Updating SecurityContext

[Celinio Fernandes]

Hi,
I have a small question regarding the SecurityContext update.

I noticed that when I use the following lines the SecurityContext is not really (or never ???) updated :

Authentication auth = new UsernamePasswordAuthenticationToken(authUser, null, authorities);
SecurityContext sc = new SecurityContextImpl();
sc.setAuthentication(auth);
SecurityContextHolder.setContext(sc);

However, if i use the following lines, the SecurityContext is systematically updated :

Authentication auth = new UsernamePasswordAuthenticationToken(authUser, null, authorities);
SecurityContextHolder.getContext().setAuthentication(auth);

So, the line SecurityContextHolder.getContext().setAuthentication(auth); does correctly update the security context.

But aren't these two ways of doing the same thing ?
Why does the first method does not work ?

Thanks for enlightening me.

[Rishi Shehrawat]

The SecurityContextHolder is able to reterieve the context from threadlocal, which is where it is kept/stored by Spring.

http://static.springsource.org/spring-security/site/docs/3.0.x/apidocs/org/springframework/security/core/context/SecurityContextHolder.html