Q:

Spring Security: sudden classpath and Thymeleaf related issues after modifying the filter chain

I'm trying to integrate waffle-spring-security4 with an existing Spring Boot project, where most of the configuration happens automatically. I've noticed that when the NegotiateSecurityFilter is in the chain, some weird things occur: I get ClassNotFoundException on initializing a completely trivial class with one String property; a Thymeleaf template which previously loaded fine now can't be resolved and so on. When this happened, I had the following filters in the chain:

WebAsyncManagerIntegrationFilter
SecurityContextPersistenceFilter
HeaderWriterFilter
CsrfFilter
LogoutFilter
NegotiateSecurityFilter (by Waffle)
BasicAuthenticationFilter
RequestCacheAwareFilter
SecurityContextHolderAwareRequestFilter
SessionManagementFilter
ExceptionTranslationFilter
FilterSecurityInterceptor

With switching back to a HTTP Basic authentication the issue disappears, so I think the issue might be with the filters above. Do you have any idea on how to troubleshoot this? (If you have any strategy for debugging similar issues, that would be excellent.)

A:

Yes, it was caused by Waffle, as it has turned out.
The problem was that once you've done a successful authentication with Waffle, for the rest of the run, the necessary files were not accessible. This caused everything which were trying to load something from the classpath to fail miserably. I have to add here that I've tried to run this from source with gradle bootRun and by building the jar and running that instead; in the first case, the Thymeleaf resolution failed, in the second, a Spring class was not found.
It turns out that if the remote user (who's logging in via SSO) doesn't have read access to the files, once the user it's authenticated, the application won't work normally anymore at all! I wasn't aware of this environmental change caused by Waffle, as I don't recall seeing anything about it on the docs - but it makes sense. After I gave read access to the user, it started to work.

