title: Difference between Role and GrantedAuthority in Spring Security
body: <p>There are concepts and implementations in Spring Security, such as the <code>GrantedAuthority</code> interface to get an <em>authority</em> to authorize/control an access. </p>
  
  <p>I would like that to permissible operations, such as <em>createSubUsers</em>, or <em>deleteAccounts</em>, which I would allow to an <em>admin</em> (with role <code>ROLE_ADMIN</code>). </p>
  
  <p>I am getting confused as the tutorials/demos I see online. I try to connect what I read, but I think we treat the two interchangeably.</p>
  
  <p>I see <code>hasRole</code> consuming a <code>GrantedAuthority</code> string? I most definitely am doing it wrong in understanding. What are these conceptually in Spring Security? </p>
  
  <p>How do I store the role of a user, separate from the authorities for that role?</p>
  
  <p>I'm also looking at the <code>org.springframework.security.core.userdetails.UserDetails</code> interface which is used in the authentication-provider referenced DAO, which consumes a <code>User</code> (note last GrantedAuthority):</p>
  
  <pre><code>public User(String username, 
              String password, 
              boolean enabled, 
              boolean accountNonExpired,
              boolean credentialsNonExpired, 
              boolean accountNonLocked, 
              Collection&lt;? extends GrantedAuthority&gt; authorities)
  </code></pre>
  
  <p>Or is there any other way to differentiate the other two? Or is it not supported and we have to make our own?</p>