title: AuthenticationCredentialsNotFoundException: An Authentication object was not found in the SecurityContext
body: <p>I have this implementation of a login function on my server following <a href="https://stackoverflow.com/questions/13914547/gwt-spring-security-integration-pure-gwt-no-jsp">this post</a> basically:</p>
  
  <pre><code>@Transactional
  public void login(String userId, String password) {
  
      LOGGER.debug("Login for " + userId);
  
      User user = new User(userId, password, true, true, true, true, new ArrayList&lt;GrantedAuthority&gt;());
  
      Authentication auth = new UsernamePasswordAuthenticationToken(user, password,
              new ArrayList&lt;GrantedAuthority&gt;());
  
      try {
          auth = this.authenticationProvider.authenticate(auth);
      } catch(BadCredentialsException e) {
          LOGGER.debug("Bad credentials ..");
          throw new RuntimeException(e.getMessage());
      }
  
      LOGGER.debug("User successfully authenticated [userId="+userId+"]");
  
      SecurityContext sc = new SecurityContextImpl();
      sc.setAuthentication(auth);
  
      SecurityContextHolder.setContext(sc);       
  }
  </code></pre>
  
  <p>This appears to work so far without any troubles. However, if I execute this request right after login</p>
  
  <pre><code>@PreAuthorize("hasPermission('ADMIN')")
  public void test(String msg) {
      LOGGER.debug("test: " + msg);
  }
  </code></pre>
  
  <p>the result is this exception here:</p>
  
  <pre><code>Caused by: org.springframework.security.authentication.AuthenticationCredentialsNotFoundException: An Authentication object was not found in the SecurityContext
      at org.springframework.security.access.intercept.AbstractSecurityInterceptor.credentialsNotFound(AbstractSecurityInterceptor.java:378)
      at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:222)
      at org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:64)
      at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
      at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:653)
      at com.mz.server.web.service.LoginService$$EnhancerBySpringCGLIB$$caf0e62d_2.test(&lt;generated&gt;)
      at com.mz.server.web.servlet.LoginServletImpl.test(LoginServletImpl.java:99)
  </code></pre>
  
  <p>Reading about <code>SecurityContextHolder.setContext()</code> it says:</p>
  
  <blockquote>
    <p>Associates a new <code>SecurityContext</code> with the current thread of execution.</p>
  </blockquote>
  
  <p>so I guess my problem here is that I don't understand how Spring can recall a user that just logged into my system and now wants to proceed with authenticated request.</p>
  
  <p>And why am I not just getting redirected to <code>/login</code>?</p>
  
  <hr>
  
  <p><strong>Spring</strong> context:</p>
  
  <pre><code>&lt;!-- //////////////////////////////////////////////////////////////////////////////// --&gt;
  &lt;!-- // BEGIN Spring Security --&gt;
  
  &lt;sec:http auto-config="true" use-expressions="true"/&gt;
  
  &lt;bean id="httpSessionSecurityContextRepository" class='org.springframework.security.web.context.HttpSessionSecurityContextRepository'&gt;
      &lt;property name='allowSessionCreation' value='false' /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="securityContextPersistenceFilter" class="org.springframework.security.web.context.SecurityContextPersistenceFilter"&gt;
      &lt;constructor-arg ref="httpSessionSecurityContextRepository" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy"&gt;
      &lt;constructor-arg&gt;
          &lt;list&gt;
              &lt;sec:filter-chain pattern="/**" filters="securityContextPersistenceFilter" /&gt;
          &lt;/list&gt;
      &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  
  &lt;bean id="authenticationListener" class="com.mz.server.web.auth.CustomAuthenticationListener"/&gt;
  
  &lt;bean id="authenticationProvider" class="com.mz.server.web.auth.CustomAuthenticationProvider"/&gt;
  
  &lt;bean id="userDetailsService" class="com.mz.server.web.service.CustomUserDetailsService"/&gt;
  
  &lt;sec:authentication-manager alias="authenticationManager"&gt;
      &lt;sec:authentication-provider ref="authenticationProvider"/&gt;
  &lt;/sec:authentication-manager&gt;
  
  &lt;sec:global-method-security 
      authentication-manager-ref="authenticationManager"
      pre-post-annotations="enabled"/&gt;
  
  &lt;!-- // END Spring Security --&gt;
  &lt;!-- //////////////////////////////////////////////////////////////////////////////// --&gt;
  </code></pre>
  
  <p><strong>web.xml</strong></p>
  
  <pre><code>&lt;!-- //////////////////////////////////////////////////////////////////////////////// --&gt;
  &lt;!-- // BEGIN Filters --&gt;
  
  &lt;!-- Spring Security --&gt;
  
  &lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/**&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  
  &lt;!-- // END FILTERS --&gt;
  &lt;!-- //////////////////////////////////////////////////////////////////////////////// --&gt;
  </code></pre>