Spring security : User class without UserRole (roles). Authentication only no authorization needed

Question

I'm using Spring-security with Spring-boot. My Application is a POC, for the moment there is no need to have Role.

I was wondering if it is possible to have a Custom UserDetailsService which return UserDetails in loadUserByUsername method but without the GrantedAuthority nor UserRole class.

I have googled all the day long for an example but I always get them with the UserRole.

Thanks in advance

Answer 1

This should work:

1. Let UserDetails return an empty collection in getAuthorities():

   public class User implements UserDetails {
       ...
       @Override
       public Collection<? extends GrantedAuthority> getAuthorities() {        
           return new HashSet<GrantedAuthority>();
       }
   }
   

2. Use just authenticated() while configuring security

   http.authorizeRequests()
       ...
       .antMatchers("/foo").authenticated()
       ...