Propagate Authorities From Previous Factors

[jzheaux]

Applications can use AuthenticationBuilder to apply existing authentications to new ones.

For example, if the current logged in user is represented by:

Authentication firstFactor = ...

And they provide a second set of authenticated credentials, represented by:

Authentication secondFactor = ...

Then the first factor can be applied to the second factor as follows:

secondFactor = secondFactor.toBuilder()
    .authorities((a) -> a.addAll(firstFactor.getAuthorities()).build();

This draft PR adds a basic builder to each Authentication implementation that implements Authentication.Builder. In order to simplify upgrades, toBuilder by default returns a no-op implementation of Authentication.Builder that ultimately returns the same authentication unchanged.

[rwinch]

Thanks for the PR @jzheaux! I've provided feedback inline, but my main pieces of feedback are:

• The AuthenticationManager should not be accessing the SecurityContext. Instead, we should have the controller (e.g. Filter) that invokes the AuthenticationManager perform the merging of the two Authentication instances.
• I think that the builder APIs should function independently of MFA and should work for any properties on the Authentication. Doing this would also allow deprecation of the setAuthenticated method.
• I don't think we should have an Authentication.apply(Authentication) method. Especially so if it is only applying the authorities and ignoring many other properties that are on the Authentication object.

[rwinch]

Thanks again for all your work on this. I think that we are nearly done. I provided a minor comment inline.

I think that we should also update the reference. At minimum it should be added to whats-new.adoc and link to the Javadoc. However, I think the core APIs in servlet/authentication/architecture.adoc should be updated and the diagram description of AbstractAuthenticationProcessingFilter and the reactive equivalents.