{"action":"created","issue":{"url":"https://api.github.com/repos/auth0-samples/auth0-spring-security-api-sample/issues/1","repository_url":"https://api.github.com/repos/auth0-samples/auth0-spring-security-api-sample","labels_url":"https://api.github.com/repos/auth0-samples/auth0-spring-security-api-sample/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/auth0-samples/auth0-spring-security-api-sample/issues/1/comments","events_url":"https://api.github.com/repos/auth0-samples/auth0-spring-security-api-sample/issues/1/events","html_url":"https://github.com/auth0-samples/auth0-spring-security-api-sample/issues/1","id":160260668,"number":1,"title":"org.springframework.security.access.AccessDeniedException: Access is denied (probably roles are not parsed properly)","user":{"login":"DanailMinchev","id":7883702,"avatar_url":"https://avatars.githubusercontent.com/u/7883702?v=3","gravatar_id":"","url":"https://api.github.com/users/DanailMinchev","html_url":"https://github.com/DanailMinchev","followers_url":"https://api.github.com/users/DanailMinchev/followers","following_url":"https://api.github.com/users/DanailMinchev/following{/other_user}","gists_url":"https://api.github.com/users/DanailMinchev/gists{/gist_id}","starred_url":"https://api.github.com/users/DanailMinchev/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DanailMinchev/subscriptions","organizations_url":"https://api.github.com/users/DanailMinchev/orgs","repos_url":"https://api.github.com/users/DanailMinchev/repos","events_url":"https://api.github.com/users/DanailMinchev/events{/privacy}","received_events_url":"https://api.github.com/users/DanailMinchev/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2016-06-14T19:12:03Z","updated_at":"2016-09-22T15:21:51Z","closed_at":"2016-06-18T13:41:48Z","body":"Hi @arcseldon ,\r\n\r\nI have tried the example and the authentication is working only for `http://localhost:3001/secured/ping` endpoint.\r\n\r\nThe endpoints:\r\n\r\n- `http://localhost:3001/secured/username`\r\n- `http://localhost:3001/secured/post`\r\n\r\nthrow `org.springframework.security.access.AccessDeniedException: Access is denied` exception and in the response (example):\r\n`{\"timestamp\":1465930478547,\"status\":403,\"error\":\"Forbidden\",\"message\":\"Access is denied\",\"path\":\"/secured/username\"}`\r\n\r\nWhat I did is: I changed `com.auth0.example.SecuredPingController#securedPing` method and added `Principal principal` parameter to see if my JWT has been generated fine and is accepted.\r\nPlease find attached screenshot and see the contents of the `principal` object:\r\n![principal-debug](https://cloud.githubusercontent.com/assets/7883702/16055768/75d319dc-326a-11e6-827c-fce3511c9778.png)\r\n\r\nI think the problem is in authorization part - probably the roles are not parsed.\r\n\r\nDetails on configuration and steps to reproduce:\r\n\r\n1). I have generated JWT using this request:\r\n```\r\ncurl -X POST -H \"Content-Type: application/json\" -d '{\"client_id\": \"client_id_here\", \"username\": \"user@example.com\", \"password\": \"password_here\", \"connection\": \"Username-Password-Authentication\", \"grant_type\": \"password\", \"scope\": \"openid offline_access\", \"device\": \"DeviceTest1\"}' https://username.eu.auth0.com/oauth/ro\r\n```\r\n\r\n2). Tested `http://localhost:3001/ping` - OK\r\n```\r\ncurl -X GET -H \"Content-Type: application/json\" -H \"Cache-Control: no-cache\" \"http://localhost:3001/ping\"\r\n```\r\nResult:\r\n```\r\nAll good. You don't need to be authenticated to call this\r\n```\r\n\r\n3). Tested `http://localhost:3001/secured/ping` - OK\r\n```\r\ncurl -X GET -H \"Authorization: Bearer ID_TOKEN_FROM_POINT_1\" -H \"Content-Type: application/json\" -H \"Cache-Control: no-cache\" \"http://localhost:3001/secured/ping\"\r\n```\r\nResult:\r\n```\r\nAll good. You only get this message if you're authenticated\r\n```\r\n\r\n4). Tested `http://localhost:3001/secured/username` - **ERROR**\r\n```\r\ncurl -X GET -H \"Authorization: Bearer ID_TOKEN_FROM_POINT_1\" -H \"Content-Type: application/json\" -H \"Cache-Control: no-cache\" \"http://localhost:3001/secured/username\"\r\n```\r\nResult:\r\n```\r\n{\"timestamp\":1465931176377,\"status\":403,\"error\":\"Forbidden\",\"message\":\"Access is denied\",\"path\":\"/secured/username\"}\r\n```\r\n\r\n------------\r\n\r\nAuth0 Dashboard screenshots:\r\n\r\nThe user's Metadata screenshot:\r\n![user details - metadata](https://cloud.githubusercontent.com/assets/7883702/16056101/e9f1e37e-326b-11e6-83f2-1bd03923d7a7.png)\r\n\r\nThe rules:\r\n![rules - index](https://cloud.githubusercontent.com/assets/7883702/16056164/2d08ab5c-326c-11e6-8e4c-1890bae90508.png)\r\n![rules - edit](https://cloud.githubusercontent.com/assets/7883702/16056169/31e2b1ea-326c-11e6-8e7f-4570022b8a82.png)\r\n"},"comment":{"url":"https://api.github.com/repos/auth0-samples/auth0-spring-security-api-sample/issues/comments/248935776","html_url":"https://github.com/auth0-samples/auth0-spring-security-api-sample/issues/1#issuecomment-248935776","issue_url":"https://api.github.com/repos/auth0-samples/auth0-spring-security-api-sample/issues/1","id":248935776,"user":{"login":"abobwhite","id":3910329,"avatar_url":"https://avatars.githubusercontent.com/u/3910329?v=3","gravatar_id":"","url":"https://api.github.com/users/abobwhite","html_url":"https://github.com/abobwhite","followers_url":"https://api.github.com/users/abobwhite/followers","following_url":"https://api.github.com/users/abobwhite/following{/other_user}","gists_url":"https://api.github.com/users/abobwhite/gists{/gist_id}","starred_url":"https://api.github.com/users/abobwhite/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/abobwhite/subscriptions","organizations_url":"https://api.github.com/users/abobwhite/orgs","repos_url":"https://api.github.com/users/abobwhite/repos","events_url":"https://api.github.com/users/abobwhite/events{/privacy}","received_events_url":"https://api.github.com/users/abobwhite/received_events","type":"User","site_admin":false},"created_at":"2016-09-22T15:21:51Z","updated_at":"2016-09-22T15:21:51Z","body":"Thanks @arcseldon ! I was having this problem for days and could not figure out the problem. Was adding ```roles``` to ```scope``` documented somewhere? That ended up being my only problem."}}
{"actor":{"display_login":"abobwhite"}}