Principal not showing Authorities after implementing AuthoritiesExtractor - spring-security

Question

I am extending AuthoritiesExtractor. In my implementation I am adding a new authority called "MYROLE". I have created a bean (#Bean) as shown below in SecurityConfig.java to initialize this extractor as shown below.
#Configuration
#EnableOAuth2Sso
public class SecurityConfig extends WebSecurityConfigurerAdapter {
#Bean
public AuthoritiesExtractor userAuthorityExtractor() {
return new UserAuthorityExtractor();
}
My controller method /me returns the principal object shown below.
#RestController
public class UserController {
#GetMapping("/me")
public Principal currentUser (Principal principal) {
return principal;
}
The returned object does not display the authority "MYROLE". What am I missing?

Answer 1

First things first, set a break point in your extractor. Does your code even execute? I would set the break point here:
#Bean
public AuthoritiesExtractor userAuthorityExtractor() {
return new UserAuthorityExtractor();
}
If that's a no, then you need to figure out why your bean is not being invoked. I would make sure that your SecurityConfig is actually picked up by the component scanner.
As for your controller.
In Spring Security, there is no guarantee that the Principal object also holds the authorities. The principal itself is a very simple interface
/**
* Returns the name of this principal.
*
* #return the name of this principal.
*/
public String getName();
So what you want, is the Authentication object, because that interface exposes getAuthorities
#RestController
public class UserController {
#GetMapping("/me")
public Principal currentUser (Authentication authentication) {
//do what you need with authorities
Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();
return authentication.getPrincipal();
}
You can also review the default implementation
public List<GrantedAuthority> extractAuthorities(Map<String, Object> map) {
String authorities = "ROLE_USER";
if (map.containsKey("authorities")) {
authorities = this.asAuthorities(map.get("authorities"));
}
return AuthorityUtils.commaSeparatedStringToAuthorityList(authorities);
}