code: protected Set<GrantedAuthority> getAuthorities(String username) throws AuthenticationException {
  
      P principal = retrievePrincipal(username);
      if (principal == null) {
        LOG.warn("Failed to retrieve user for login {}.", username);
        throw new UsernameNotFoundException(username);
      }
  
      // determine granted authorities for spring-security...
      Set<GrantedAuthority> authorities = new HashSet<>();
      Collection<String> accessControlIds = this.principalAccessControlProvider.getAccessControlIds(principal);
      Set<AccessControl> accessControlSet = new HashSet<>();
      for (String id : accessControlIds) {
        boolean success = this.accessControlProvider.collectAccessControls(id, accessControlSet);
        if (!success) {
          LOG.warn("Undefined access control {}.", id);
          // authorities.add(new SimpleGrantedAuthority(id));
        }
      }
      for (AccessControl accessControl : accessControlSet) {
        authorities.add(new AccessControlGrantedAuthority(accessControl));
      }
      return authorities;
    }
docs: Returns the {@link GrantedAuthority}s of the provided user identified by the {@code username}.
  
  @param username the name of the user
  @return the associated {@link GrantedAuthority}s
  @throws AuthenticationException if not principal is retrievable for the given {@code username}