title: Spring Security 3.1 and returning anonymous UserDetails
body: <p>I'm trying to figure out how to have Spring Security return a UserDetails object for anonymous users for this call:</p>
  
  <pre><code>SecurityContextHolder.getContext().getAuthentication().getPrincipal()
  </code></pre>
  
  <p>I know that without special configuration, that call will return a string instead of a UserDetails object you create with a custom UserDetailsService implementation, but I'd rather not constantly check for "if(principal instanceof String)" everywhere.  Is there a way to do this with the Spring configuration - a way that will store the anonymous UserDetails object in the user's session context until they log in? Ostensibly, I'd like a unique anonymous UserDetails for each guest so I can track individual usage with it.</p>
  
  <p>I've also noticed that methods I have secured with the "PreAuthorize" annotation don't seem to honour the hasRole check with anonymous users. I'm sure that is a symptom of whatever I'm doing wrong. Here's an example of that:  </p>
  
  <pre><code>@RequestMapping(value = "/almanac/new", method = RequestMethod.GET)
  @PreAuthorize("hasRole('ROLE_ADMIN')")
  public String newSetup(ModelMap model) {
  </code></pre>
  
  <p>Here's my spring security context (complete except for the enclosing beans node). You can note that I tried enabling the "anonymous" </p>
  
  <pre><code>&lt;debug /&gt;
  &lt;http pattern="/js/**"  security="none" /&gt;
  &lt;http pattern="/css/**"  security="none" /&gt;
  &lt;http pattern="/images/**"  security="none" /&gt;
  &lt;http pattern="/loggedout.jsp" security="none"/&gt;
  &lt;http name="httpSiteMap" use-expressions="true"&gt;
      &lt;custom-filter ref="almanacUsrPwdAuthProcFilter" before="FORM_LOGIN_FILTER"/&gt;
      &lt;intercept-url pattern="/login*" access="isAnonymous()" /&gt;
      &lt;intercept-url pattern="/home/**" access="hasRole('ROLE_USER')" /&gt;
      &lt;intercept-url pattern="/admin/**" access="hasRole('ROLE_ADMIN')" /&gt;
      &lt;intercept-url pattern="/**" access="isAnonymous()" /&gt;
      &lt;form-login  login-page="/login.jsp"
                   default-target-url="/home.htm"
                   always-use-default-target="false" /&gt;
      &lt;logout logout-success-url="/loggedout.jsp" delete-cookies="JSESSIONID"/&gt;
      &lt;session-management invalid-session-url="/timeout.jsp"&gt;
          &lt;concurrency-control max-sessions="1" error-if-maximum-exceeded="true" /&gt;
      &lt;/session-management&gt;
      &lt;anonymous enabled="true" /&gt;
  &lt;/http&gt;
  
  &lt;global-method-security pre-post-annotations="enabled" secured-annotations="enabled" /&gt;
  
  &lt;authentication-manager alias="mainAuthMgr"&gt;
      &lt;authentication-provider ref="almanacAuthenticationProvider"/&gt;
  &lt;/authentication-manager&gt;
  </code></pre>
  
  <p>Any other suggestions based on the code you see here would be welcome.</p>