Add SecurityContextHolderStrategy for Jaas

Issue gh-11060
Issue gh-11061

web/src/main/java/org/springframework/security/web/jaasapi/JaasApiIntegrationFilter.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2010-2021 the original author or authors.
+ * Copyright 2010-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,6 +31,8 @@ import org.springframework.core.log.LogMessage;
 import org.springframework.security.authentication.jaas.JaasAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.core.context.SecurityContextHolderStrategy;
+import org.springframework.util.Assert;
 import org.springframework.web.filter.GenericFilterBean;
 
 /**
@@ -51,6 +53,9 @@ import org.springframework.web.filter.GenericFilterBean;
  */
 public class JaasApiIntegrationFilter extends GenericFilterBean {
 
+	private SecurityContextHolderStrategy securityContextHolderStrategy = SecurityContextHolder
+			.getContextHolderStrategy();
+
 	private boolean createEmptySubject;
 
 	/**
@@ -113,7 +118,7 @@ public class JaasApiIntegrationFilter extends GenericFilterBean {
 	 * available.
 	 */
 	protected Subject obtainSubject(ServletRequest request) {
-		Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
+		Authentication authentication = this.securityContextHolderStrategy.getContext().getAuthentication();
 		this.logger.debug(LogMessage.format("Attempting to obtainSubject using authentication : %s", authentication));
 		if (authentication == null) {
 			return null;
@@ -143,4 +148,15 @@ public class JaasApiIntegrationFilter extends GenericFilterBean {
 		this.createEmptySubject = createEmptySubject;
 	}
 
+	/**
+	 * Sets the {@link SecurityContextHolderStrategy} to use. The default action is to use
+	 * the {@link SecurityContextHolderStrategy} stored in {@link SecurityContextHolder}.
+	 *
+	 * @since 5.8
+	 */
+	public void setSecurityContextHolderStrategy(SecurityContextHolderStrategy securityContextHolderStrategy) {
+		Assert.notNull(securityContextHolderStrategy, "securityContextHolderStrategy cannot be null");
+		this.securityContextHolderStrategy = securityContextHolderStrategy;
+	}
+
 }

web/src/test/java/org/springframework/security/web/jaasapi/JaasApiIntegrationFilterTests.java

@@ -48,8 +48,12 @@ import org.springframework.security.authentication.jaas.TestLoginModule;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.authority.AuthorityUtils;
 import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.core.context.SecurityContextHolderStrategy;
+import org.springframework.security.core.context.SecurityContextImpl;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.BDDMockito.given;
+import static org.mockito.Mockito.mock;
 
 /**
  * Tests the JaasApiIntegrationFilter.
@@ -189,6 +193,14 @@ public class JaasApiIntegrationFilterTests {
 		assertJaasSubjectEquals(new Subject());
 	}
 
+	@Test
+	public void doFilterUsesCustomSecurityContextHolderStrategy() throws Exception {
+		SecurityContextHolderStrategy strategy = mock(SecurityContextHolderStrategy.class);
+		given(strategy.getContext()).willReturn(new SecurityContextImpl(this.token));
+		this.filter.setSecurityContextHolderStrategy(strategy);
+		assertJaasSubjectEquals(this.authenticatedSubject);
+	}
+
 	private void assertJaasSubjectEquals(final Subject expectedValue) throws Exception {
 		MockFilterChain chain = new MockFilterChain() {
 			@Override