spring security oauth2 usage with async requests - asynchronous

Question

From what I can tell, the SpringSecurityFilter chain runs twice per request for #Async requests, because it runs on the inbound request thread, is passed to the async code which runs on a different thread, and then when it attempts to write to the response thread the SpringSecurityFilter chain runs again.
This is causing a problem near access_token expiry because I am using RemoteTokenServices, and what happens is the original request is authenticated, the service activity takes about a second, and then RemoteTokenServices is called again, at which point the access_token has expired, so the request returns a 401.
What is the recommended solution here? I have been unable to prevent the SecurityFilterChain from running the second time on the response thread. Am I doing something wrong, or is this expected behavior? I see the SecurityContext correctly passed thru to the #Async thread, but it is null in the response thread.
Is there a way to ensure the SecurityFilterChain only runs once per request? Or is the solution to accept the multiple filter calls per request and handle it with caching somehow?
I'm using spring-boot 1.3.3.RELEASE and spring-security-oauth2 2.0.9.RELEASE.
logs:
INFO [..nio-exec-1] [Caching...] loadAuthentication: 0bc97f92-9ebb-411f-9e8e-e7dc137aeffe
DEBUG [..nio-exec-1] [Caching...] Entering CachingRemoteTokenService auth: null
DEBUG [..nio-exec-1] [Audit...] AuditEvent [timestamp=Wed Mar 30 12:27:45 PDT 2016, principal=testClient, type=AUTHENTICATION_SUCCESS, data={details=remoteAddress=127.0.0.1, tokenType=BearertokenValue=<TOKEN>}]
INFO [..nio-exec-1] [Controller] Callable testing request received
DEBUG [MvcAsync1] [TaskService] taskBegin
DEBUG [MvcAsync1] [TaskService] Entering TaskService auth: org.springframework.security.oauth2.provider.OAuth2Authentication#47c78d1a: Principal: testClient; Credentials: [PROTECTED]; Authenticated: true; Details: remoteAddress=127.0.0.1, tokenType=BearertokenValue=<TOKEN>; Granted Authorities: ROLE_CLIENT
DEBUG [MvcAsync1] [TaskService] end of task
INFO [..nio-exec-2] [Caching...] loadAuthentication: 0bc97f92-9ebb-411f-9e8e-e7dc137aeffe
DEBUG [..nio-exec-2] [Caching...] Entering CachingRemoteTokenService auth: null
DEBUG [..nio-exec-2] [RemoteTokenServices] check_token returned error: invalid_token
DEBUG [..nio-exec-2] [Audit...] AuditEvent [timestamp=Wed Mar 30 12:27:47 PDT 2016, principal=access-token, type=AUTHENTICATION_FAILURE, data={type=org.springframework.security.authentication.BadCredentialsException, message=0bc97f92-9ebb-411f-9e8e-e7dc137aeffe}]
relevant code:
controller:
#RequestMapping(value = "/callable",
method = RequestMethod.GET,
produces = { MediaType.APPLICATION_JSON_VALUE })
public #ApiResponseObject Callable<ApiResponse> runCallable(HttpServletRequest httpServletRequest)
throws InterruptedException {
log.info(String.format("Callable testing request received"));
Callable<ApiResponse> rv = taskService::execute;
return rv;
}
async service:
#Override
public ApiResponse execute() {
log.debug("taskBegin");
Authentication auth = SecurityContextHolder.getContext().getAuthentication();
log.debug("Entering TaskService auth: " + auth);
try {
Thread.sleep(1000);
} catch (InterruptedException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
ApiResponse rv = new ApiResponse();
rv.setStatus(HttpStatus.OK.value());
log.debug("end of task");
return rv;
}
RemoteTokenServices implementation (note caching is commented out):
public class CachingRemoteTokenService extends RemoteTokenServices {
private static Log log = LogFactory.getLog(CachingRemoteTokenService.class);
#Override
//#Cacheable(cacheNames="tokens", key="#root.methodName + #accessToken")
public OAuth2Authentication loadAuthentication(String accessToken)
throws org.springframework.security.core.AuthenticationException,
InvalidTokenException {
log.info("loadAuthentication: " + accessToken);
Authentication auth = SecurityContextHolder.getContext().getAuthentication();
log.debug("Entering CachingRemoteTokenService auth: " + auth);
return super.loadAuthentication(accessToken);
}
#Override
//#Cacheable(cacheNames="tokens", key="#root.methodName + #accessToken")
public OAuth2AccessToken readAccessToken(String accessToken) {
log.info("readAccessToken: " + accessToken);
Authentication auth = SecurityContextHolder.getContext().getAuthentication();
log.debug("Entering CachingRemoteTokenService auth: " + auth);
return super.readAccessToken(accessToken);
}
}
and finally my security config:
#Configuration
public class Oauth2ResourceConfig {
private static Log log = LogFactory.getLog(Oauth2ResourceConfig.class);
#Value("${client.secret}")
private String clientSecret;
#Value("${check.token.endpoint}")
private String checkTokenEndpoint;
#Bean
#Lazy
public ResourceServerTokenServices tokenService() {
CachingRemoteTokenService tokenServices = new CachingRemoteTokenService();
tokenServices.setClientId("test-service");
tokenServices.setClientSecret(clientSecret);
tokenServices.setCheckTokenEndpointUrl(checkTokenEndpoint);
return tokenServices;
}
#Configuration
#EnableResourceServer
protected static class ResourceServerConfig extends ResourceServerConfigurerAdapter {
#Override
public void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.antMatchers("/health-check").permitAll()
.antMatchers("/**").access("#oauth2.isClient() and #oauth2.hasScope('trust')");
#Override
public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
resources.resourceId("test-service");
}
}
}

Answer 1

got an answer here: https://github.com/spring-projects/spring-security-oauth/issues/736
apparently the fix is to configure security.filter-dispatcher-types=REQUEST, ERROR