title: spring-security: authorization without authentication
body: <p>I'm trying to integrate Spring Security in my web application. It seems pretty easy to do as long as you integrate the whole process of authentication and authorization. </p>
  
  <p>However, both authentication and authorization seem so coupled that it's being very time-consuming for me to understand how I could split these processes, and get authentication independently of authorization. </p>
  
  <p>The authentication process is external to our system  (based on single sign-on) and this cannot be modified. Nevertheless, once the user succeeds this process, it's loaded in the session, including roles. </p>
  
  <p>What we are trying to achieve is to make use of this information for the authorization process of Spring Security, that's to say, to force it to get the roles from the user session instead of picking it up through the authentication-provider.</p>
  
  <p>Is there any way to achieve this? </p>