{"action":"created","issue":{"url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5096","repository_url":"https://api.github.com/repos/spring-projects/spring-boot","labels_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5096/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5096/comments","events_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5096/events","html_url":"https://github.com/spring-projects/spring-boot/issues/5096","id":131755623,"number":5096,"title":"#oauth2.hasScope and Resource Server","user":{"login":"silent-box","id":12157601,"avatar_url":"https://avatars.githubusercontent.com/u/12157601?v=3","gravatar_id":"","url":"https://api.github.com/users/silent-box","html_url":"https://github.com/silent-box","followers_url":"https://api.github.com/users/silent-box/followers","following_url":"https://api.github.com/users/silent-box/following{/other_user}","gists_url":"https://api.github.com/users/silent-box/gists{/gist_id}","starred_url":"https://api.github.com/users/silent-box/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/silent-box/subscriptions","organizations_url":"https://api.github.com/users/silent-box/orgs","repos_url":"https://api.github.com/users/silent-box/repos","events_url":"https://api.github.com/users/silent-box/events{/privacy}","received_events_url":"https://api.github.com/users/silent-box/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/spring-projects/spring-boot/labels/waiting-for-triage","name":"waiting-for-triage","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2016-02-05T21:12:23Z","updated_at":"2016-03-14T08:59:46Z","closed_at":null,"body":"Hello,\r\n\r\nI  have multiple Resource servers that share an Authorization server, everything works pretty good.\r\n\r\nNow I'm trying to protect controllers in Resource servers with @PreAuthorize(\"#oauth2.hasScope('scope')\") annotation, but it just rejects every call, even with the right scope.\r\n\r\nHere is an example Resource server code:\r\n\r\n```java\r\n@SpringBootApplication\r\n@EnableResourceServer\r\n@EnableWebSecurity\r\n@EnableGlobalMethodSecurity(prePostEnabled = true)\r\npublic class MyResourceApplication {\r\n\r\n\tpublic static void main(String[] args) {\r\n\t\tSpringApplication.run(MyResourceApplication.class, args);\r\n\t}\r\n}\r\n```\r\n```java\r\n@RestController\r\npublic class MyController {\r\n\r\n\t@PreAuthorize(\"#oauth2.hasScope('ui')\")\r\n\t@RequestMapping(value = \"/\", method = RequestMethod.GET)\r\n\tpublic String hello(Principal principal) {\r\n\t\treturn \"hello, \" + principal.getName();\r\n\t}\r\n}\r\n```\r\n\r\nAuth-server have the user-info-uri controller, which returns Principal object.\r\n\r\nI'm making request from Browser('ui' scope) to Account-service. \r\nAccount-service invokes Auth-server and receives the following response:\r\n\r\n<img width=\"748\" alt=\"screen shot 2016-02-04 at 00 38 54\" src=\"https://cloud.githubusercontent.com/assets/12157601/12797936/b93c4a68-cad7-11e5-8b30-958a8a6e0426.png\">\r\n\r\nI can see this in my logs:\r\n```\r\nPreviously Authenticated: org.springframework.security.oauth2.provider.OAuth2Authentication@48cce0de: Principal: account-service; Credentials: [PROTECTED]; Authenticated: true; Details: remoteAddress=127.0.0.1, tokenType=BearertokenValue=<TOKEN>; Not granted any authorities\r\nVoter: org.springframework.security.access.prepost.PreInvocationAuthorizationAdviceVoter@4cd3541a, returned: -1\r\nVoter: org.springframework.security.access.vote.RoleVoter@7e09868e, returned: 0\r\nVoter: org.springframework.security.access.vote.AuthenticatedVoter@23c38124, returned: 0\r\n```\r\n\r\nSo, UsernamePasswordAuthenticationToken contains target scope somewhere in details, but OAuth2Authentication object has no scopes and OAuth2SecurityExpressionMethods.hasScope doesn't work.\r\n\r\nMy question is, why 'ui' scope does not appear in OAuth2Authentication object after Resource-Auth servers talking? What am i doing wrong?\r\n\r\nThank you.\r\n"},"comment":{"url":"https://api.github.com/repos/spring-projects/spring-boot/issues/comments/196211273","html_url":"https://github.com/spring-projects/spring-boot/issues/5096#issuecomment-196211273","issue_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5096","id":196211273,"user":{"login":"dsyer","id":124075,"avatar_url":"https://avatars.githubusercontent.com/u/124075?v=3","gravatar_id":"","url":"https://api.github.com/users/dsyer","html_url":"https://github.com/dsyer","followers_url":"https://api.github.com/users/dsyer/followers","following_url":"https://api.github.com/users/dsyer/following{/other_user}","gists_url":"https://api.github.com/users/dsyer/gists{/gist_id}","starred_url":"https://api.github.com/users/dsyer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dsyer/subscriptions","organizations_url":"https://api.github.com/users/dsyer/orgs","repos_url":"https://api.github.com/users/dsyer/repos","events_url":"https://api.github.com/users/dsyer/events{/privacy}","received_events_url":"https://api.github.com/users/dsyer/received_events","type":"User","site_admin":false},"created_at":"2016-03-14T08:59:46Z","updated_at":"2016-03-14T08:59:46Z","body":"You are relying on the `UserInfoTokenServices` from Spring Boot for the token information (including scopes), but it is only designed to return user details (not OAuth2 stuff like scope) by default. If you want to change the behaviour you can provide your own implementation, or fix the `UserController` to extract more information from the details (which as you have shown are retained and available if you need them). If you think something is missing from the default implementation of `UserInfoTokenServices` please raise a ticket with Spring Boot for now, since that's where the code is at the minute."}}