title: Spring Securirty Granted Authorities always return empty
body: <p>I am trying to gather user permissions from Active Directory in my Spring 4.0.6 application, using Spring Security 3.2.4.</p>
  
  <p>Some details:</p>
  
  <ul>
  <li>Authentication works. I can get the current username.</li>
  <li>Pre-authentication is done by JBoss 7.2 using JCIFS (NTLM).</li>
  <li>LDAP server works, so host and port are correct.</li>
  <li>Domain is correct.</li>
  </ul>
  
  <p><strong>SecurityConfig.java</strong></p>
  
  <pre><code>@Configuration
  @EnableWebMvcSecurity
  @PropertySource( "classpath:/resources/ldap-config.properties" )
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Value( "${domain}" )
      private String strDomain;
  
      @Value( "${ldap.host}" )
      private String strHost;
  
      @Value( "${ldap.basedn}" )
      private String strBaseDn;
  
      @Value( "${ldap.userdn}" )
      private String strUserDn;
  
      @Value( "${ldap.userdn.password}" )
      private String strUserDnPassword;
  
      @Bean
      public static PropertySourcesPlaceholderConfigurer propertySourcesPlaceholderConfigurer() {
          return new PropertySourcesPlaceholderConfigurer();
      }
  
      @Bean 
      public ActiveDirectoryGrantedAuthoritiesMapper grantedAuthoritiesMapper() {
          return new ActiveDirectoryGrantedAuthoritiesMapper();
      }
  
      @Bean
      public ActiveDirectoryLdapAuthenticationProvider activeDirectoryLdapAuthenticationProvider() {
  
          ActiveDirectoryLdapAuthenticationProvider activeDirectoryLdapAuthenticationProvider = new ActiveDirectoryLdapAuthenticationProvider(strDomain, strHost);
          activeDirectoryLdapAuthenticationProvider.setUseAuthenticationRequestCredentials(true);
          activeDirectoryLdapAuthenticationProvider.setConvertSubErrorCodesToExceptions(true);
  
          activeDirectoryLdapAuthenticationProvider.setAuthoritiesMapper(this.grantedAuthoritiesMapper());
  
          return activeDirectoryLdapAuthenticationProvider;
      }
  
      @Override
      public void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
  
          authenticationManagerBuilder
          .authenticationProvider(this.activeDirectoryLdapAuthenticationProvider());
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          http
              .authorizeRequests()
                  .anyRequest().authenticated()
              .and()
              .jee();
      }
  }
  </code></pre>
  
  <p><strong>ActiveDirectoryGrantedAuthoritiesMapper.java</strong></p>
  
  <pre><code>public class ActiveDirectoryGrantedAuthoritiesMapper implements GrantedAuthoritiesMapper {
  
      // Constants for group defined in LDAP
      private final String ROLE_ADMIN = "A_SPECIFIC_ADMIN_GROUP_IN_AD";
      private final String ROLE_USER = "A_SPECIFIC_GROUP_IN_AD";
  
      public ActiveDirectoryGrantedAuthoritiesMapper() {
      }
  
      @Override
      public Collection&lt;? extends GrantedAuthority&gt; mapAuthorities(final Collection&lt;? extends GrantedAuthority&gt; authorities) {
  
          Set&lt;SecurityContextAuthority&gt; roles = EnumSet.noneOf(SecurityContextAuthority.class);
  
          for (GrantedAuthority authority : authorities) {
  
              System.out.println("GrantedAuthority : " + authority.getAuthority());
  
              if (ROLE_ADMIN.equals(authority.getAuthority())) {
                  roles.add(SecurityContextAuthority.ROLE_ADMIN);
              }
  
              if (ROLE_USER.equals(authority.getAuthority())) {
                  roles.add(SecurityContextAuthority.ROLE_USER);
              }
          }
  
          return roles;
      }
  
  }
  </code></pre>
  
  <p><strong>SecurityContextAuthority.java</strong></p>
  
  <pre><code>public enum SecurityContextAuthority implements GrantedAuthority {
  
      ROLE_ADMIN, ROLE_USER;
  
      @Override
      public String getAuthority() {
          return name();
      }
  }
  </code></pre>
  
  <hr>
  
  <p>What I got in my console:</p>
  
  <pre><code>2014-10-14 14:04:02,557 INFO  [stdout] (http-localhost/127.0.0.1:8080-2) MY_DOMAIN\MY_USERNAME
  2014-10-14 14:04:02,557 INFO  [stdout] (http-localhost/127.0.0.1:8080-2) Authorities: []
  2014-10-14 14:04:02,557 INFO  [stdout] (http-localhost/127.0.0.1:8080-2) Auth Type: NTLM
  2014-10-14 14:04:02,557 INFO  [stdout] (http-localhost/127.0.0.1:8080-2) Is Authenticated: true
  </code></pre>
  
  <p>With debugging turned on, I got the follow extra details:</p>
  
  <pre><code>2014-10-16 11:10:50,959 DEBUG [org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter] (http-localhost/127.0.0.1:8080-1) Checking secure context token: null
  2014-10-16 11:10:50,959 DEBUG [org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter] (http-localhost/127.0.0.1:8080-1) PreAuthenticated J2EE principal: MY_DOMAIN\MY_USERNAME
  2014-10-16 11:10:50,959 DEBUG [org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter] (http-localhost/127.0.0.1:8080-1) preAuthenticatedPrincipal = MY_DOMAIN\MY_USERNAME, trying to authenticate
  2014-10-16 11:10:50,959 DEBUG [org.springframework.security.web.authentication.preauth.j2ee.J2eeBasedPreAuthenticatedWebAuthenticationDetailsSource] (http-localhost/127.0.0.1:8080-1) J2EE roles [[]] mapped to Granted Authorities: [[]]
  2014-10-16 11:10:50,960 DEBUG [org.springframework.security.authentication.ProviderManager] (http-localhost/127.0.0.1:8080-1) Authentication attempt using org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider
  2014-10-16 11:10:50,960 DEBUG [org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider] (http-localhost/127.0.0.1:8080-1) PreAuthenticated authentication request: org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken@f99efc97: Principal: MY_DOMAIN\MY_USERNAME; Credentials: [PROTECTED]; Authenticated: false; Details: org.springframework.security.web.authentication.preauth.PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails@380f4: RemoteIpAddress: 127.0.0.1; SessionId: FaMwocWCdZawHD1GvwUcNg8S; []; Not granted any authorities
  2014-10-16 11:10:50,960 DEBUG [org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter] (http-localhost/127.0.0.1:8080-1) Authentication success: org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken@661034c: Principal: org.springframework.security.core.userdetails.User@f99c56bc: Username: MY_DOMAIN\MY_USERNAME; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Not granted any authorities; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.preauth.PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails@380f4: RemoteIpAddress: 127.0.0.1; SessionId: FaMwocWCdZawHD1GvwUcNg8S; []; Not granted any authorities
  </code></pre>
  
  <p><strong>Other debugging info:</strong></p>
  
  <ul>
  <li>Authorities are always empty</li>
  <li>mapAuthorities and getAuthority never seem to be invoked. Adding breakpoints does nothing at all.</li>
  </ul>
  
  <p>Any help would be much appreciated.</p>