp; distributionRequest.getRecipientId() == currentUser.getRecipientId())
              return true;
  
          throw new AercacheWSException(Consts.EXCEPTIONMISSINGELEMENTORPERMITION);
      }
  
  }
  </code></pre>
  
  <p>Any ideas?</p>
  
  <p>thanks in advance</p>