title: How to filter JWT authentication authorities based on http header
body: <p>Basically I want to implement a filter after the JWT token is parsed and before the method is called with the ability to modify the authentication object based on an http header</p>
  
  <h2>Context</h2>
  
  <p>In our application we have (among others) three entities related to authentication/authorization: Users, Permissions and Groups. Permissions can be directly assigned to an user or could be assigned to one of the groups a user belongs to.</p>
  
  <p>Given this a JWT token looks like this:</p>
  
  <pre><code>{
    "username": "duck",
    "groups": [
      {
        "name": "swimmer",
        "permissions": [
          "swim"
        ]
      },
      {
        "name": "walker",
        "permissions": [
          "walk"
        ]
      }
    ],
    "permissions": [
      "quack"
    ]
  }
  </code></pre>
  
  <p>The JWT flow is setup extending <code>AuthorizationServerConfigurerAdapter</code> and <code>ResourceServerConfigurerAdapter</code>, and the permissions are extracted from the map of JWT claims by extending <code>DefaultUserAuthenticationConverter</code></p>
  
  <p>By using <code>@EnableGlobalMethodSecurity(prePostEnabled = true)</code> in the configuration I am able to annotate methods with  <code>@PreAuthorize</code></p>
  
  <p>For example:</p>
  
  <pre><code>@PreAuthorize("hasPermission('quack')")
  public void quack();
  </code></pre>
  
  <p>This works with permissions directly assigned to the user.</p>
  
  <p>However I want to receive an http header e.g: 'x-group' and add permissions from that group (if any) to the authentication object</p>
  
  <p>Then, given the above 'jwt' with the http header set to <code>swimmer</code> I want to be able to invoke the following method:</p>
  
  <pre><code>@PreAuthorize("hasPermission('swim')")
  public void 
  </code></pre>