Add configurable role case sensitivity

[sdelamo]

Summary

• Adds micronaut.security.roles-case-sensitive, defaulting to true so existing role checks remain case-sensitive.
• Makes micronaut.security.roles-case-sensitive=false opt the default DefaultRolesFinder into case-insensitive role comparison for @Secured, intercept URL maps, and SecurityService.hasRole.
• Preserves the existing DefaultRolesFinder(TokenConfiguration) constructor behavior and adds focused tests plus security configuration guide documentation.

Verification

• ./gradlew --no-build-cache :micronaut-security:compileJava :micronaut-security:spotlessCheck
• ./gradlew :micronaut-security:test --tests 'io.micronaut.security.token.DefaultRolesFinderSpec' --tests 'io.micronaut.security.config.SecurityConfigurationPropertiesSpec' --tests 'io.micronaut.security.authorization.SecuredRolesCaseSensitiveSpec' --tests 'io.micronaut.security.authorization.SecuredRolesCaseInsensitiveConfigurationSpec' --tests 'io.micronaut.security.rules.ConfigurationInterceptUrlMapRuleSpec'

Focused test result: 28 tests, 28 successes, 0 failures, 0 skipped.

Release Metadata

• Target branch: 5.1.x
• Release target: 5.1.0
• SemVer impact: minor, backward-compatible opt-in enhancement
• Selected Micronaut organization project: 5.1.0 Release
• PR-visible assets: not applicable; no rendered output, image, PDF, archive, log, or generated binary artifact changed.

Closes #327.

---

✨ This message was AI-generated using gpt-5

[Copilot]

Pull request overview

Adds a new security configuration toggle to control whether role comparisons are case-sensitive, defaulting to current behavior (case-sensitive) while enabling an opt-in case-insensitive mode for authorization checks.

Changes:

• Introduces micronaut.security.roles-case-sensitive (default true) via SecurityConfiguration/SecurityConfigurationProperties.
• Updates DefaultRolesFinder to optionally perform case-insensitive role matching (affecting @Secured, intercept URL map rules, and SecurityService.hasRole).
• Adds focused Spock tests and updates the security configuration guide documentation.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/main/docs/guide/securityConfiguration.adoc	Documents the new micronaut.security.roles-case-sensitive toggle and its effect on role comparisons.
security/src/main/java/io/micronaut/security/config/SecurityConfiguration.java	Adds a new isRolesCaseSensitive() configuration API (default true).
security/src/main/java/io/micronaut/security/config/SecurityConfigurationProperties.java	Binds the new rolesCaseSensitive property with default true.
security/src/main/java/io/micronaut/security/token/DefaultRolesFinder.java	Uses the new configuration to switch between case-sensitive vs case-insensitive role matching.
security/src/test/groovy/io/micronaut/security/config/SecurityConfigurationPropertiesSpec.groovy	Verifies default and configured values for rolesCaseSensitive.
security/src/test/groovy/io/micronaut/security/rules/ConfigurationInterceptUrlMapRuleSpec.groovy	Extends role comparison tests and validates case-insensitive behavior for intercept URL map rules.
security/src/test/groovy/io/micronaut/security/authorization/SecuredRolesCaseInsensitiveConfigurationSpec.groovy	Adds an embedded-server spec validating case-insensitive @Secured and SecurityService.hasRole.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud