How should I map the 2 following default ACEGI tables? Apparently I need a primary key for the authorities table, but am discouraged in the documentation from using composite ids for anything other than legacy code.

So what's the best practice for this very common situation? Is it appropriate to use a composite id for all fields in the authorities table even though this isn't legacy code? I think it's fairly normal for 1 table have a one-to-many mapping with fields from another table where that other table (authorities in this case) has no need for an ID. Should I add an ID to the authorities table?

CREATE TABLE users (
username VARCHAR(50) NOT NULL PRIMARY KEY,
password VARCHAR(50) NOT NULL,
enabled BIT NOT NULL
);

CREATE TABLE authorities (
username VARCHAR(50) NOT NULL,
authority VARCHAR(50) NOT NULL
);

I just tried to do the composite-id method and I get an error. Apparently I can't use one of the fields specified in the composite-id for anything other than the composite-id. So this didn't work:

I had tried commenting out the authority property, but the many-to-one relationship uses the same column as in the first key-property. If I take that out, then I don't get my many-to-one relationship.