title: OAuth2 retrieve client_id in CustomUserDetailsService
body: <p>I created a Spring Boot application configured to be my Authorization Server oauth2, have other applications Spring boot that are configured as Client oauth2.</p>
  
  <p>In my server I implemented CustomUserDetailsService I would like in the method loadUserByUsername to retrieve the client_id of the project that is being authenticated.</p>
  
  <p>I do not know if this is possible, but I would like to recover this to validate the client_id because I have several applications that use the same authorizer and by client_id I will check if the user has access to that application.</p>
  
  <p>Does anyone know how to do this?</p>
  
  <p><strong>application.yml</strong>  client</p>
  
  <pre><code>security:
    basic:
      enabled: false
    oauth2:
      sso:
        loginPath: /login
      client:
        clientId: web_app
        clientSecret: secret
        accessTokenUri: https://localhost/uaa/oauth/token
        userAuthorizationUri: https://localhost/uaa/oauth/authorize
  </code></pre>
  
  <p><strong>CustomUserDetailsService</strong></p>
  
  <pre><code>public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
          try {
  
              //I would like to recover the client_id in this location
  
              User domainUser = userRepository.findByUsername(username);
  </code></pre>
  
  <p>Have to validate any server because I have a single login for all applications:</p>
  
  <p>Auth server authentication is done by user and password and application.</p>
  
  <p>Imagine that you are logging into "<a href="https://accounts.google.com/" rel="nofollow noreferrer">https://accounts.google.com/</a>" google checks user and password and displays your account with shortcuts to "PRODUCTS".</p>
  
  <p>Now if you access "<a href="https://mail.google.com" rel="nofollow noreferrer">https://mail.google.com</a>" google checks user and password and displays the gmail interface. In my case it can come from the URL <a href="https://application.domain.com" rel="nofollow noreferrer">https://application.domain.com</a>, <a href="https://application2.domain.com" rel="nofollow noreferrer">https://application2.domain.com</a>, <a href="https://application3.domain.com" rel="nofollow noreferrer">https://application3.domain.com</a> or "<a href="https://accounts.domain.com" rel="nofollow noreferrer">https://accounts.domain.com</a>.</p>
  
  <p>All URLs it uses user and password, but it can have access to application1 or all or none.</p>
  
  <p>I would like to do the server side, because it returns the access token only for applications that have permission (credit). If the user and password are correct it does not mean that the user has access to all the applications.</p>