Fixed issue with caching by making AbstractIntegrationFilter (and its subclasses) write the new Authentication object to the well-known location.

core/src/test/java/org/acegisecurity/adapters/HttpRequestIntegrationFilterTests.java

@@ -63,6 +63,9 @@ public class HttpRequestIntegrationFilterTests extends TestCase {
 
         PrincipalAcegiUserToken castResult = (PrincipalAcegiUserToken) result;
         assertEquals(principal, result);
+
+        filter.commitToContainer(new MockHttpServletRequest(principal, null),
+            principal);
     }
 
     public void testHandlesIfHttpRequestIsNullForSomeReason() {

core/src/test/java/org/acegisecurity/ui/AbstractIntegrationFilterTests.java

@@ -202,6 +202,11 @@ public class AbstractIntegrationFilterTests extends TestCase {
             super();
         }
 
+        public void commitToContainer(ServletRequest request,
+            Authentication authentication) {
+            this.extractFromContainerResult = authentication;
+        }
+
         public Object extractFromContainer(ServletRequest request) {
             return this.extractFromContainerResult;
         }

core/src/test/java/org/acegisecurity/ui/AutoIntegrationFilterTests.java

@@ -17,6 +17,7 @@ package net.sf.acegisecurity.ui;
 
 import junit.framework.TestCase;
 
+import net.sf.acegisecurity.Authentication;
 import net.sf.acegisecurity.GrantedAuthority;
 import net.sf.acegisecurity.GrantedAuthorityImpl;
 import net.sf.acegisecurity.MockHttpServletRequest;
@@ -68,6 +69,30 @@ public class AutoIntegrationFilterTests extends TestCase {
         junit.textui.TestRunner.run(AutoIntegrationFilterTests.class);
     }
 
+    public void testCommitForHttpSession() {
+        // This is the object we want to commit
+        PrincipalAcegiUserToken principal = new PrincipalAcegiUserToken("key",
+                "someone", "password",
+                new GrantedAuthority[] {new GrantedAuthorityImpl("SOME_ROLE")});
+
+        // Setup the mock so AutoIntegrationFilter detects HttpSessionIntegrationFilter should be used
+        MockHttpSessionIntegrationFilter mockHttpSessionIntegrationFilter = new MockHttpSessionIntegrationFilter(new PrincipalAcegiUserToken(
+                    "x", "x", "x",
+                    new GrantedAuthority[] {new GrantedAuthorityImpl("x")}));
+
+        // Setup the AutoIntegrationFilter to use our mock HttpSessionIntegrationFilter object
+        AutoIntegrationFilter filter = new MockAutoIntegrationFilterHttpSession(mockHttpSessionIntegrationFilter);
+
+        // Test we can commit the new object (this will override the principal with "x" in its properties)
+        filter.commitToContainer(new MockHttpServletRequest("ignored"),
+            principal);
+
+        // Test the object was indeed committed and overwrote the principal with "x" in its properties
+        assertEquals(principal,
+            mockHttpSessionIntegrationFilter.extractFromContainer(
+                new MockHttpServletRequest("ignored")));
+    }
+
     public void testDetectsAuthenticationObjectInHttpRequest() {
         AutoIntegrationFilter filter = new AutoIntegrationFilter();
         PrincipalAcegiUserToken principal = new PrincipalAcegiUserToken("key",
@@ -201,6 +226,11 @@ public class AutoIntegrationFilterTests extends TestCase {
             super();
         }
 
+        public void commitToContainer(ServletRequest request,
+            Authentication authentication) {
+            this.toReturn = authentication;
+        }
+
         public Object extractFromContainer(ServletRequest request) {
             return this.toReturn;
         }

core/src/test/java/org/acegisecurity/ui/webapp/HttpSessionIntegrationFilterTests.java

@@ -51,6 +51,48 @@ public class HttpSessionIntegrationFilterTests extends TestCase {
         junit.textui.TestRunner.run(HttpSessionIntegrationFilterTests.class);
     }
 
+    public void testCommitFailSilentlyIfNullsProvided() {
+        HttpSessionIntegrationFilter filter = new HttpSessionIntegrationFilter();
+        filter.commitToContainer(null, null);
+        assertTrue(true);
+    }
+
+    public void testCommitOperation() {
+        // Build an Authentication object we want returned
+        PrincipalAcegiUserToken principal = new PrincipalAcegiUserToken("key",
+                "someone", "password",
+                new GrantedAuthority[] {new GrantedAuthorityImpl("SOME_ROLE")});
+
+        // Build a mock request
+        MockHttpSession session = new MockHttpSession();
+        MockHttpServletRequest request = new MockHttpServletRequest(null,
+                session);
+
+        // Try to commit
+        HttpSessionIntegrationFilter filter = new HttpSessionIntegrationFilter();
+        filter.commitToContainer(request, principal);
+
+        // Check it committed the object
+        Object result = session.getAttribute(HttpSessionIntegrationFilter.ACEGI_SECURITY_AUTHENTICATION_KEY);
+        assertEquals(principal, result);
+    }
+
+    public void testCommitOperationGracefullyIgnoredIfSessionIsNull() {
+        PrincipalAcegiUserToken principal = new PrincipalAcegiUserToken("key",
+                "someone", "password",
+                new GrantedAuthority[] {new GrantedAuthorityImpl("SOME_ROLE")});
+
+        // Build a mock request
+        MockHttpSession session = null;
+        MockHttpServletRequest request = new MockHttpServletRequest(null,
+                session);
+
+        HttpSessionIntegrationFilter filter = new HttpSessionIntegrationFilter();
+        filter.commitToContainer(request, principal);
+
+        assertTrue(true);
+    }
+
     public void testCorrectOperation() {
         // Build a mock session containing the authenticated user
         PrincipalAcegiUserToken principal = new PrincipalAcegiUserToken("key",