Refactor authoritiesClaimName to use Collection and remove null checks

- Change authoritiesClaimName field to Collection<String> authoritiesClaimNames
- Add isExplicitlySet flag to preserve original behavior
- Remove null checks by ensuring authoritiesClaimNames is always initialized
- Maintain backward compatibility for explicit vs default claim name handling
- Delete unnecessary test code related to previous null-checking logic

Author: chanbinme

oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/authentication/JwtGrantedAuthoritiesConverter.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2022 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -53,7 +53,9 @@ public final class JwtGrantedAuthoritiesConverter implements Converter<Jwt, Coll
 
 	private String authoritiesClaimDelimiter = DEFAULT_AUTHORITIES_CLAIM_DELIMITER;
 
-	private String authoritiesClaimName;
+	private Collection<String> authoritiesClaimNames = WELL_KNOWN_AUTHORITIES_CLAIM_NAMES;
+
+	private boolean isExplicitlySet = false;
 
 	/**
 	 * Extract {@link GrantedAuthority}s from the given {@link Jwt}.
@@ -102,14 +104,15 @@ public void setAuthoritiesClaimDelimiter(String authoritiesClaimDelimiter) {
 	 */
 	public void setAuthoritiesClaimName(String authoritiesClaimName) {
 		Assert.hasText(authoritiesClaimName, "authoritiesClaimName cannot be empty");
-		this.authoritiesClaimName = authoritiesClaimName;
+		this.authoritiesClaimNames = Collections.singletonList(authoritiesClaimName);
+		this.isExplicitlySet = true;
 	}
 
 	private String getAuthoritiesClaimName(Jwt jwt) {
-		if (StringUtils.hasText(this.authoritiesClaimName)) {
-			return this.authoritiesClaimName;
+		if (this.isExplicitlySet) {
+			return this.authoritiesClaimNames.iterator().next();
 		}
-		for (String claimName : WELL_KNOWN_AUTHORITIES_CLAIM_NAMES) {
+		for (String claimName : this.authoritiesClaimNames) {
 			if (jwt.hasClaim(claimName)) {
 				return claimName;
 			}

oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/authentication/JwtGrantedAuthoritiesConverterTests.java

@@ -21,15 +21,11 @@
 import java.util.Collections;
 
 import org.junit.jupiter.api.Test;
-import org.junit.jupiter.params.ParameterizedTest;
-import org.junit.jupiter.params.provider.NullSource;
-import org.junit.jupiter.params.provider.ValueSource;
 
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.oauth2.jwt.Jwt;
 import org.springframework.security.oauth2.jwt.TestJwts;
-import org.springframework.test.util.ReflectionTestUtils;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
@@ -274,21 +270,4 @@ public void convertWithCustomAuthoritiesSplitRegexWhenTokenHasScopeAttributeThen
 				new SimpleGrantedAuthority("SCOPE_message:write"));
 	}
 
-	@ParameterizedTest
-	@ValueSource(strings = { "", "   " })
-	@NullSource
-	public void convertWhenAuthoritiesClaimNameIsBlankThenUsesWellKnownClaims(String invalidClaimName)
-			throws Exception {
-		// @formatter:off
-		Jwt jwt = TestJwts.jwt()
-				.claim("scope", "message:read message:write")
-				.build();
-		// @formatter:on
-		JwtGrantedAuthoritiesConverter jwtGrantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
-		ReflectionTestUtils.setField(jwtGrantedAuthoritiesConverter, "authoritiesClaimName", invalidClaimName);
-		Collection<GrantedAuthority> authorities = jwtGrantedAuthoritiesConverter.convert(jwt);
-		assertThat(authorities).containsExactly(new SimpleGrantedAuthority("SCOPE_message:read"),
-				new SimpleGrantedAuthority("SCOPE_message:write"));
-	}
-
 }