getAuthorities() is a UserDetails method that returns the collection of GrantedAuthority instances granted to a user. Authorities represent permitted actions such as reading, writing, or deleting data. section 3.2.1 section 7.1
Use the returned authorities to:
- Represent fine-grained privileges; Spring Security can also use authorities to represent roles, which group privileges. section 3.2.1
- Carry a user’s granted permissions into the authenticated user details after authentication. section 7.1
- Support authorization rules that restrict actions such as reading, writing, or deleting resources. section 3.2.1
Permission-based access
If Jane has the delete authority and John has the read authority, authorization rules can permit Jane to delete product records and John to read documents. section 7.1
Listing 7.2 The getAuthorities() method from the UserDetails contract
public interface UserDetails extends Serializable {
Collection<? extends GrantedAuthority> getAuthorities();
// Omitted code
}
Inspect the UserDetails contract signature showing that getAuthorities() returns a collection of GrantedAuthority instances. section 7.1
