title: Spring Security + custom User object attached to session for filtered requests
body: <p>I am not sure how to solve the following problem/ realize my scenario. Maybe someone can give me some hints?</p>
  
  <ol>
  <li><p>I have a Spring MVC app with Spring Security. I also use a custom Login page. All works fine so far, I can authenticate and display the logged in user on my JSP using the following code.</p>
  
  <p><code>&lt;sec:authorize ifAnyGranted="ROLE_USER"&gt;</code></p>
  
  <p><code>Logged in as &lt;sec:authentication property="principal.username" /&gt;</code></p>
  
  <p><code>&lt;/sec:authorize&gt;</code></p></li>
  <li><p>The users a re retreieved from a database right now. Code for that in XML is</p>
  
  <p><code>&lt;jdbc-user-service data-source-ref="dataSource"
              users-by-username-query="SELECT username, password , '1' AS enabled FROM users WHERE username = ?"
              authorities-by-username-query="SELECT username, 'ROLE_USER' FROM users WHERE username = ?" /&gt;</code></p></li>
  </ol>
  
  <p>All works fine. Problem is, I actually have a custom User class that I would like to use and probably keep in my session as later DB requests should filter the results according to the logged in User.id.</p>
  
  <p>How would I do this?</p>
  
  <ul>
  <li>What do I need to do to store my User object in my session? Is this the right way to do it?</li>
  <li>I use Hibernate. What is Best pratice to filter request, e.g. for objects called "Task" (in a task manager), according to the logged in user? (I have a column and property user_id in the tasks-table in my MySQL DB)</li>
  </ul>
  
  <p>Any help or hint is much appreciated. Just need some direction :-)</p>