Spring Security - Kerberos аутентификация + SpEL авторизация

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    
    @Value("${authentication.ldap.domain}")
    private String ldapDomain;
    
    @Value("${authentication.ldap.url}")
    private String ldapUrl;
    
    @Value("${authentication.ldap.search-base}")
    private String ldapSearchBase;
    
    @Value("${authentication.ldap.ad-filter}")
    private String ldapFilter;
    
    @Value("${authentication.ldap.spnego-filter}")
    private String spnegoFilter;
 
    @Value("${authentication.service-principal}")
    private String servicePrincipal;
    
    @Value("${authentication.keytab-location}")
    private String keytabLocation;
    
    @Value("${authentication.krb5conf-location}")
    private String krbConfLocation;
    
    @Autowired 
    private CustomSuccessHandler successHandler;
    
    @Autowired
    public void configureGlobal(final AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(kerberosServiceAuthenticationProvider());
        auth.authenticationProvider(activeDirectoryLdapAuthenticationProvider());
    }
        
    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring()
           .antMatchers("/resources/**");
    }
    
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
            .exceptionHandling()
                .authenticationEntryPoint(spnegoEntryPoint())
                .and()
            .authorizeRequests()
                .anyRequest().authenticated()
                .and()
            .formLogin()
                .loginPage("/login")
                .loginProcessingUrl("/login")
                .successHandler(successHandler)
                .defaultSuccessUrl("/home")
                .permitAll()
                .and()
            .logout()
                .permitAll()
                .and()
            .addFilterBefore(usernamePasswordAuthenticationFilter(authenticationManagerBean()),
                    BasicAuthenticationFilter.class)
            .addFilterBefore(spnegoAuthenticationProcessingFilter(authenticationManagerBean()),
                    UsernamePasswordAuthenticationFilter.class);
    }
    
    @Bean
    public ActiveDirectoryLdapAuthenticationProvider activeDirectoryLdapAuthenticationProvider() {
        ActiveDirectoryLdapAuthenticationProvider provider = 
                new ActiveDirectoryLdapAuthenticationProvider( this.ldapDomain, this.ldapUrl, this.ldapSearchBase );
        provider.setUserDetailsContextMapper(userDetailsMapper());
        provider.setContextEnvironmentProperties(contextEnvironment());
        provider.setSearchFilter(this.ldapFilter);
        return provider;
    }
 
    @Bean
    public KerberosServiceAuthenticationProvider kerberosServiceAuthenticationProvider() throws Exception {
        KerberosServiceAuthenticationProvider provider = new KerberosServiceAuthenticationProvider();
        provider.setTicketValidator(ticketValidator());
        provider.setUserDetailsService(ldapUserDetailsService());
        provider.afterPropertiesSet();
        return provider;
    }
    
    @Bean
    public SpnegoAuthenticationProcessingFilter spnegoAuthenticationProcessingFilter(AuthenticationManager authenticationManager) throws ServletException {
        SpnegoAuthenticationProcessingFilter filter = new SpnegoAuthenticationProcessingFilter();
        filter.setSuccessHandler(successHandler);
        filter.setAuthenticationManager(authenticationManager);
        filter.afterPropertiesSet();
        return filter;
    }
    
    @Bean
    public UsernamePasswordAuthenticationFilter usernamePasswordAuthenticationFilter(AuthenticationManager authenticationManager) {
        UsernamePasswordAuthenticationFilter filter = new UsernamePasswordAuthenticationFilter();
        filter.setAuthenticationSuccessHandler(successHandler);
        filter.setAuthenticationManager(authenticationManager);
        filter.afterPropertiesSet();
        return filter;
    }
    
    @Bean
    public SpnegoEntryPoint spnegoEntryPoint() {
        return new SpnegoEntryPoint("/login");
    }
    
    @Bean
    public SunJaasKerberosClient kerberosClient() {
        return new SunJaasKerberosClient();
    }
    
    @Bean
    public SunJaasKerberosTicketValidator ticketValidator() throws Exception {
        SunJaasKerberosTicketValidator ticketValidator = new SunJaasKerberosTicketValidator();
        ticketValidator.setServicePrincipal(this.servicePrincipal);
        ticketValidator.setKeyTabLocation(new FileSystemResource(this.keytabLocation));
        ticketValidator.afterPropertiesSet();
        return ticketValidator;
    }
    
    @Bean
    public LdapUserDetailsService ldapUserDetailsService() throws Exception {
        FilterBasedLdapUserSearch userSearch = new FilterBasedLdapUserSearch(this.ldapSearchBase, this.spnegoFilter, krbContextSource());
        LdapUserDetailsService service = new LdapUserDetailsService(userSearch, authoritiesPopulator());
        service.setUserDetailsMapper(userDetailsMapper());
        return service;
    }
 
    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }
    
    @Bean
    public KerberosLdapContextSource krbContextSource() throws Exception {
        KerberosLdapContextSource contextSource = new KerberosLdapContextSource(this.ldapUrl);
        contextSource.setLoginConfig(loginConfig());
        contextSource.setBaseEnvironmentProperties(contextEnvironment());
        contextSource.afterPropertiesSet();
        return contextSource;
    }
    
    @Bean
    public SunJaasKrb5LoginConfig loginConfig() throws Exception {
        SunJaasKrb5LoginConfig loginConfig = new SunJaasKrb5LoginConfig();
        loginConfig.setServicePrincipal(this.servicePrincipal);
        loginConfig.setKeyTabLocation(new FileSystemResource(this.keytabLocation));
        loginConfig.setIsInitiator(true);
        loginConfig.afterPropertiesSet();
        return loginConfig;
    }
    
    @Bean
    public GlobalSunJaasKerberosConfig globalConfig() throws Exception {
        GlobalSunJaasKerberosConfig globalConfig = new GlobalSunJaasKerberosConfig();
        globalConfig.setKrbConfLocation(this.krbConfLocation);
        globalConfig.afterPropertiesSet();
        return globalConfig;
    }
    
    @Bean
    public CustomUserDetailsMapper userDetailsMapper() {
        return new CustomUserDetailsMapper();
    }
    
    @Bean
    public DefaultLdapAuthoritiesPopulator authoritiesPopulator() throws Exception {
        DefaultLdapAuthoritiesPopulator authoritiesPopulator = new DefaultLdapAuthoritiesPopulator(krbContextSource(), this.ldapSearchBase);
        authoritiesPopulator.setConvertToUpperCase(false);
        authoritiesPopulator.setRolePrefix("");
        return authoritiesPopulator;
    }
    
    @Bean
    public Map<String,Object> contextEnvironment() {
        Hashtable<String, Object> envProps = new Hashtable<>();
        envProps.put("java.naming.ldap.attributes.binary","objectGUID");
        return envProps;
    }
}

@Getter @Setter
@Document( collection = "users" )
@ToString( exclude = {"position"} )
public class User {
 
    private String username;
        
    private String firstName;
    
    private String lastName;
    
    private String mail;
    
    private Boolean isEnabled;
    
    private String objectGuid;
 
    private String authority;
    
    private Position position;
    
    public String getFullName() {
        return this.firstName + " " + this.lastName;
    }
}

@Override
    public void onAuthenticationSuccess(HttpServletRequest request, 
                                        HttpServletResponse response,
                                        Authentication authentication) throws IOException, ServletException {
        if ( authentication != null && authentication.isAuthenticated() ) {
            CustomUserDetailsImpl details = (CustomUserDetailsImpl) authentication.getPrincipal();
            User user = userService.readUser( details.getUsername() );
            if( user == null || !user.equals( details.getUser() ) ) {
                user = userService.createDocument( details.getUser() );
            }
        }
        super.onAuthenticationSuccess(request, response, authentication);
    }