Q:

Spring Session scope use for user login

I'am new to spring and hibernate.I used a POJO class for maintain a sessoin data.i put scope as a session. here
@Component
@Scope("session")
public class SessionInfo {
    private int userId;
    private String loggingUser;

// getter and setter methods

}

then my controller class set as a scope="request" and methods in that controller i can pass the sessionInfo class and set/get session data.
@RequestMapping(method = RequestMethod.GET)
    public String index(Model model,SessionInfo session) {
        session.setLoggingUser("akudahewa@gmail.com");
        // set model attributes ....
        return "BusinessCategory/index";
    } 

Thats how i maintaining a session data in my application. In this way every time i need to pass the sessionInfo class in every method where needed and check is there any user in the session object, Is is way correct or not. and also cant we use intercepter for this. If not what is the best way to maintain the session data in spring.

A:

Spring security also includes a class named SecurityContextHolder. This class is a thread-safe "singleton" which allows you to access the login context for the current request. In particular, you can access the authentication principal by calling SecurityContextHolder.getContext().getAuthentication().getPrincipal().
If you are using LdapAuthenticationProvider as an authentication provider, the default instance returned by calling getPrincipal() is going to be of type LdapUserDetailsImpl. This can be customized by implementing a custom UserDetailsContextMapper and injecting it into the userDetailsContextMapper property on your LdapAuthenticationProvider instance.

