public static ArrayList<GrantedAuthority> populateAuthorities(JMXConnector jmxc) {
    ObjectName name;
    ArrayList<GrantedAuthority> authorities = new ArrayList<>();
    try {
      name = new ObjectName(PulseConstants.OBJECT_NAME_ACCESSCONTROL_MBEAN);
      MBeanServerConnection mbeanServer = jmxc.getMBeanServerConnection();

      for (String role : PulseConstants.PULSE_ROLES) {
        Object[] params = role.split(":");
        String[] signature =
            new String[] {String.class.getCanonicalName(), String.class.getCanonicalName()};
        boolean result = (Boolean) mbeanServer.invoke(name, "authorize", params, signature);
        if (result) {
          authorities.add(new SimpleGrantedAuthority("ROLE_" + role));
        }
      }
    } catch (Exception e) {
      throw new RuntimeException(e.getMessage(), e);
    }

    return authorities;

  }
Spring security authentication object for GemFire
<p>
To use GemFire Integrated Security Model set Spring Application Profile to
pulse.authentication.gemfire
<p>
1. Authentication : 1.a GemFire profile creates JMX connection with given credentials at the
login time. 1.b Successful connect is considered as Successful Authentication for Pulse WebApp
<p>
2. Authorization : 2.a Using newly created authenticated connection AccessControlMXBean is called
to get authentication levels. See @See {@link #populateAuthorities(JMXConnector)}. This sets
Spring Security Authorities 2.b DataBrowser end-points are required to be authorized against
Spring Granted Authority

@since GemFire version 9.0
geode-pulse/src/main/java/org/apache/geode/tools/pulse/internal/security/GemFireAuthentication.java