title: Using scopes as roles in Spring Security OAuth2 (provider)
body: <p>Let's consider a fairly simple hypothetical application where users can read or write posts.</p>
  
  <p>Some users can read and write articles while some others can only read them. With Spring Security (3.2.1) I modeled this by having 2 roles:</p>
  
  <ul>
  <li>ROLE_WRITE: this role grants users access to writing posts.</li>
  <li>ROLE_READ: this role grants users access to reading posts.</li>
  </ul>
  
  <p>Implementing this with Spring security is fairly straightforward...</p>
  
  <p>Now I want to also allow third-party apps to read and write posts on behalf of users by implementing an OAuth2 provider using <a href="https://github.com/spring-projects/spring-security-oauth">Spring Security OAuth (version 2.0.0.M3 ATM)</a>.</p>
  
  <p>During the authorization step, the app asks the user whether they are willing to grant the right to read and/or write posts on their behalf. The user here is granting scopes here (not roles).</p>
  
  <p>Then when the OAuth2 consumer calls my REST API, Spring Sec OAuth authorizes the token granted and creates an authentication containing the user with all their roles and only the scopes granted.</p>
  
  <p>The problem (and the question) is that I now have to write different security logic depending on whether the API is called by a user normally authenticated (just check the roles) or whether it's called through OAuth2 (check roles + scopes).</p>
  
  <p>Is it possible to "merge" the concepts of roles and scopes in Spring Security OAuth2 so that during the authorization step, the user grants the app a subset of the <strong>roles</strong> they have (and have the OAuth2 authentication only report these in the granted authorities)? That way when the 3rd party app makes an API call, the roles on the authentication are the ones granted? That way I don't have to write any OAuth2 specific security logic.</p>