SEC-1183: Modified Attributes2GrantedAuthoritiesMapper to return Collection<? extends GrantedAuthority>.

core/src/main/java/org/springframework/security/core/authority/GrantedAuthoritiesContainer.java

@@ -1,7 +1,7 @@
 package org.springframework.security.core.authority;
 
 import java.io.Serializable;
-import java.util.List;
+import java.util.*;
 
 import org.springframework.security.core.GrantedAuthority;
 
@@ -16,5 +16,5 @@ import org.springframework.security.core.GrantedAuthority;
  * @since 2.0
  */
 public interface GrantedAuthoritiesContainer extends Serializable {
-    List<GrantedAuthority> getGrantedAuthorities();
+    Collection<? extends GrantedAuthority> getGrantedAuthorities();
 }

core/src/main/java/org/springframework/security/core/authority/GrantedAuthoritiesContainerImpl.java

@@ -1,7 +1,6 @@
 package org.springframework.security.core.authority;
 
-import java.util.Collections;
+import java.util.*;
-import java.util.List;
 
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.util.Assert;
@@ -10,8 +9,10 @@ import org.springframework.util.Assert;
 public class GrantedAuthoritiesContainerImpl implements MutableGrantedAuthoritiesContainer {
     private List<GrantedAuthority> authorities;
 
-    public void setGrantedAuthorities(List<GrantedAuthority> newAuthorities) {
+    public void setGrantedAuthorities(Collection<? extends GrantedAuthority> newAuthorities) {
-        authorities = Collections.unmodifiableList(newAuthorities);
+        ArrayList<GrantedAuthority> temp = new ArrayList<GrantedAuthority>(newAuthorities.size());
+        temp.addAll(newAuthorities);
+        authorities = Collections.unmodifiableList(temp);
     }
 
     public List<GrantedAuthority> getGrantedAuthorities() {

core/src/main/java/org/springframework/security/core/authority/MutableGrantedAuthoritiesContainer.java

@@ -1,9 +1,9 @@
 package org.springframework.security.core.authority;
 
-import java.util.List;
-
 import org.springframework.security.core.GrantedAuthority;
 
+import java.util.*;
+
 /**
  * Indicates that a object can be used to store and retrieve GrantedAuthority objects.
  * <p>
@@ -19,5 +19,5 @@ public interface MutableGrantedAuthoritiesContainer extends GrantedAuthoritiesCo
     /**
      * Used to store authorities in the containing object.
      */
-    void setGrantedAuthorities(List<GrantedAuthority> authorities);
+    void setGrantedAuthorities(Collection<? extends GrantedAuthority> authorities);
 }

core/src/main/java/org/springframework/security/core/authority/mapping/Attributes2GrantedAuthoritiesMapper.java

@@ -7,21 +7,21 @@ import org.springframework.security.core.GrantedAuthority;
 
 /**
  * Interface to be implemented by classes that can map a list of security attributes (such as roles or
- * group names) to a list of Spring Security GrantedAuthorities.
+ * group names) to a collection of Spring Security {@code GrantedAuthority}s.
  *
  * @author Ruud Senden
  * @since 2.0
  */
 public interface Attributes2GrantedAuthoritiesMapper {
     /**
-     * Implementations of this method should map the given list of attributes to a
+     * Implementations of this method should map the given collection of attributes to a
-     * list of Spring Security GrantedAuthorities. There are no restrictions for the
+     * collection of Spring Security GrantedAuthorities. There are no restrictions for the
      * mapping process; a single attribute can be mapped to multiple Spring Security
      * GrantedAuthorities, all attributes can be mapped to a single Spring Security
-     * GrantedAuthority, some attributes may not be mapped, etc.
+     * {@code GrantedAuthority}, some attributes may not be mapped, etc.
      *
      * @param attributes the attributes to be mapped
-     * @return the list of mapped GrantedAuthorities
+     * @return the collection of authorities created from the attributes
      */
-    public List<GrantedAuthority> getGrantedAuthorities(Collection<String> attributes);
+    public Collection<? extends GrantedAuthority> getGrantedAuthorities(Collection<String> attributes);
 }

core/src/main/java/org/springframework/security/core/authority/mapping/MapBasedAttributes2GrantedAuthoritiesMapper.java

@@ -1,13 +1,6 @@
 package org.springframework.security.core.authority.mapping;
 
-import java.util.ArrayList;
+import java.util.*;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.StringTokenizer;
 
 import org.springframework.beans.factory.InitializingBean;
 import org.springframework.security.core.GrantedAuthority;

core/src/test/java/org/springframework/security/core/authority/mapping/MapBasedAttributes2GrantedAuthoritiesMapperTest.java

@@ -1,18 +1,12 @@
 package org.springframework.security.core.authority.mapping;
 
-import static org.junit.Assert.*;
+import static org.junit.Assert.assertTrue;
-
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collection;
-import java.util.HashMap;
-import java.util.List;
 
 import org.junit.Test;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.GrantedAuthorityImpl;
-import org.springframework.security.core.authority.mapping.Attributes2GrantedAuthoritiesMapper;
+
-import org.springframework.security.core.authority.mapping.MapBasedAttributes2GrantedAuthoritiesMapper;
+import java.util.*;
 
 /**
  *
@@ -73,113 +67,100 @@ public class MapBasedAttributes2GrantedAuthoritiesMapperTest {
     public void testMapping1() throws Exception {
         String[] roles = { "role1" };
         String[] expectedGas = { "ga1" };
-        Attributes2GrantedAuthoritiesMapper mapper = getDefaultMapper();
+        testGetGrantedAuthorities(getDefaultMapper(), roles, expectedGas);
-        testGetGrantedAuthorities(mapper, roles, expectedGas);
     }
 
     @Test
     public void testMapping2() throws Exception {
         String[] roles = { "role2" };
         String[] expectedGas = { "ga2" };
-        Attributes2GrantedAuthoritiesMapper mapper = getDefaultMapper();
+        testGetGrantedAuthorities(getDefaultMapper(), roles, expectedGas);
-        testGetGrantedAuthorities(mapper, roles, expectedGas);
     }
 
     @Test
     public void testMapping3() throws Exception {
         String[] roles = { "role3" };
         String[] expectedGas = { "ga3", "ga4" };
-        Attributes2GrantedAuthoritiesMapper mapper = getDefaultMapper();
+        testGetGrantedAuthorities(getDefaultMapper(), roles, expectedGas);
-        testGetGrantedAuthorities(mapper, roles, expectedGas);
     }
 
     @Test
     public void testMapping4() throws Exception {
         String[] roles = { "role4" };
         String[] expectedGas = { "ga5", "ga6" };
-        Attributes2GrantedAuthoritiesMapper mapper = getDefaultMapper();
+        testGetGrantedAuthorities(getDefaultMapper(), roles, expectedGas);
-        testGetGrantedAuthorities(mapper, roles, expectedGas);
     }
 
     @Test
     public void testMapping5() throws Exception {
         String[] roles = { "role5" };
         String[] expectedGas = { "ga7", "ga8", "ga9" };
-        Attributes2GrantedAuthoritiesMapper mapper = getDefaultMapper();
+        testGetGrantedAuthorities(getDefaultMapper(), roles, expectedGas);
-        testGetGrantedAuthorities(mapper, roles, expectedGas);
     }
 
     @Test
     public void testMapping6() throws Exception {
         String[] roles = { "role6" };
         String[] expectedGas = { "ga10", "ga11", "ga12" };
-        Attributes2GrantedAuthoritiesMapper mapper = getDefaultMapper();
+        testGetGrantedAuthorities(getDefaultMapper(), roles, expectedGas);
-        testGetGrantedAuthorities(mapper, roles, expectedGas);
     }
 
     @Test
     public void testMapping7() throws Exception {
         String[] roles = { "role7" };
         String[] expectedGas = { "ga13", "ga14" };
-        Attributes2GrantedAuthoritiesMapper mapper = getDefaultMapper();
+        testGetGrantedAuthorities(getDefaultMapper(), roles, expectedGas);
-        testGetGrantedAuthorities(mapper, roles, expectedGas);
     }
 
     @Test
     public void testMapping8() throws Exception {
         String[] roles = { "role8" };
         String[] expectedGas = { "ga13", "ga14" };
-        Attributes2GrantedAuthoritiesMapper mapper = getDefaultMapper();
+        testGetGrantedAuthorities(getDefaultMapper(), roles, expectedGas);
-        testGetGrantedAuthorities(mapper, roles, expectedGas);
     }
 
     @Test
     public void testMapping9() throws Exception {
         String[] roles = { "role9" };
         String[] expectedGas = {};
-        Attributes2GrantedAuthoritiesMapper mapper = getDefaultMapper();
+        testGetGrantedAuthorities(getDefaultMapper(), roles, expectedGas);
-        testGetGrantedAuthorities(mapper, roles, expectedGas);
     }
 
     @Test
     public void testMapping10() throws Exception {
         String[] roles = { "role10" };
         String[] expectedGas = {};
-        Attributes2GrantedAuthoritiesMapper mapper = getDefaultMapper();
+        testGetGrantedAuthorities(getDefaultMapper(), roles, expectedGas);
-        testGetGrantedAuthorities(mapper, roles, expectedGas);
     }
 
     @Test
     public void testMapping11() throws Exception {
         String[] roles = { "role11" };
         String[] expectedGas = {};
-        Attributes2GrantedAuthoritiesMapper mapper = getDefaultMapper();
+        testGetGrantedAuthorities(getDefaultMapper(), roles, expectedGas);
-        testGetGrantedAuthorities(mapper, roles, expectedGas);
     }
 
     @Test
     public void testNonExistingMapping() throws Exception {
         String[] roles = { "nonExisting" };
         String[] expectedGas = {};
-        Attributes2GrantedAuthoritiesMapper mapper = getDefaultMapper();
+        testGetGrantedAuthorities(getDefaultMapper(), roles, expectedGas);
-        testGetGrantedAuthorities(mapper, roles, expectedGas);
     }
 
     @Test
     public void testMappingCombination() throws Exception {
         String[] roles = { "role1", "role2", "role3", "role4", "role5", "role6", "role7", "role8", "role9", "role10", "role11" };
         String[] expectedGas = { "ga1", "ga2", "ga3", "ga4", "ga5", "ga6", "ga7", "ga8", "ga9", "ga10", "ga11", "ga12", "ga13", "ga14"};
-        Attributes2GrantedAuthoritiesMapper mapper = getDefaultMapper();
+        testGetGrantedAuthorities(getDefaultMapper(), roles, expectedGas);
-        testGetGrantedAuthorities(mapper, roles, expectedGas);
     }
 
     private HashMap getValidAttributes2GrantedAuthoritiesMap() {
         HashMap m = new HashMap();
         m.put("role1","ga1");
         m.put("role2",new GrantedAuthorityImpl("ga2"));
-        m.put("role3",Arrays.asList(new Object[]{"ga3",new GrantedAuthorityImpl("ga4")}));
+        m.put("role3",Arrays.asList("ga3",new GrantedAuthorityImpl("ga4")));
         m.put("role4","ga5,ga6");
-        m.put("role5",Arrays.asList(new Object[]{"ga7","ga8",new Object[]{new GrantedAuthorityImpl("ga9")}}));
+        m.put("role5",Arrays.asList("ga7","ga8",new Object[]{new GrantedAuthorityImpl("ga9")}));
         m.put("role6",new Object[]{"ga10","ga11",new Object[]{new GrantedAuthorityImpl("ga12")}});
         m.put("role7",new String[]{"ga13","ga14"});
         m.put("role8",new String[]{"ga13","ga14",null});
@@ -196,11 +177,11 @@ public class MapBasedAttributes2GrantedAuthoritiesMapperTest {
         return mapper;
     }
 
-    private void testGetGrantedAuthorities(Attributes2GrantedAuthoritiesMapper mapper, String[] roles, String[] expectedGas) {
+    private void testGetGrantedAuthorities(MapBasedAttributes2GrantedAuthoritiesMapper mapper, String[] roles, String[] expectedGas) {
         List<GrantedAuthority> result = mapper.getGrantedAuthorities(Arrays.asList(roles));
         Collection resultColl = new ArrayList(result.size());
-        for (int i = 0; i < result.size(); i++) {
+        for (GrantedAuthority auth : result) {
-            resultColl.add(result.get(i).getAuthority());
+            resultColl.add(auth.getAuthority());
         }
         Collection expectedColl = Arrays.asList(expectedGas);
         assertTrue("Role collections should match; result: " + resultColl + ", expected: " + expectedColl, expectedColl

core/src/test/java/org/springframework/security/core/authority/mapping/SimpleRoles2GrantedAuthoritiesMapperTests.java

@@ -1,14 +1,9 @@
 package org.springframework.security.core.authority.mapping;
 
+import junit.framework.TestCase;
 import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.core.authority.mapping.SimpleAttributes2GrantedAuthoritiesMapper;
-
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collection;
-import java.util.List;
 
-import junit.framework.TestCase;
+import java.util.*;
 
 /**
  *

web/src/main/java/org/springframework/security/web/authentication/preauth/PreAuthenticatedGrantedAuthoritiesAuthenticationDetails.java

@@ -1,7 +1,6 @@
 package org.springframework.security.web.authentication.preauth;
 
-import java.util.Collections;
+import java.util.*;
-import java.util.List;
 
 import org.springframework.security.authentication.AuthenticationDetails;
 import org.springframework.security.core.GrantedAuthority;
@@ -37,10 +36,12 @@ public class PreAuthenticatedGrantedAuthoritiesAuthenticationDetails extends Aut
     }
 
     /**
-     * @see MutableGrantedAuthoritiesContainer#setGrantedAuthorities(List)
+     * @see MutableGrantedAuthoritiesContainer#setGrantedAuthorities(Collection)
      */
-    public void setGrantedAuthorities(List<GrantedAuthority> aJ2eeBasedGrantedAuthorities) {
+    public void setGrantedAuthorities(Collection<? extends GrantedAuthority> aJ2eeBasedGrantedAuthorities) {
-        this.preAuthenticatedGrantedAuthorities = Collections.unmodifiableList(aJ2eeBasedGrantedAuthorities);
+        List<GrantedAuthority> temp = new ArrayList<GrantedAuthority>(aJ2eeBasedGrantedAuthorities.size());
+        temp.addAll(aJ2eeBasedGrantedAuthorities);
+        this.preAuthenticatedGrantedAuthorities = Collections.unmodifiableList(temp);
     }
 
     /**
@@ -48,8 +49,8 @@ public class PreAuthenticatedGrantedAuthoritiesAuthenticationDetails extends Aut
      */
     public String toString() {
         StringBuilder sb = new StringBuilder();
-        sb.append(super.toString() + "; ");
+        sb.append(super.toString()).append("; ");
-        sb.append("preAuthenticatedGrantedAuthorities: " + preAuthenticatedGrantedAuthorities);
+        sb.append("preAuthenticatedGrantedAuthorities: ").append(preAuthenticatedGrantedAuthorities);
         return sb.toString();
     }
 }

web/src/main/java/org/springframework/security/web/authentication/preauth/PreAuthenticatedGrantedAuthoritiesUserDetailsService.java

@@ -1,6 +1,6 @@
 package org.springframework.security.web.authentication.preauth;
 
-import java.util.List;
+import java.util.*;
 
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
@@ -41,7 +41,7 @@ public class PreAuthenticatedGrantedAuthoritiesUserDetailsService
     public final UserDetails loadUserDetails(PreAuthenticatedAuthenticationToken token) throws AuthenticationException {
         Assert.notNull(token.getDetails());
         Assert.isInstanceOf(GrantedAuthoritiesContainer.class, token.getDetails());
-        List<GrantedAuthority> authorities = ((GrantedAuthoritiesContainer) token.getDetails()).getGrantedAuthorities();
+        Collection<? extends GrantedAuthority> authorities = ((GrantedAuthoritiesContainer) token.getDetails()).getGrantedAuthorities();
         return createuserDetails(token, authorities);
     }
 
@@ -51,7 +51,7 @@ public class PreAuthenticatedGrantedAuthoritiesUserDetailsService
      * @param token the authentication request token
      * @param authorities the pre-authenticated authorities.
      */
-    protected UserDetails createuserDetails(Authentication token, List<GrantedAuthority> authorities) {
+    protected UserDetails createuserDetails(Authentication token, Collection<? extends GrantedAuthority> authorities) {
         return new User(token.getName(), "N/A", true, true, true, true, authorities);
     }
 }

web/src/main/java/org/springframework/security/web/authentication/preauth/PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails.java

@@ -5,9 +5,7 @@ import org.springframework.security.core.authority.GrantedAuthoritiesContainer;
 import org.springframework.security.web.authentication.WebAuthenticationDetails;
 
 import javax.servlet.http.HttpServletRequest;
-import java.util.ArrayList;
+import java.util.*;
-import java.util.Collections;
-import java.util.List;
 
 /**
  * This WebAuthenticationDetails implementation allows for storing a list of
@@ -23,7 +21,7 @@ public class PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails extends
     private final List<GrantedAuthority> authorities;
 
     public PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails(HttpServletRequest request,
-            List<GrantedAuthority> authorities) {
+            Collection<? extends GrantedAuthority> authorities) {
         super(request);
 
         List<GrantedAuthority> temp = new ArrayList<GrantedAuthority>(authorities.size());

web/src/main/java/org/springframework/security/web/authentication/preauth/j2ee/J2eeBasedPreAuthenticatedWebAuthenticationDetailsSource.java

@@ -68,7 +68,7 @@ public class J2eeBasedPreAuthenticatedWebAuthenticationDetailsSource
     public PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails buildDetails(HttpServletRequest context) {
 
         Collection<String> j2eeUserRoles = getUserRoles(context);
-        List<GrantedAuthority> userGas = j2eeUserRoles2GrantedAuthoritiesMapper.getGrantedAuthorities(j2eeUserRoles);
+        Collection<? extends GrantedAuthority> userGas = j2eeUserRoles2GrantedAuthoritiesMapper.getGrantedAuthorities(j2eeUserRoles);
 
         if (logger.isDebugEnabled()) {
             logger.debug("J2EE roles [" + j2eeUserRoles + "] mapped to Granted Authorities: [" + userGas + "]");

web/src/main/java/org/springframework/security/web/authentication/preauth/websphere/WebSpherePreAuthenticatedAuthenticationDetailsSource.java

@@ -1,6 +1,6 @@
 package org.springframework.security.web.authentication.preauth.websphere;
 
-import java.util.List;
+import java.util.*;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
@@ -73,9 +73,9 @@ public class WebSpherePreAuthenticatedAuthenticationDetailsSource extends Authen
      *
      * @return authorities mapped from the user's WebSphere groups.
      */
-    private List<GrantedAuthority> getWebSphereGroupsBasedGrantedAuthorities() {
+    private Collection<? extends GrantedAuthority> getWebSphereGroupsBasedGrantedAuthorities() {
         List<String> webSphereGroups = wasHelper.getGroupsForCurrentUser();
-        List<GrantedAuthority> userGas = webSphereGroups2GrantedAuthoritiesMapper.getGrantedAuthorities(webSphereGroups);
+        Collection<? extends GrantedAuthority> userGas = webSphereGroups2GrantedAuthoritiesMapper.getGrantedAuthorities(webSphereGroups);
         if (logger.isDebugEnabled()) {
             logger.debug("WebSphere groups: " + webSphereGroups + " mapped to Granted Authorities: " + userGas);
         }

web/src/main/java/org/springframework/security/web/authentication/preauth/websphere/WebSpherePreAuthenticatedWebAuthenticationDetailsSource.java

@@ -9,7 +9,7 @@ import org.springframework.security.core.authority.mapping.SimpleAttributes2Gran
 import org.springframework.security.web.authentication.preauth.PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails;
 
 import javax.servlet.http.HttpServletRequest;
-import java.util.List;
+import java.util.*;
 
 /**
  * This AuthenticationDetailsSource implementation will set the pre-authenticated granted
@@ -43,9 +43,9 @@ public class WebSpherePreAuthenticatedWebAuthenticationDetailsSource implements
      *
      * @return authorities mapped from the user's WebSphere groups.
      */
-    private List<GrantedAuthority> getWebSphereGroupsBasedGrantedAuthorities() {
+    private Collection<? extends GrantedAuthority> getWebSphereGroupsBasedGrantedAuthorities() {
         List<String> webSphereGroups = wasHelper.getGroupsForCurrentUser();
-        List<GrantedAuthority> userGas = webSphereGroups2GrantedAuthoritiesMapper.getGrantedAuthorities(webSphereGroups);
+        Collection<? extends GrantedAuthority> userGas = webSphereGroups2GrantedAuthoritiesMapper.getGrantedAuthorities(webSphereGroups);
         if (logger.isDebugEnabled()) {
             logger.debug("WebSphere groups: " + webSphereGroups + " mapped to Granted Authorities: " + userGas);
         }

web/src/test/java/org/springframework/security/web/authentication/preauth/PreAuthenticatedGrantedAuthoritiesUserDetailsServiceTests.java

@@ -2,15 +2,13 @@ package org.springframework.security.web.authentication.preauth;
 
 import static org.junit.Assert.*;
 
-import java.util.List;
+import java.util.*;
 
 import org.junit.Test;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.AuthorityUtils;
 import org.springframework.security.core.authority.GrantedAuthoritiesContainer;
 import org.springframework.security.core.userdetails.UserDetails;
-import org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken;
-import org.springframework.security.web.authentication.preauth.PreAuthenticatedGrantedAuthoritiesUserDetailsService;
 
 /**
  *
@@ -51,7 +49,7 @@ public class PreAuthenticatedGrantedAuthoritiesUserDetailsServiceTests {
         PreAuthenticatedGrantedAuthoritiesUserDetailsService svc = new PreAuthenticatedGrantedAuthoritiesUserDetailsService();
         PreAuthenticatedAuthenticationToken token = new PreAuthenticatedAuthenticationToken(userName, "dummy");
         token.setDetails(new GrantedAuthoritiesContainer() {
-            public List<GrantedAuthority> getGrantedAuthorities() {
+            public Collection<? extends GrantedAuthority> getGrantedAuthorities() {
                 return gas;
             }
         });