spring-projects / spring-projects/spring-security

Provide mechanism to map UserDetails to GrantedAuthority

Open
#13,651 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

If spring-security support such extension:

@FunctionalInterface
public interface UserAuthorityMapper {

	Collection<? extends GrantedAuthority> mapAuthorities(UserDetails user);

}

@FunctionalInterface
public interface UserRoleMapper extends UserAuthorityMapper {

	Collection<String> mapRoles(UserDetails user);

	@Override
	default Collection<? extends GrantedAuthority> mapAuthorities(UserDetails user) {
		return mapRoles(user).stream().map(SimpleGrantedAuthority::new).collect(Collectors.toList());
	}

}

and have a built-in implementation:

@Component
public class UsernameAndTypeRoleMapper implements UserRoleMapper {

	@Override
	public Collection<String> mapRoles(UserDetails user) {
		return List.of(mapUsername(user), mapUserType(user));
	}

	protected String mapUsername(UserDetails user) {
		return "USERNAME(" + user.getUsername() + ")";
	}

	protected String mapUserType(UserDetails user) {
		Class<?> c = ReflectionUtils.getEntityClass(user);
		String name = c.getSimpleName();
		if (!StringUtils.hasLength(name)) {
			name = c.getSuperclass().getSimpleName();
		}
		return name.toUpperCase();
	}

}

Then every user will have an unique username role and type role, take User admin = new User("admin") for example, role USERNAME(admin) and USER will be added to its authorities.

I would like to submit a PR if the team decide to accept this feature request.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Review the proposed UserAuthorityMapper, UserRoleMapper, and UsernameAndTypeRoleMapper interfaces in the issue, then trace how Spring Security currently maps UserDetails to GrantedAuthority. No repository files or tests are identified, so first locate the relevant authority-mapping entry points and existing tests; done means an accepted design and verified username and user-type authorities without changing the requested behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
authorization, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.