diff --git a/core/src/main/java/org/acegisecurity/context/rmi/ContextPropagatingRemoteInvocation.java b/core/src/main/java/org/acegisecurity/context/rmi/ContextPropagatingRemoteInvocation.java index 95132c78c2..23837b6397 100644 --- a/core/src/main/java/org/acegisecurity/context/rmi/ContextPropagatingRemoteInvocation.java +++ b/core/src/main/java/org/acegisecurity/context/rmi/ContextPropagatingRemoteInvocation.java @@ -117,15 +117,18 @@ public class ContextPropagatingRemoteInvocation extends RemoteInvocation { + securityContext); } - Object result = super.invoke(targetObject); + try { - SecurityContextHolder.setContext(new SecurityContextImpl()); + return super.invoke(targetObject); - if (logger.isDebugEnabled()) { - logger.debug( - "Set SecurityContext to new instance of SecurityContextImpl"); + } finally { + + SecurityContextHolder.setContext(new SecurityContextImpl()); + + if (logger.isDebugEnabled()) { + logger.debug( + "Set SecurityContext to new instance of SecurityContextImpl"); + } } - - return result; } } diff --git a/core/src/test/java/org/acegisecurity/context/rmi/ContextPropagatingRemoteInvocationTests.java b/core/src/test/java/org/acegisecurity/context/rmi/ContextPropagatingRemoteInvocationTests.java index 29308342c2..ffd4e359fc 100644 --- a/core/src/test/java/org/acegisecurity/context/rmi/ContextPropagatingRemoteInvocationTests.java +++ b/core/src/test/java/org/acegisecurity/context/rmi/ContextPropagatingRemoteInvocationTests.java @@ -85,6 +85,28 @@ public class ContextPropagatingRemoteInvocationTests extends TestCase { remoteInvocation.invoke(new TargetObject())); } + public void testContextIsResetEvenIfExceptionOccurs() throws Exception { + // Setup client-side context + Authentication clientSideAuthentication = new UsernamePasswordAuthenticationToken("marissa", + "koala"); + SecurityContextHolder.getContext().setAuthentication(clientSideAuthentication); + + ContextPropagatingRemoteInvocation remoteInvocation = getRemoteInvocation(); + + try { + // Set up the wrong arguments. + remoteInvocation.setArguments(new Object[] {}); + remoteInvocation.invoke(TargetObject.class.newInstance()); + fail("Expected IllegalArgumentException"); + } catch(IllegalArgumentException e) { + // expected + } + + assertNull("Authentication must be null ", SecurityContextHolder.getContext().getAuthentication()); + + } + + private ContextPropagatingRemoteInvocation getRemoteInvocation() throws Exception { Class clazz = TargetObject.class;