Support AliasFor

- Wrap Method lookup in AnnotatedMethod, the same as Spring MVC does,
to better match the MethodParameter an Argument Resolver receives
- Use MergedAnnotations API to resolve aliasFor in found meta-annotation

web/src/main/java/org/springframework/security/web/method/annotation/AuthenticationPrincipalArgumentResolver.java

@@ -20,6 +20,7 @@
 
 import org.springframework.core.MethodParameter;
 import org.springframework.core.annotation.AnnotationUtils;
+import org.springframework.core.annotation.MergedAnnotations;
 import org.springframework.expression.BeanResolver;
 import org.springframework.expression.Expression;
 import org.springframework.expression.ExpressionParser;
@@ -191,7 +192,7 @@ private AuthenticationPrincipal findMethodAnnotation(MethodParameter parameter)
 		for (Annotation toSearch : annotationsToSearch) {
 			annotation = AnnotationUtils.findAnnotation(toSearch.annotationType(), this.annotationType);
 			if (annotation != null) {
-				return annotation;
+				return MergedAnnotations.from(toSearch).get(this.annotationType).synthesize();
 			}
 		}
 		return null;

web/src/test/java/org/springframework/security/web/method/annotation/AuthenticationPrincipalArgumentResolverTests.java

@@ -28,6 +28,7 @@
 
 import org.springframework.core.MethodParameter;
 import org.springframework.core.annotation.AliasFor;
+import org.springframework.core.annotation.AnnotatedMethod;
 import org.springframework.core.annotation.AnnotationConfigurationException;
 import org.springframework.expression.BeanResolver;
 import org.springframework.security.authentication.TestingAuthenticationToken;
@@ -200,7 +201,6 @@ public void resolveArgumentObject() throws Exception {
 	public void resolveArgumentCustomMetaAnnotation() throws Exception {
 		CustomUserPrincipal principal = new CustomUserPrincipal();
 		setAuthenticationPrincipal(principal);
-		this.resolver.setTemplateDefaults(new AnnotationTemplateExpressionDefaults());
 		this.expectedPrincipal = principal.id;
 		assertThat(this.resolver.resolveArgument(showUserCustomMetaAnnotation(), null, null, null))
 			.isEqualTo(this.expectedPrincipal);
@@ -217,7 +217,7 @@ public void resolveArgumentCustomMetaAnnotationTpl() throws Exception {
 	}
 
 	@Test
-	public void resolveArgumentAnnotationFromInterface() {
+	public void resolveArgumentAnnotationTemplateFromInterface() {
 		CustomUserPrincipal principal = new CustomUserPrincipal();
 		setAuthenticationPrincipal(principal);
 		this.resolver.setTemplateDefaults(new AnnotationTemplateExpressionDefaults());
@@ -227,6 +227,17 @@ public void resolveArgumentAnnotationFromInterface() {
 			.resolveArgument(getMethodParameter("username", CustomUserPrincipal.class), null, null, null));
 	}
 
+	@Test
+	public void resolveArgumentAnnotationFromInterface() {
+		CustomUserPrincipal principal = new CustomUserPrincipal();
+		setAuthenticationPrincipal(principal);
+		assertThat(this.resolver.supportsParameter(getMethodParameter("getUserByInterface", CustomUserPrincipal.class)))
+			.isTrue();
+		assertThat(this.resolver.resolveArgument(getMethodParameter("username", CustomUserPrincipal.class), null, null,
+				null))
+			.isEqualTo(this.expectedPrincipal);
+	}
+
 	private MethodParameter showUserNoAnnotation() {
 		return getMethodParameter("showUserNoAnnotation", String.class);
 	}
@@ -285,7 +296,7 @@ private MethodParameter showUserCustomMetaAnnotationTpl() {
 
 	private MethodParameter getMethodParameter(String methodName, Class<?>... paramTypes) {
 		Method method = ReflectionUtils.findMethod(TestController.class, methodName, paramTypes);
-		return new MethodParameter(method, 0);
+		return new AnnotatedMethod(method).getMethodParameters()[0];
 	}
 
 	private void setAuthenticationPrincipal(Object principal) {