title: spring security principal null/user not logged in on permitAll path
body: <p>I have spring-security securing some paths in my app and leaving others open for anonymous access. The problem I am running into is related to the open parts where I have left the access as "permitAll". I only want to protect certain paths from access by a non-ADMIN but I do want the admin user to be recognizable when they are in the open parts of the path.</p>
  
  <p>Thymeleaf template (partial):</p>
  
  <pre><code>&lt;p&gt;Hello Spring Boot User &lt;span th:text="${username}"/&gt;!&lt;/p&gt;
  &lt;div sec:authorize="isAnonymous()"&gt;isAnonymous&lt;/div&gt;
  &lt;div sec:authorize="isRememberMe()"&gt;isRememberMe&lt;/div&gt;
  &lt;div sec:authorize="isAuthenticated()"&gt;isAuthenticated&lt;/div&gt;
  &lt;div sec:authorize="isFullyAuthenticated()"&gt;isFullyAuthenticated&lt;/div&gt;
  </code></pre>
  
  <p><strong>NOTE:</strong> The model defines the username as:</p>
  
  <pre><code>String username = (principal != null ? principal.getName() : "ANONYMOUS");
  </code></pre>
  
  <p>Config (Java based) - there are multiple types of authentication being used</p>
  
  <pre><code>@Configuration
  public static class FormLoginConfigurationAdapter extends WebSecurityConfigurerAdapter {
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.antMatcher("/form/**").authorizeRequests().anyRequest().authenticated()
                  .and().formLogin().permitAll().loginPage("/form/login").loginProcessingUrl("/form/login")
                  .and().logout().logoutUrl("/form/logout").invalidateHttpSession(true).logoutSuccessUrl("/");
      }
  }
  
  @Order(45) // LOW
  @Configuration
  public static class BasicAuthConfigurationAdapter extends WebSecurityConfigurerAdapter {
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.antMatcher("/basic/**").authorizeRequests().anyRequest().authenticated()
                  .and().httpBasic();
      }
  }
  </code></pre>
  
  <p>There is no security config for the /open path. Just a controller. There is also a controller for the /form path. Those are both something like this (just the path varies for now):</p>
  
  <pre><code>@Controller
  @RequestMapping("/open")
  public class OpenController extends BaseController {
      @RequestMapping({"", "/"})
      public String home(HttpServletRequest req, Principal principal, Model model) {
          commonModelPopulate(req, principal, model);
          return "home"; // name of the template
      }
  }
  </code></pre>
  
  <p>If I go to this path <strong>/open</strong> (not protected) I see:</p>
  
  <pre><code>Hello Spring Boot User ANONYMOUS!
  </code></pre>
  
  <p>But if I go to this path <strong>/form</strong> (form login protected - after login) I see:</p>
  
  <pre><code>Hello Spring Boot User admin! 
  isAuthenticated 
  isFullyAuthenticated
  </code></pre>
  
  <p>So I think there might be multiple issues here. The first is that the thymeleaf sec:authorize attributes are not doing anything and the second is that it seems like I can only access the Principal and other security info if I am under a protected path.</p>
  
  <p>Is there a way to protect just one path (and sub paths) but allow the Principal and security data to be accessed everywhere else in my app?</p>