spring-projects / spring-projects/spring-security
Consolidate GrantedAuthority List support
@jzheaux is already working on this.
Since Apr 24, 2019.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
There are a number of places in the code that need to create a List<GrantedAuthority> from a list of authority roots.
AuthorityUtils.createAuthorityList(String...) already exists.
However, there is another common use case found in UserBuilder and UserRequestPostProcessor and will likely get added in other places:
List<GrantedAuthority> authorities = new ArrayList<>(roles.length);
for (String role : roles) {
if (role.startsWith(prefix)) {
throw new IllegalArgumentException(
"Role should not start with " + prefix
+ " since this method automatically prefixes with this value. Got "
+ role);
}
else {
authorities.add(new SimpleGrantedAuthority(prefix + role));
}
}
Mainly, this is handy for specifying roles without worrying about the ROLE_ prefix:
userBuilder.roles("USER", "ADMIN")
One other place this could get added is when building an OAuth 2.0 authentication token and wanting to supply a list of scopes without worrying about the SCOPE_ prefix.
hypotheticalOAuth2TokenBuilder.scopes("read", "write")
It'd be nice if this logic were consolidated somewhere. A good place might be AuthorityUtils:
public static List<GrantedAuthority> createAuthorityList(String prefix, String... roles) {
// ... consolidated code
}
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.