[Acegisecurity-developer] Suggested approach for authority design

[Tim Kettering]

Hi everyone,   On this project I’m working on, we are using JAAS to authenticate a token, and Acegi’s JAAS support classes allow for the translation of the user and its principals to Acegi’s authority objects.  But in this particular case, we are not interested in the principals that JAAS returns.  We want to continue using our own method for obtaining the authorities.    So I’ve been looking at a few possible approaches.  But none of them seem to really avoid the sense of “code smell”, so I thought I’d ask on the list for suggestions from people who may be more familiar with a better strategy.    using a different authentication provider to simply populate the authorities – it seems to me that authentication manager will only process with one authentication provider, and if it returns a valid token, it does not continue down the list… so when jaas authentication provider returns a valid token, it wont process the custom class I made.  (correct me if im wrong).   Replace Acegi’s JaasAuthenticationProvider with a similar one of our own that adds a method that obtains the additional authorities and adds it in.  This was the approach I started with, and I thought perhaps I could make use of the AuthenticationDao to obtain the authorities I needed for the user and add them in, but apparently AuthenticationDao does not provide an easy way to simply obtain the authorities.. but instead, need to obtain the user itself.    With the latest code in HEAD, AuthorityResolver can now return a set, so I could hack a custom Resolver that ignored the returned Jaas Principal and simply provided its own, but this seems rather inelegant, and has it’s own issues.    So, I guess I’m asking here.. is there a easier way (that I’ve missed) to introduce my own GrantedAuthorities in the JAAS authentication flow??   Thanks in advance!   -tim