documentation: DelegatingSecurityContextExecutor is not covered by the linked article

[seanf]

What are you missing in the docs

Data Loaders (N+1) links to https://www.baeldung.com/spring-security-async-principal-propagation suggesting that it will explain how to use DelegatingSecurityContextExecutor. But the current version of the article doesn't deal with DelegatingSecurityContextExecutor at all. I couldn't find a relevant version in the wayback machine either.

Proposed text

I did find another article on dev.to which at least mentions DelegatingSecurityContextExecutor: https://dev.to/spooz/spring-security-and-threads

DelegatingSecurityContextExecutor also gets some coverage in Spring Security docs here: https://docs.spring.io/spring-security/reference/features/integrations/concurrency.html#_delegatingsecuritycontextexecutor

It would also be useful to include a code example, perhaps based on this discussion: #1477 (comment)

[seanf]

I see that the Baeldung article does mention DelegatingSecurityContextAsyncTaskExecutor. Would that work? If so, perhaps the docs should just be updated to reference DelegatingSecurityContextAsyncTaskExecutor instead of DelegatingSecurityContextExecutor.

[paulbakker]

@sjohnr any thoughts on this? Feel free to update the docs with better information if you can.

[sjohnr]

@seanf thanks for reaching out! It does indeed seem like a docs improvement could help here, specifically with a code example. I'll look at adding that using this ticket.

In the meantime, some notes of interest (that I'll use to put together the code example):

• Spring GraphQL's Security page describes using context propagation. It simply links to this page:
• The Context Propagation section mentions passing context using ThreadLocalAccessor from the Context Propagation library and gives an example of RequestAttributesAccessor. However, there is a formal implementation of this in Spring Framework: RequestAttributesThreadLocalAccessor.

Additionally, I personally added a SecurityContextHolderThreadLocalAccessor for the 6.5 release of Spring Security.

The idea there would be, if you add the context-propagation library to the classpath, the service loader mechanism and auto-configuration in Spring Boot will kick in, and you should get this for free. I think you will need to enable it (spring.reactor.context-propagation=auto) for your application, though.

Having said that, I'll need to double check that this all works in the context of Spring GraphQL and specifically DGS, as I could be wrong in my assumptions or understanding.

I see that the Baeldung article does mention DelegatingSecurityContextAsyncTaskExecutor. Would that work? If so, perhaps the docs should just be updated to reference DelegatingSecurityContextAsyncTaskExecutor instead of DelegatingSecurityContextExecutor.

I believe so, yes. There are different implementations and they all should work, but in different contexts based on which "thing" (type of Executor, etc.) you are trying to instrument with SecurityContext handling. However, if context propagation works, that will be a simpler approach, so I'll start there and see about adding a documentation example for one or both ways.