title: Spring Security 4 @AuthenticationPrincipal empty with core.annotation.AuthenticationPrincipal but not web.bind.annotation.AuthenticationPrincipal
body: <p>I just recently upgraded from Spring Security 3 to 4 and my <code>@AuthenticationPrincipal</code> annotated input arguments in controllers are now empty. I managed to work around it by using the deprecated <code>org.springframework.security.web.bind.annotation.AuthenticationPrincipal</code>, but when using the one from the <code>org.springframework.security.core.annotation</code> package it is empty.</p>
  
  <p>It'll also work if I do:<br>
      <code>User activeUser = (User) ((Authentication) principal).getPrincipal();</code></p>
  
  <p>I followed the migration guide as best as I could.</p>
  
  <p>Here's my <code>spring-security.xml</code>:</p>
  
  <pre><code>&lt;beans:beans xmlns="http://www.springframework.org/schema/security"
  xmlns:beans="http://www.springframework.org/schema/beans"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="
      http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
      http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-4.0.xsd"&gt;
  
  &lt;!-- enable use-expressions --&gt;
  &lt;http auto-config="false" use-expressions="true"&gt;
      &lt;intercept-url pattern="/secure/admin**" access="hasAnyRole('ROLE_ADMIN', 'ROLE_SUPER_ADMIN')" /&gt;
      &lt;intercept-url pattern="/secure/admin/**" access="hasAnyRole('ROLE_ADMIN', 'ROLE_SUPER_ADMIN')" /&gt;
      &lt;intercept-url pattern="/secure/user**" access="isAuthenticated()" /&gt;
      &lt;intercept-url pattern="/secure/user/**" access="isAuthenticated()" /&gt;
      &lt;intercept-url pattern="/**" access="permitAll" /&gt;
  
      &lt;form-login login-page="/login"
          authentication-success-handler-ref="redirectRoleStrategy"
          authentication-failure-url="/login?error"
          username-parameter="username"
          password-parameter="password"
          login-processing-url="/auth/login_check" /&gt;
  
      &lt;logout logout-success-url="/login?logout" delete-cookies="JSESSIONID" /&gt;
      &lt;csrf disabled="true" /&gt;
  &lt;/http&gt;
  
  &lt;beans:bean id='userDetailsService' class='com.myproject.security.UserDetailsServiceImpl' /&gt;
  
  &lt;beans:bean id="authenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider"&gt;
      &lt;beans:property name="userDetailsService" ref="userDetailsService"/&gt;
  &lt;/beans:bean&gt;
  
  &lt;beans:bean id='authenticationManager' class='org.springframework.security.authentication.ProviderManager'&gt;
      &lt;beans:constructor-arg&gt;
          &lt;beans:list&gt;
              &lt;beans:ref bean='authenticationProvider' /&gt;
          &lt;/beans:list&gt;
      &lt;/beans:constructor-arg&gt;
  &lt;/beans:bean&gt;
  
  &lt;!-- Select users and user_roles from database --&gt;
  &lt;authentication-manager&gt;
      &lt;authentication-provider user-service-ref='userDetailsService'&gt;
          &lt;password-encoder ref="encoder" /&gt;
      &lt;/authentication-provider&gt;
  &lt;/authentication-manager&gt;
  
  &lt;beans:bean id="encoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"&gt;
      &lt;beans:constructor-arg name="strength" value="10" /&gt;
  &lt;/beans:bean&gt;
  
  &lt;beans:bean id="redirectRoleStrategy" class="com.myproject.security.RoleBasedAuthenticationSuccessHandler"&gt;
      &lt;beans:property name="roleUrlMap"&gt;
          &lt;beans:map&gt;
              &lt;beans:entry key="ROLE_ADMIN" value="/secure/admin"/&gt;
              &lt;beans:entry key="ROLE_SUPER_ADMIN" value="/secure/admin"/&gt;
          &lt;/beans:map&gt;
      &lt;/beans:property&gt;
  &lt;/beans:bean&gt;
  </code></pre>
  
  <p></p>