Altering roles using UserDetails and JdbcUserDetailsManager

[matt.friedman]

JdbcUserDetailsManager has a method: JdbcUserDetailsManager.alterUser(UserDetails); this method contains code to update the existing authorities with the authorities contained in the UserDetails instance.

However, when calling JdbcUserDetailsManager.loadUserByUsername() it returns a UserDetails with an unmodifiable collection of authorities. So, by default you can't update the authorities on the UserDetails instance.

Additionally, the insert and delete authorities methods in JdbcUserDetailsManager are private.

Could this be considered an API clash?

Is there another way to alter the roles/authorities for a user that I'm not yet aware of?

Thanks,
Matt