spring-projects / spring-projects/spring-security
"Regression?" in SimpleGrantedAuthority because of constructor parameter name changed
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Describe the bug
In spring-security v6.5.7, I was using following code in my table repository:
Collection<SimpleGrantedAuthority> findAllByCode(String code);
And this code was correctly looking in my table for columns code and role. Then creating a SimpleGrantedAuthority by using this constructor (extract from spring-security code) :
public SimpleGrantedAuthority(String role) {
Assert.hasText(role, "A granted authority textual representation is required");
this.role = role;
}
To Reproduce
Then I upgraded to spring-security 7.0.2. And I was getting Exception when my method findAllByCode was called :
Method threw 'org.springframework.data.core.PropertyReferenceException' exception.
org.springframework.data.core.PropertyReferenceException: No property 'authority' found for type 'MyCustomClass'
And yes MyCustomClass have properties code and role but no authority. And no I don't want to change my column to authority or my code from role to authority.
For reference, in spring security the constructor looks like :
public SimpleGrantedAuthority(String authority) {
Assert.hasText(authority, "A granted authority textual representation is required");
this.role = authority;
}
Expected behavior
Here is my workaround, I added following code in my repository class :
Collection<MyCustomClass> findAllByCode(String code);
default Collection<SimpleGrantedAuthority> findAuthoritiesByCode(String code) {
return findAllByCode(code).stream()
.map(myCustomClass -> new SimpleGrantedAuthority(myCustomClass.getRole()))
.toList();
Since role was renamed to authority, I now have to using a custom constructor to map MyCustomClass.role to the spring-security SimpleGrantedAuthority constructor
Solutions ?
One solution to avoid this "regression?" could be to revert the following commit b55c28cf25815e443c20bd0a1618506573e3a768 made by @quaff and @jzheaux on Oct 20, 2025
Of course, i am not a spring-security expert/contributor. And anyway I found a way to fix this "regression?".
Thank you @quaff, @jzheaux and all contributors for providing so much work on spring-security. Have a nice day.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing the SimpleGrantedAuthority constructor before and after commit b55c28cf25815e443c20bd0a1618506573e3a768, focusing on how its parameter name affects the repository method findAllByCode. Determine whether the compatibility behavior should be restored or another mapping approach is appropriate; the issue is done when the reported PropertyReferenceException is prevented without requiring users to rename their role property.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authorization
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100