{"action":"closed","issue":{"url":"https://api.github.com/repos/spring-projects/spring-security-oauth/issues/699","repository_url":"https://api.github.com/repos/spring-projects/spring-security-oauth","labels_url":"https://api.github.com/repos/spring-projects/spring-security-oauth/issues/699/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-security-oauth/issues/699/comments","events_url":"https://api.github.com/repos/spring-projects/spring-security-oauth/issues/699/events","html_url":"https://github.com/spring-projects/spring-security-oauth/issues/699","id":133984950,"number":699,"title":"Q: ResourceServer with custom roles/permissions.","user":{"login":"greyfairer","id":1299313,"avatar_url":"https://avatars.githubusercontent.com/u/1299313?v=3","gravatar_id":"","url":"https://api.github.com/users/greyfairer","html_url":"https://github.com/greyfairer","followers_url":"https://api.github.com/users/greyfairer/followers","following_url":"https://api.github.com/users/greyfairer/following{/other_user}","gists_url":"https://api.github.com/users/greyfairer/gists{/gist_id}","starred_url":"https://api.github.com/users/greyfairer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/greyfairer/subscriptions","organizations_url":"https://api.github.com/users/greyfairer/orgs","repos_url":"https://api.github.com/users/greyfairer/repos","events_url":"https://api.github.com/users/greyfairer/events{/privacy}","received_events_url":"https://api.github.com/users/greyfairer/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-02-16T13:42:55Z","updated_at":"2016-03-22T16:04:24Z","closed_at":"2016-03-22T16:04:24Z","body":"Hi,\r\n\r\nWe have an application with controllers that need to be protected per user, such as:\r\n`@PreAuthorize(\"hasRole('ROLE_SITE_MANAGEMENT') and hasPermission(#productId, 'PRODUCT', 'WRITE')\")`\r\n\r\nIn the current application, we have `@EnableGlobalMethodSecurity(prePostEnabled = true)` activated. We have a `CustomAuthenticationProvider` that acts as both `AuthenticationProvider `and `UserDetailsService`, and puts roles and permission attributes in the Authentication objects, and a `CustomPermissionEvaluator `that can check the permission attributes.\r\n\r\nNow we want to switch to OAuth2, so we make the application a ResourceServer by using `@EnableResourceServer`, and authenticate with JWT tokens obtained from an external authorization server (a Spring boot application with `@EnableAuthorizationServer`). The authorization server puts the username in the JWT token, plus some OAuth2 attributes, so the `SecurityContextHolder.getContext().getAuthentication()` is now a `OAuth2Authentication `object.\r\n\r\nThe `@PreAuthorize(...)` is now validated for the `OAuth2Authentication `object, but how can I add custom roles into it that are not provided in the JWT token? Can I wire a `UserDetailsService `in the `OAuth2AuthenticationManager`?\r\n\r\nMy `CustomPermissionEvaluator` seems to be picked up by the OAuth2MethodSecurityConfiguration, but it doesn't see the permission attributes, so it cannot really do much, unless it would read the permission attributes based on the login name itself."}}