How to properly access a secured Spring Data REST Repository in a ApplicationRunner?

Tags: , ,

I followed the documentation on how to secure REST repositories with @PreAuthorize. However, the following repository

public interface RouteRepository extends SortingOnlyRepository<Route, Long> {

needs to be accessed by an ApplicationRunner to perform some initial setup tasks after application startup.

public class RouteBuilder implements ApplicationRunner {
    private final RouteRepository repository;

    public RouteBuilder(RouteRepository repository) {
        this.repository = repository;

    public void run(ApplicationArguments args) throws Exception {
                // do something

Since there’s no security context active when this runner is executed the application won’t start at all

java.lang.IllegalStateException: Failed to load ApplicationContext
Caused by: java.lang.IllegalStateException: Failed to execute ApplicationRunner
Caused by: An Authentication object was not found in the SecurityContext

What are my options to access the REST repository properly? I’m thinking of

  • Populating a fake Authentication like this
  • Decouple concerns and just don’t use a REST repository for this use case
  • Configure security in a WebSecurityConfig alone


The answer to the question is to populate a proper (fake) security context and is actually given in the official Spring Data REST + Spring Security example.

Adapted from Application:

try {
    SecurityUtils.runAs("system", "system", "ROLE_ADMIN");

                // do something
} finally {

Where SecurityUtils is

public static void runAs(String username, String password, String... roles) {
            new UsernamePasswordAuthenticationToken(username, password, AuthorityUtils.createAuthorityList(roles)));

Source: stackoverflow