SEC-1231: Authentication.getAuthorities should be of type Collection<GrantedAuthority> and not List<GrantedAuthority>. Refactored the interface and related classes to match (UserDetails etc).

web/src/main/java/org/springframework/security/web/authentication/preauth/PreAuthenticatedAuthenticationToken.java

@@ -1,7 +1,6 @@
 package org.springframework.security.web.authentication.preauth;
 
-import java.util.Arrays;
-import java.util.List;
+import java.util.Collection;
 
 import org.springframework.security.authentication.AbstractAuthenticationToken;
 import org.springframework.security.core.GrantedAuthority;
@@ -39,13 +38,6 @@ public class PreAuthenticatedAuthenticationToken extends AbstractAuthenticationT
         this.credentials = aCredentials;
     }
 
-    /**
-     *
-     * @deprecated
-     */
-    public PreAuthenticatedAuthenticationToken(Object aPrincipal, Object aCredentials, GrantedAuthority[] anAuthorities) {
-        this(aPrincipal, aCredentials, Arrays.asList(anAuthorities));
-    }
 
     /**
      * Constructor used for an authentication response. The {@link
@@ -57,7 +49,7 @@ public class PreAuthenticatedAuthenticationToken extends AbstractAuthenticationT
      * @param anAuthorities
      *            The granted authorities
      */
-    public PreAuthenticatedAuthenticationToken(Object aPrincipal, Object aCredentials, List<GrantedAuthority> anAuthorities) {
+    public PreAuthenticatedAuthenticationToken(Object aPrincipal, Object aCredentials, Collection<GrantedAuthority> anAuthorities) {
         super(anAuthorities);
         this.principal = aPrincipal;
         this.credentials = aCredentials;

web/src/main/java/org/springframework/security/web/authentication/switchuser/SwitchUserAuthorityChanger.java

@@ -1,6 +1,6 @@
 package org.springframework.security.web.authentication.switchuser;
 
-import java.util.List;
+import java.util.Collection;
 
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
@@ -28,5 +28,5 @@ public interface SwitchUserAuthorityChanger {
      *
      * @return the modified list of granted authorities.
      */
-    List<GrantedAuthority> modifyGrantedAuthorities(UserDetails targetUser, Authentication currentAuthentication, List<GrantedAuthority> authoritiesToBeGranted);
+    Collection<GrantedAuthority> modifyGrantedAuthorities(UserDetails targetUser, Authentication currentAuthentication, Collection<GrantedAuthority> authoritiesToBeGranted);
 }

web/src/main/java/org/springframework/security/web/authentication/switchuser/SwitchUserProcessingFilter.java

@@ -17,6 +17,7 @@ package org.springframework.security.web.authentication.switchuser;
 
 import java.io.IOException;
 import java.util.ArrayList;
+import java.util.Collection;
 import java.util.List;
 
 import javax.servlet.FilterChain;
@@ -290,7 +291,7 @@ public class SwitchUserProcessingFilter extends GenericFilterBean implements App
         GrantedAuthority switchAuthority = new SwitchUserGrantedAuthority(ROLE_PREVIOUS_ADMINISTRATOR, currentAuth);
 
         // get the original authorities
-        List<GrantedAuthority> orig = targetUser.getAuthorities();
+        Collection<GrantedAuthority> orig = targetUser.getAuthorities();
 
         // Allow subclasses to change the authorities to be granted
         if (switchUserAuthorityChanger != null) {
@@ -323,7 +324,7 @@ public class SwitchUserProcessingFilter extends GenericFilterBean implements App
         Authentication original = null;
 
         // iterate over granted authorities and find the 'switch user' authority
-        List<GrantedAuthority> authorities = current.getAuthorities();
+        Collection<GrantedAuthority> authorities = current.getAuthorities();
 
         for (GrantedAuthority auth : authorities) {
             // check for switch user type of authority

web/src/main/java/org/springframework/security/web/servletapi/SecurityContextHolderAwareRequestWrapper.java

@@ -17,7 +17,7 @@ package org.springframework.security.web.servletapi;
 
 
 import java.security.Principal;
-import java.util.List;
+import java.util.Collection;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletRequestWrapper;
@@ -128,7 +128,7 @@ public class SecurityContextHolderAwareRequestWrapper extends HttpServletRequest
             return false;
         }
 
-        List<GrantedAuthority> authorities = auth.getAuthorities();
+        Collection<GrantedAuthority> authorities = auth.getAuthorities();
 
         if (authorities == null) {
             return false;

web/src/test/java/org/springframework/security/web/authentication/AnonymousProcessingFilterTests.java

@@ -33,6 +33,7 @@ import org.springframework.mock.web.MockHttpServletResponse;
 import org.springframework.security.authentication.TestingAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.AuthorityUtils;
 import org.springframework.security.core.authority.GrantedAuthorityImpl;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.core.userdetails.memory.UserAttribute;
@@ -45,15 +46,6 @@ import org.springframework.security.core.userdetails.memory.UserAttribute;
  * @version $Id$
  */
 public class AnonymousProcessingFilterTests extends TestCase {
-    //~ Constructors ===================================================================================================
-
-    public AnonymousProcessingFilterTests() {
-        super();
-    }
-
-    public AnonymousProcessingFilterTests(String arg0) {
-        super(arg0);
-    }
 
     //~ Methods ========================================================================================================
 
@@ -164,7 +156,7 @@ public class AnonymousProcessingFilterTests extends TestCase {
 
         Authentication auth = SecurityContextHolder.getContext().getAuthentication();
         assertEquals("anonymousUsername", auth.getPrincipal());
-        assertEquals(new GrantedAuthorityImpl("ROLE_ANONYMOUS"), auth.getAuthorities().get(0));
+        assertTrue(AuthorityUtils.authorityListToSet(auth.getAuthorities()).contains("ROLE_ANONYMOUS"));
         SecurityContextHolder.getContext().setAuthentication(null); // so anonymous fires again
 
         // Now test operation if we have removeAfterRequest = true

web/src/test/java/org/springframework/security/web/authentication/preauth/PreAuthenticatedAuthenticationTokenTests.java

@@ -1,5 +1,6 @@
 package org.springframework.security.web.authentication.preauth;
 
+import java.util.Collection;
 import java.util.List;
 
 import junit.framework.TestCase;
@@ -47,7 +48,7 @@ public class PreAuthenticatedAuthenticationTokenTests extends TestCase {
         assertEquals(credentials, token.getCredentials());
         assertNull(token.getDetails());
         assertNotNull(token.getAuthorities());
-        List<GrantedAuthority> resultColl = token.getAuthorities();
+        Collection<GrantedAuthority> resultColl = token.getAuthorities();
         assertTrue("GrantedAuthority collections do not match; result: " + resultColl + ", expected: " + gas,
                 gas.containsAll(resultColl) && resultColl.containsAll(gas));
 

web/src/test/java/org/springframework/security/web/authentication/switchuser/SwitchUserProcessingFilterTests.java

@@ -19,6 +19,7 @@ import static org.junit.Assert.*;
 import static org.mockito.Mockito.*;
 
 import java.util.ArrayList;
+import java.util.Collection;
 import java.util.List;
 
 import javax.servlet.FilterChain;
@@ -368,7 +369,7 @@ public class SwitchUserProcessingFilterTests {
         SwitchUserProcessingFilter filter = new SwitchUserProcessingFilter();
         filter.setUserDetailsService(new MockUserDetailsService());
         filter.setSwitchUserAuthorityChanger(new SwitchUserAuthorityChanger() {
-            public List<GrantedAuthority> modifyGrantedAuthorities(UserDetails targetUser, Authentication currentAuthentication, List<GrantedAuthority> authoritiesToBeGranted) {
+            public Collection<GrantedAuthority> modifyGrantedAuthorities(UserDetails targetUser, Authentication currentAuthentication, Collection<GrantedAuthority> authoritiesToBeGranted) {
                 List <GrantedAuthority>auths = new ArrayList<GrantedAuthority>();
                 auths.add(new GrantedAuthorityImpl("ROLE_NEW"));
                 return auths;
@@ -378,7 +379,7 @@ public class SwitchUserProcessingFilterTests {
         Authentication result = filter.attemptSwitchUser(request);
         assertTrue(result != null);
         assertEquals(2, result.getAuthorities().size());
-        assertEquals("ROLE_NEW", result.getAuthorities().get(0).getAuthority());
+        assertTrue(AuthorityUtils.authorityListToSet(result.getAuthorities()).contains("ROLE_NEW"));
     }