title: Spring Security: mapping OAuth2 claims with roles to secure Resource Server endpoints
body: <p>I'm setting up a Resource Server with Spring Boot and to secure the endpoints I'm using OAuth2 provided by Spring Security. So I'm using the Spring Boot <code>2.1.8.RELEASE</code> which for instance uses Spring Security <code>5.1.6.RELEASE</code>.</p>
  
  <p>As Authorization Server I'm using Keycloak. All processes between authentication, issuing access tokens and validation of the tokens in the Resource Server are working correctly. Here is an example of an issued and decoded token (with some parts are cut):</p>
  
  <pre><code>{
    "jti": "5df54cac-8b06-4d36-b642-186bbd647fbf",
    "exp": 1570048999,
    "aud": [
      "myservice",
      "account"
    ],
    "azp": "myservice",
    "realm_access": {
      "roles": [
        "offline_access",
        "uma_authorization"
      ]
    },
    "resource_access": {
      "myservice": {
        "roles": [
          "ROLE_user",
          "ROLE_admin"
        ]
      },
      "account": {
        "roles": [
          "manage-account",
          "manage-account-links",
          "view-profile"
        ]
      }
    },
    "scope": "openid email offline_access microprofile-jwt profile address phone",
  }
  
  </code></pre>
  
  <p>How can I configure Spring Security to use the information in the access token to provide conditional authorization for different endpoints?</p>
  
  <p>Ultimately I want to write a controller like this:</p>
  
  <pre class="lang-java prettyprint-override"><code>@RestController
  public class Controller {
  
      @Secured("ROLE_user")
      @GetMapping("userinfo")
      public String userinfo() {
          return "not too sensitive action";
      }
  
      @Secured("ROLE_admin")
      @GetMapping("administration")
      public String administration() {
          return "TOOOO sensitive action";
      }
  }
  </code></pre>