java - Best practices handling authentication data in a Spring web application -

i know question answered in subjective way, i'd know if there best practice handle authenticated user data in spring web application.

i mean: need retrieve user id authenticated user in several classes of service layer of application.

at moment i'm getting principal object autowired in controller methods:

@requestmapping("/some/path", method = requestmethod.get) public string getbyid(@requestparam integer id, principal principal){ ... } 

and pass principal.getname() in every method invocation, example:

// service class method public void dosomething(integer id, string username){      // retrieve user username app db } 

i know call:

authentication auth = securitycontextholder.getcontext().getauthentication(); 

in service layer current authenticated user, i'm wondering if bad design application.

what's common way handle authentication data? should retrieve need or should pass "through levels" of application?

you can add post authentication handler

1. login security xml

	  <form-login login-page="/login.jsp"      			authentication-success-handler-ref="authenticationsuccesshandler"      			authentication-failure-url="/login.jsp?error=true" />      		<logout logout-success-url="/login.jsp" />    		      	</http>      	<beans:bean id="authenticationsuccesshandler" class="com.login.authenticationsuccesshandler">      		<beans:property name="defaulttargeturl" value="/dashboard" />      	</beans:bean>

2. java class

        package com.login;          import java.io.ioexception;          import javax.servlet.servletexception;          import javax.servlet.http.httpservletrequest;          import javax.servlet.http.httpservletresponse;          import javax.servlet.http.httpsession;                    import org.springframework.beans.factory.annotation.autowired;          import org.springframework.security.core.authentication;          import org.springframework.security.core.context.securitycontextholder;          import org.springframework.security.web.authentication.savedrequestawareauthenticationsuccesshandler;                    import com.commonfunction.commonfunction;                    public class authenticationsuccesshandler extends          savedrequestawareauthenticationsuccesshandler {          	@autowired           	commonfunction commonfunction;          	/**          	 * override method set session after           	 * authentication          	 * prince 5/5/16          	 */          	@override          	public void onauthenticationsuccess(httpservletrequest request,          			httpservletresponse response, authentication authentication)          					throws ioexception, servletexception {          		super.onauthenticationsuccess(request, response, authentication);          		httpsession session = request.getsession(true);                    		try {          			authentication auth=securitycontextholder.getcontext().getauthentication();          			loginbean login=(loginbean)auth.getprincipal();          			session.setattribute("vendorid",login.getvendorid());          			session.setattribute("loginid",login.getusername());          			session.setattribute("username",login.getvendorname());          			session.setattribute("vendortype",login.getvendortype());          			session.setattribute("navigationlist",commonfunction.getnavigationcontent(request));          			          			system.out.println("successfully authenticate:"+login.getvendorid());          		} catch (exception e) {          			logger.error("error in getting user()", e);          			e.printstacktrace();          		}           	}                    }