java - Set Security Context within AuthenticationSuccessEvent Listener -

i working on web application uses spring security. using legacy database system, necessary write custom authenticationprovider. after successful authentication, can load info on user, e.g. roles, available domains, etc. while logic can contained within authenticationprovider, have reasons factor out external location. so, wrote listener spring security authenticationsuccessevent:

public void onapplicationevent(authenticationsuccessevent event) {     authentication auth = event.getauthentication();     user user = (user)auth.getprincipal(); //custom userdetails implementation     list<grantedauthority> newauthorities;      //do stuff user , new authorities     securitycontextholder.getcontext().setauthentication(               new usernamepasswordauthenticationtoken(user, null, newauthorities); } 

the securitycontext changed within method, seem lose new authorities afterwards. in particular, within method, securitycontext contains

usernamepasswordauthenticationtoken@70df1ce8  

at end of filter chain, message that

usernamepasswordauthenticationtoken@bbe0f021 

is being persisted securitycontextpersistencefilter.

i may able work around putting logic authenticationprovider, customizing authentication filter, or trying use authenticationsuccesshandler instead. i'd still understand why changes made in event handler aren't reflected outside of it.