Authorities Extraction

[jzheaux]

There are myriad ways to represent authorities in OAuth2 that go beyond scope. We need a hook so code can transform any custom representation of roles in access tokens into Spring Security roles:

Collection<? extend GrantedAuthority> extractAuthorities(AbstractOAuth2Token token)

[rwinch]

I'd prefer to make this a bit more generic. Accepting an Authentication and returning an Authentication would be ideal. This allows for more powerful transformations. We can always provide an abstract class that supports extracting the authorities only.

[jzheaux]

Yes, I like that. Actually, I had that originally, but was a bit worried about it being too generic. I'll play with that a bit more and see what comes out.

Also, I experienced some heartburn over which Authentication to send in the case of something like JwtAccessTokenAuthenticationProvider. This works:

public Authentication authenticate(Authentication auth) {
    // ... verify JWT, etc.

    Collection<? extends GrantedAuthority> authorities =
        this.authoritiesExtractor.extractAuthorities(new JwtAuthenticationToken(jwt));

    return new JwtAuthenticationToken(jwt, authorities);
}

But the above code feels a bit icky since I end up constructing an authentication for the sole purpose of calling extractAuthorities. Not really a problem, but an indication that maybe there is another way to look at it.

[jzheaux]

Ah, I just reread your comment, and I missed that you prefer a contract that returns an Authentication as well. Will take a look.