title: Spring Boot Security Configuration OAuthSSO and ResourceServer
body: <p>I have a WebApp consisting of 2 parts. 
  One is with a frontend (Vaadin) where i want the user to be Logged-In via OAuth2. I then Check whether the user has a certain Role or not. --> If user opens the URL he shall be redirected to the OAuthLogin automatically. --> This is working with the @EnableOAuthSso.</p>
  
  <p>Second Part is the REST-API of the Application, which is found by anything under /api/*. fE. /api/devices
  should give me a list if the Get-Request has a valid Bearer-Token. If the GET Request has no Bearer-Token or a wrong Role (Authority) if want to get a 403.</p>
  
  <p>Now this is my configuration: </p>
  
  <pre><code>@Configuration
  @EnableOAuth2Sso
  public class ProdWebSecurityConfiguration extends WebSecurityConfigurerAdapter {
      private static final String ADMIN_ROLE= "role.global.admin";
      private static final String READ_API_ROLE= "role.base.read.api";
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.csrf().disable();
          http.authorizeRequests()
                  .antMatchers("/login**", "/error**").permitAll()
  
                  .antMatchers("/*").hasAuthority(ADMIN_ROLE)
                  .antMatchers("/api/**").hasAnyAuthority(ADMIN_ROLE, READ_API_ROLE)
                  .and().logout().permitAll().logoutSuccessUrl(rootAuthUri + "/connect/endsession")
          ;
      }
  </code></pre>
  
  <p>Now when opening for example /manageDevices in the Browser i get forced to be logged in via Auth-Code-Flow and everything works like as expected.</p>
  
  <p>When i try to open /api/devices i also get forced to be logged in via Oauth. Even when i do send Http-Header with Authentication: Bearer xxxxx. Somehow it always forces me to the Login-Screen from my OAuth login.</p>
  
  <p>application.properties these lines are defined:</p>
  
  <pre><code>base.rootauthuri=https://oauth2.mypage.ch
  security.oauth2.client.clientId=client.base.parameters
  security.oauth2.client.clientSecret=secret
  security.oauth2.client.accessTokenUri=${base.rootauthuri}/connect/token
  security.oauth2.client.userAuthorizationUri=${base.rootauthuri}/connect/authorize
  security.oauth2.client.scope=openid,scope.base.parameters,role,offline_access
  security.oauth2.client.clientAuthenticationScheme=form
  security.oauth2.resource.userInfoUri=${base.rootauthuri}/connect/userinfo
  </code></pre>
  
  <p>How can i force everything under /api/* to not redirect to the AuthenticationForm but respond with 403 if no Bearer Token is sent. How can i make it to Check whether the Bearer-Token has Role "READ_API_ROLE" also.</p>