SEC-2841: AbstractUserDetailsAuthenticationProvider with a UserCache doesn't seem to honor mapped authorities

Gregory Gerard (Migrated from SEC-2841) said:

I needed to cache authentications from Active Directory so I created my own CachingActiveDirectoryLdapAuthenticationProvider and delegate to ActiveDirectoryLdapAuthenticationProvider for the meat.

This works just fine.

However, when I added a GrantedAuthoritiesMapper to either CachingActiveDirectoryLdapAuthenticationProvider or ActiveDirectoryLdapAuthenticationProvider or both, while the mapper would get called and the first time use of a URL worked, subsequent operations would fail. When I put a filter in to see what the authorities were, the mapped versions weren't there.

My work around was to explicitly call the mapper in retrieveUser(...). This now works.

In short when caching, the mapper doesn't seem to work with cached authentications.

Start with AbstractUserDetailsAuthenticationProvider and the ActiveDirectoryLdapAuthenticationProvider and CachingActiveDirectoryLdapAuthenticationProvider entry points, especially retrieveUser(...), to trace how mapped authorities are handled before and after caching. Done means cached authentications expose the same mapped authorities as the initial authentication, with regression coverage for the cached path.