SEC-1492: Added GrantedAuthoritiesMapper to provide mapping of loaded authorities to those which are eventually stored in the user Authentication object.

core/src/main/java/org/springframework/security/authentication/dao/AbstractUserDetailsAuthenticationProvider.java

@@ -28,6 +28,8 @@ import org.springframework.security.authentication.UsernamePasswordAuthenticatio
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.SpringSecurityMessageSource;
+import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper;
+import org.springframework.security.core.authority.mapping.NullAuthoritiesMapper;
 import org.springframework.security.core.userdetails.UserCache;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UserDetailsChecker;
@@ -84,6 +86,7 @@ public abstract class AbstractUserDetailsAuthenticationProvider implements Authe
     protected boolean hideUserNotFoundExceptions = true;
     private UserDetailsChecker preAuthenticationChecks = new DefaultPreAuthenticationChecks();
     private UserDetailsChecker postAuthenticationChecks = new DefaultPostAuthenticationChecks();
+    private GrantedAuthoritiesMapper authoritiesMapper = new NullAuthoritiesMapper();
 
     //~ Methods ========================================================================================================
 
@@ -191,7 +194,7 @@ public abstract class AbstractUserDetailsAuthenticationProvider implements Authe
         // Also ensure we return the original getDetails(), so that future
         // authentication events after cache expiry contain the details
         UsernamePasswordAuthenticationToken result = new UsernamePasswordAuthenticationToken(principal,
-                authentication.getCredentials(), user.getAuthorities());
+                authentication.getCredentials(), authoritiesMapper.mapAuthorities(user.getAuthorities()));
         result.setDetails(authentication.getDetails());
 
         return result;
@@ -295,6 +298,10 @@ public abstract class AbstractUserDetailsAuthenticationProvider implements Authe
         this.postAuthenticationChecks = postAuthenticationChecks;
     }
 
+    public void setAuthoritiesMapper(GrantedAuthoritiesMapper authoritiesMapper) {
+        this.authoritiesMapper = authoritiesMapper;
+    }
+
     private class DefaultPreAuthenticationChecks implements UserDetailsChecker {
         public void check(UserDetails user) {
             if (!user.isAccountNonLocked()) {

core/src/main/java/org/springframework/security/core/authority/mapping/GrantedAuthoritiesMapper.java

@@ -0,0 +1,15 @@
+package org.springframework.security.core.authority.mapping;
+
+import org.springframework.security.core.GrantedAuthority;
+
+import java.util.*;
+
+/**
+ * Mapping interface which can be injected into the authentication layer to convert the
+ * authorities loaded from storage into those which will be used in the {@code Authentication} object.
+ *
+ * @author Luke Taylor
+ */
+public interface GrantedAuthoritiesMapper {
+    Collection<? extends GrantedAuthority> mapAuthorities(Collection<? extends GrantedAuthority> authorities);
+}

core/src/main/java/org/springframework/security/core/authority/mapping/NullAuthoritiesMapper.java

@@ -0,0 +1,14 @@
+package org.springframework.security.core.authority.mapping;
+
+import org.springframework.security.core.GrantedAuthority;
+
+import java.util.*;
+
+/**
+ * @author Luke Taylor
+ */
+public class NullAuthoritiesMapper implements GrantedAuthoritiesMapper {
+    public Collection<? extends GrantedAuthority> mapAuthorities(Collection<? extends GrantedAuthority> authorities) {
+        return authorities;
+    }
+}