spring-projects / spring-projects/spring-security

Consolidate GrantedAuthority List support

Open
#6,816 1 comment 0 reactions 1 assignee View on GitHub

@jzheaux is already working on this.

Since Apr 24, 2019.

in: core type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

There are a number of places in the code that need to create a List<GrantedAuthority> from a list of authority roots.

AuthorityUtils.createAuthorityList(String...) already exists.

However, there is another common use case found in UserBuilder and UserRequestPostProcessor and will likely get added in other places:

List<GrantedAuthority> authorities = new ArrayList<>(roles.length);
for (String role : roles) {
	if (role.startsWith(prefix)) {
		throw new IllegalArgumentException(
				"Role should not start with " + prefix
						+ " since this method automatically prefixes with this value. Got "
						+ role);
	}
	else {
		authorities.add(new SimpleGrantedAuthority(prefix + role));
	}
}

Mainly, this is handy for specifying roles without worrying about the ROLE_ prefix:

userBuilder.roles("USER", "ADMIN")

One other place this could get added is when building an OAuth 2.0 authentication token and wanting to supply a list of scopes without worrying about the SCOPE_ prefix.

hypotheticalOAuth2TokenBuilder.scopes("read", "write")

It'd be nice if this logic were consolidated somewhere. A good place might be AuthorityUtils:

public static List<GrantedAuthority> createAuthorityList(String prefix, String... roles) {
    // ... consolidated code
}

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.