There are a number of places in Spring Security that issue granted authorities based on the principal, or loosely based on the principal. Here are a few:
- AuthoritiesPopulator
- GrantedAuthoritiesMapper
- AuthorityGranter
- JwtGrantedAuthoritiesConverter
- OpaqueTokenAuthenticationProvider
It would be nice to create a common abstraction that each of these could adapt to and that each authentication provider can be easily configured with:
interface GrantedAuthoritiesProvider<P> extends Converter<P, Collection<GrantedAuthority>>
This will allow for configuring each authentication provider to issue authorities dynamically and independently from the user itself, since not all authorities are direct properties of the user.