I think I may have found a way to handle this while avoiding synchronization issues. If all of this is obvious to a non-noob, feel free to ignore me.
For all of my business logic beans dependent upon a principal-like User object, I had them implement an interface
Code:
interface UserSpecificBean {
setUser(User user);
}
Then, I created a BeanPostProcessor
Code:
class SessionAwarePostProcessor {
public SessionAwarePostProcessor(HttpSession session) {
... get the User object from the session
}
public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
if (bean instanceof UserSpecificBean) {
((UserSpecificBean)bean).setUser(user);
}
return bean;
}
}
and registered it when obtaining my WebApplicationContext
Code:
ConfigurableWebApplicationContext context =
(ConfigurableWebApplicationContext)WebApplicationContextUtils
.getRequiredWebApplicationContext(session.getServletContext());
ConfigurableBeanFactory factory =
(ConfigurableBeanFactory)context.getBeanFactory();
factory.addBeanPostProcessor(new SessionAwarePostProcessor (session));
This way, I'm injecting the User-dependency into each bean when I retrieve it instead of into the entire BeanFactory.