Remove ActiveRolesProvider

[adutra]

Summary of changes:

• As proposed on the ML, ActiveRolesProvider is removed, and DefaultActiveRolesProvider is merged into DefaultAuthenticator. ActiveRolesAugmentor is also merged into AuthenticatingAugmentor.

• The implicit convention that "no roles in credentials" == "all roles requested" is removed, as it is ambiguous. From now on, credentials must explicitly include the PRINCIPAL_ROLE:ALL pseudo-role in order to request all roles.

• PersistedPolarisPrincipal is removed. It existed merely as a means of passing the PrincipalEntity from the authenticator to the roles provider. This is not necessary anymore.

[adutra]

@flyrain @collado-mike @dennishuo FYI

As discussed in the ML, I know that ActiveRolesProvider is listed as an extension point.

My ask is for you to assess whether you can refactor your own roles provider impl from this:

@RequestScoped class MyAuthenticator implements Authenticator {}
@RequestScoped class MyActiveRolesProvider implements ActiveRolesProvider {}

to this:

@RequestScoped class MyAuthenticator implements Authenticator {
  @Inject MyActiveRolesProvider rolesProvider;
}

That is, make your own impl of ActiveRolesProvider a sub-component of your Authenticator impl.

I created several protected methods in DefaultAuthenticator that can be used to facilitate this migration:

• resolvePrincipalEntity : mostly what was already in this class
• resolvePrincipalRoles : mostly code from DefaultActiveRolesProvider, also calls two methods:
  • extractRequestedRoles: decodes the token roles and handles the PRINCIPAL_ROLES:ALL stuff
  • loadPrincipalGrants: loads the principal grants

But you are also free of course to use a different Authenticator impl if that's easier.

[dennishuo]

LGTM! Thanks for the mailing list discussion and your notes about compatibility and how any service providers with custom impls can easily migrate; it provides a good example to follow in general for SPI evolution PRs.