title: Spring Security - Method level security and non-authenticated invocations
body: <p>I have a vanilla Spring Boot application that consists of a controller, a service and a DAO layer.  The controller code calls the service code and so on.  </p>
  
  <p>To implement some semblance of security, I am currently using Spring Security 4.0.x's global method security annotations in combination with Spring Security ACL to lock down my service methods.  </p>
  
  <p>Requests that go through my controllers are auth-ed and authorized just fine because a principal / user is in context.  HOWEVER, I also have some additional non-user facing code that listens for messages from an AWS queue.  Within this listener code I invoke some secured services (to stay DRY and not duplicate business logic) but for this situation no user is in scope.  </p>
  
  <p>Generally speaking:</p>
  
  <ul>
  <li>For a situation like the one I'm describing, what is a good / acceptable way to authenticate user-less method invocations e.g. ones that don't come through an HTTP request (or to bypass the check)?  I am considering manually setting the SecurityContextHolder with a "system user" in my message listener code but this has some code smell.</li>
  <li>Is method level security better applied at the controller level?</li>
  </ul>