title: Spring security oauth2 - getting custom data from OAuth2 principal
body: <p>I have a site that uses Spring security and has users (username &amp; password) and standard form authentication.  I allow users to generate a client Id and client secret linked to their account for use with an OAuth2 secured rest API.  </p>
  
  <p>I use a separate client id &amp; client secret for the API and not username and password so the user can change their password etc without breaking the API credentials, set specific scopes, disable API access etc.</p>
  
  <p>I use spring-security-oauth2 (provider) to secure the rest API and I have allowed a client credentials flow. I have setup client authentication for the api so that client id and secret are checked.</p>
  
  <p>From a separate application I use the client id and client secret to retreive an access token and start to use it with the api.  For the most part I use simple @PreAuthorize expressions typically based on client roles and scope and these appear to work correctly.</p>
  
  <p><strong>All above appears to work fine</strong></p>
  
  <p>However... I have a few API endpoints now however where I need to implement some more complex rules based on some details from the underlying user - in this case the user that generated the client id and secret.</p>
  
  <p>As a simple example consider a messaging application where I have an endpoint that allows users to post a new "message" of a specific type that can vary.  I have a table of allowed recipients for each user and each type and I want to check that the recipients of the posted message match the allowed recipient for the type.  (User allowed recipients data is typically not large, and rarely changes so I'm happy to store a copy of it when generating an access token)</p>
  
  <p>I get the principal at these endpoints and I see it is an instance of OAuth2Authentication containing:</p>
  
  <ul>
  <li>userAuthentication - null - This seems expectable for client credentials flow.</li>
  <li>clientAuthentication is populated and authorizationParameters contains the grant type and client_id</li>
  </ul>
  
  <p>I suppose I could use the client id from clientAuthentication.authorizationParameters to lookup the user and the details I require, but that would be a few queries each api call which doesn't seem to make sense.</p>
  
  <p>I would guess there's a nice place/way in Spring OAuth2 libs that while granting the access token that I could add some extra details so that later I could get them from the OAuth2Authentication (principal) object (or something that extends it?)</p>
  
  <p>Alternatively is there a better approach entirely to such issue?</p>
  
  <p>Thx!</p>