title: Spring Security: How To add extra role to authenticated user
body: <p>I have an application which works with REST services and spring security.  I have Basic authentication and I need to have hard and soft login.</p>
  
  <p>Scenario is: when a user logs in he is assigned ROLE_SOFT
  and has access to the URL which requires ROLE_SOFT, but if he wants to have access to the URL which requires ROLE_HARD, he must send some code or something to a specified web service.</p>
  
  <p>So I read this 
  <a href="https://stackoverflow.com/questions/283870/acegi-security-how-do-i-add-another-grantedauthority-to-authentication-to-anony">Acegi Security: How do i add another GrantedAuthority to Authentication to anonymous user</a></p>
  
  <p>After it I create my:</p>
  
  <pre><code>public class AuthenticationWrapper implements Authentication
  {
     private Authentication original;
  
     public AuthenticationWrapper(Authentication original)
     {
        this.original = original;
     }
  
  
     public String getName() { return original.getName(); }
     public Object getCredentials() { return original.getCredentials(); }
     public Object getDetails() { return original.getDetails(); }   
     public Object getPrincipal() { return original.getPrincipal(); }
     public boolean isAuthenticated() { return original.isAuthenticated(); }
     public void setAuthenticated( boolean isAuthenticated ) throws IllegalArgumentException
     {
        original.setAuthenticated( isAuthenticated );
     }
  
  public Collection&lt;? extends GrantedAuthority&gt; getAuthorities() {
      System.out.println("EXISTING ROLES:");
      System.out.println("Size=:"+original.getAuthorities().size());
      for (GrantedAuthority iterable : original.getAuthorities()) {
  
          System.out.println(iterable.getAuthority());
      }
  
      GrantedAuthority newrole = new SimpleGrantedAuthority("ROLE_HARD");
      System.out.println("ADD new ROLE:"+newrole.getAuthority());
      Collection&lt;? extends GrantedAuthority&gt; originalRoles = original.getAuthorities();
  
       ArrayList&lt;GrantedAuthority&gt; temp = new ArrayList&lt;GrantedAuthority&gt;(originalRoles.size()+1);
       temp.addAll(originalRoles);
       temp.add(newrole); 
       System.out.println("RETURN NEW LIST SIZE"+temp.size());
       for (GrantedAuthority grantedAuthority : temp) {
          System.out.println("NEW ROLES:"+grantedAuthority.getAuthority());
      }
  
      return Collections.unmodifiableList(temp);
  }
  </code></pre>
  
  <p>and controller</p>
  
  <pre><code>@Controller
  @RequestMapping("/login")
  public class LoginControllerImpl implements LoginController {
  
  
      LoginService loginService;
  
  
      @RequestMapping(method = RequestMethod.GET, headers = "Accept=application/json")
      @ResponseBody
      public User getUserSettings(){
          loginService=new LoginServiceImpl();
          Authentication auth =   SecurityContextHolder.getContext().getAuthentication();
          AuthenticationWrapper wrapper = new AuthenticationWrapper(auth);
          SecurityContextHolder.getContext().setAuthentication( wrapper );
  
          return loginService.getUser();
      }
  
  
  }
  </code></pre>
  
  <p>But after I change Authentication my session goes down..
  Maybe some one knows a better solution... </p>