EDIT

        try {

            Transaction txState = newSession.beginTransaction();

            Query userQuery = newSession.createQuery("select u from User u join u.grantedAuthorities ga where ga.authority in (:authorities)");

            userQuery.setParameterList("authorities", authorityStrings);

            List<User> users = userQuery.list();

            for(User user : users){

                List<GrantedAuthority> deleteFromUser = user.getGrantedAuthorities().stream().filter(

                            ga -> authorityStrings.contains(ga.getAuthority())

                        )

                        .collect(Collectors.toList());

                user.getGrantedAuthorities().removeAll(deleteFromUser);

            }

            Query groupQuery = newSession.createQuery("select g from Group g join g.grantedAuthorities ga where ga.authority in (:authorities)");

            groupQuery.setParameterList("authorities", authorityStrings);

            List<Group> groups = groupQuery.list();

            for(Group group : groups){

                List<GrantedAuthority> deleteFromUser = group.getGrantedAuthorities().stream().filter(

                            ga -> authorityStrings.contains(ga.getAuthority())

                        )

                        .collect(Collectors.toList());

                group.getGrantedAuthorities().removeAll(deleteFromUser);

            }

            newSession.flush();

            txState.commit();

        } finally {

            // no catching of the exception, if the session flush fails the transaction should roll back and

            // the exception needs to bubble up so that the transaction in enclosing session is also rolled back

            newSession.close();