SEC-30: Authentication to extend Credentials about spring-security

[spring-projects-issues]

Ben Alex said:

Whilst there are explanatory advantages in differentiating between an Authentication request and a populated Authentication object, there are no technical advantages in doing so that I can identify. I have investigated implementing this change and it would cause significant changes throughout many classes, and create backward compatibility issues for the commonly-implemented AuthenticationProvider interface. There are some issues in particular related to needing to cast (and assuming the SecurityContextHolder contains a particular type of Authentication vs AuthenticationRequest at a particular time) and also with RMI propagation of the SecurityContext. These issues are more likely to lead to bugs or configuration issues/confusion for users, and given there is no technical advantage in this change I suggest we don’t make it.