title: Spring Security 5 populating authorities based on JWT claims
body: <p>As I see Spring Security OAuth2.x project was moved to Spring Security 5.2.x. I try to implement authorization and resource server in new way. Everythin is working correctly except one thing - <code>@PreAuthorize</code> annotation. When I try to use this with standard <code>@PreAuthorize("hasRole('ROLE_USER')")</code> I always get forbidden. What I see is that the <code>Principal</code> object which is type of <code>org.springframework.security.oauth2.jwt.Jwt</code> is not able to resolve authorities and I have no idea why.</p>
  
  <pre><code>org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken@44915f5f: Principal: org.springframework.security.oauth2.jwt.Jwt@2cfdbd3; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@ffffa64e: RemoteIpAddress: 172.19.0.1; SessionId: null; Granted Authorities: SCOPE_read, SCOPE_write
  </code></pre>
  
  <p>And claims after casting it to <code>Jwt</code></p>
  
  <pre><code>{user_name=user, scope=["read","write"], exp=2019-12-18T13:19:29Z, iat=2019-12-18T13:19:28Z, authorities=["ROLE_USER","READ_ONLY"], client_id=sampleClientId}
  </code></pre>
  
  <p>Security Server Configuration</p>
  
  <pre><code>@Configuration
  @EnableAuthorizationServer
  public class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {
  
    @Autowired
    private DataSource dataSource;
  
    @Autowired
    private AuthenticationManager authenticationManager;
  
    @Bean
    public KeyPair keyPair() {
      ClassPathResource ksFile = new ClassPathResource("mytest.jks");
      KeyStoreKeyFactory keyStoreKeyFactory = new KeyStoreKeyFactory(ksFile, "mypass".toCharArray());
      return keyStoreKeyFactory.getKeyPair("mytest");
    }
  
    @Bean
    public JwtAccessTokenConverter accessTokenConverter() {
      JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
      converter.setKeyPair(keyPair());
      return converter;
    }
  
    @Bean
    public JWKSet jwkSet() {
      RSAKey key = new Builder((RSAPublicKey) keyPair().getPublic()).build();
      return new JWKSet(key);
    }
  
    @Bean
    public TokenStore tokenStore() {
      return new JwtTokenStore(accessTokenConverter());
    }
  
    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
      clients.jdbc(dataSource);
    }
  
    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) {
      endpoints.tokenStore(tokenStore())
          .accessTokenConverter(accessTokenConverter())
          .authenticationManager(authenticationManager);
    }
  
    @Override
    public void configure(AuthorizationServerSecurityConfigurer security) {
      security.tokenKeyAccess("permitAll()")
          .checkTokenAccess("isAuthenticated()");
    }
  }
  
  @EnableWebSecurity
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
  
    private UserDetailsService userDetailsService;
  
    public SecurityConfiguration(UserDetailsService userDetailsService) {
      this.userDetailsService = userDetailsService;
    }
  
    @Override
    protected void configure(HttpSecurity http) throws Exception {
      http.authorizeRequests()
              .mvcMatchers("/.well-known/jwks.json")
              .permitAll()
              .anyRequest()
              .authenticated();
    }
  
    @Bean
    public PasswordEncoder passwordEncoder() {
      return new BCryptPasswordEncoder();
    }
  
    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
      return super.authenticationManagerBean();
    }
  
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
      auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
    }
  }
  </code></pre>
  
  <p>Resource server configuration</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  public class ResuorceServerConfiguration extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests()
                  .anyRequest()
                  .authenticated()
                  .and()
                  .oauth2ResourceServer()
                  .jwt();
      }
  }
  </code></pre>
  
  <p>Maybe someone had similar issue?</p>