spring security oauth2 + switch user filter -

i set switchuserfilter in spring-boot app implements spring-security-oauth2 yet. i've set filter in websecurityconfiguration extends websecurityconfigureradapter.

after login obtain token, bearer token, , use configured endpoint switch user.

i follow code debug in ide , apparently securitycontextholder updated , new target user injected.

however, when request redirected target url (a property of filter), securitycontextholder gives me old user , not i've requested.

i've inspected oauth2authenticationprocessingfilter , token extracted request return same bearer token , builds user detail , inject securitycontextholder.

is there way use kind of filter oauth2 approach?

the problem need create new token contains new target user information. new token has sent client, future requests new target user token used. in our case token persisted on server side (using jdbctokenstore), work in server-side stateless environments (jwt-token).

our environment spring-boot/jhipster application angular 1.2 client.

creating new token:

@inject private userdetailsservice userdetailsservice;  @inject private authorizationservertokenservices tokenservice;  @inject private clientdetailsservice clientdetailsservice;      public oauth2accesstoken createimpersonationaccesstoken(string login) {        userdetails userdetails = userdetailsservice.loaduserbyusername(login);        log.info("switching current user {}", login);         collection<? extends grantedauthority> authorities = userdetails.getauthorities();        list<grantedauthority> impersonationauthorities = new arraylist<>(authorities);        authentication source = securitycontextholder.getcontext().getauthentication();        // add current user authentication (to switch impersonation):        switchusergrantedauthority switchuserauthority =                 new switchusergrantedauthority(authoritiesconstants.impersonation, source);        impersonationauthorities.add(switchuserauthority);                    userdetails newuserdetails =                 org.springframework.security.core.userdetails.user                .withusername(login)                .authorities(impersonationauthorities)                .password("justinventedhere")                .build();                            authentication userpasswordauthentiation =                 new usernamepasswordauthenticationtoken(newuserdetails, null, impersonationauthorities);         map<string, string> parameters = new hashmap<>();                clientdetails client = clientdetailsservice.loadclientbyclientid(clientid);                    oauth2request oauthrequest = new oauth2request(parameters, client.getclientid(), client.getauthorities(), true,                 client.getscope(), client.getresourceids(), null, null, null);        oauth2authentication authentication = new oauth2authentication(oauthrequest, userpasswordauthentiation);        oauth2accesstoken createaccesstoken = tokenservice.createaccesstoken(authentication);                    return createaccesstoken;    } 

this new token returned client (in our case angular 1.2 application) stores token in local storage (to used on next requests). application needs reloading (simplest way update target user):

vm.switchtoclient = function (client) {     vm.switchinguser = true;     userservice.switchtoclient(client, function(response) {                 var expiredat = new date();                 $localstorage.authenticationtoken = response;                 window.location.href='#/';                 window.location.reload()             }); }