Default auhorization on request header preauthenticated scenarios

Summary

Using with PreAuthenticatedGrantedAuthoritiesUserDetailsService there is a problem since "user details service" expects GrantedAuthoritiesContainer from the details attribute of the PreAuthenticatedAuthenticationToken (even when the token itself has a field holding a collection of GrantedAuthorities and implements both Authentication and CredentialsContainer interfaces).

The problem gets worse in combination with RequestHeaderAuthenticationFilter since it only attends to authentication header, and uses WebAuthenticationDetails which does not attend to any additional header.

I think i would be easy and convinient to provide a preauthenticated system supporting basic authorization out of the box.

This could be achieved easily both providing an extended RequestHeaderAuthenticationFilter, or an extended WebAuthenticationDetailsSource.

In the other hand i think UserDetailsService should not expect GrantedAuthoritiesContainer in the details but use the Collection present in the token.

Does this makes sense?

Actual Behavior

Cannot use preauthenticated scenario with authorization in the request header unless providing additional custom classes.

Expected Behavior

Simple authorization working out of the box with a standard header as the authentication does.

Start by reading RequestHeaderAuthenticationFilter, WebAuthenticationDetailsSource, PreAuthenticatedAuthenticationToken, and PreAuthenticatedGrantedAuthoritiesUserDetailsService to trace how request headers and granted authorities are handled. Clarify whether the change belongs in an extended filter, an extended details source, or the user-details service. Done should mean a preauthenticated request can obtain authorization from a standard request header without custom classes.