title: Spring OAuth2 restrict user to authenticate via a client
body: <p>I am implementing a Spring OAuth2 application where I have different clients using a resource. </p>
  
  <p>The clients are mobile applications, so I use the Resource Owner Password Flow.</p>
  
  <p>There are 2 roles in my application: normal users and managers. Respectively there are 2 clients, one for the normal users and one for managers.</p>
  
  <p>I don't want to apply logic on the mobile applications (clients) to check if the user has the necessary roles to access the application. As I understood the tokens should be opaque to the client.</p>
  
  <p>I already restrict the resources with user roles, but I don't want the auth server to provide the client with an access code when the user is not supposed to use that client.</p>
  
  <p>How can I restrict authorization for some users on some clients?</p>
  
  <p>Thanks in advance!</p>
  
  <p>oauth config:</p>
  
  <pre><code>@SpringBootApplication
  public class Application {
  
  public static void main(String[] args) {
      SpringApplication.run(Application.class, args);
  }
  
  @Configuration
  @EnableResourceServer
  protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
  
      @Override
      public void configure(ResourceServerSecurityConfigurer resources) {
          resources.resourceId(RESOURCE_ID);
      }
  
      @Override
      public void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests().anyRequest().access("#oauth2.clientHasRole('ROLE_MANAGER') and hasRole('ROLE_MANAGER')");
      }
  
  }
  
  @Configuration
  @EnableWebSecurity
  protected static class SecurityConfiguration extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth.inMemoryAuthentication()
                  .withUser("user").password("password").roles("USER")
              .and()
                  .withUser("demo").password("password").roles("USER")
              .and()
                  .withUser("manager").password("password").roles("MANAGER");
      }
  
      @Override
      @Bean
      public AuthenticationManager authenticationManagerBean() throws Exception {
          return super.authenticationManagerBean();
      }
  }
  
  
  @Configuration
  @EnableAuthorizationServer
  protected static class OAuth2Config extends AuthorizationServerConfigurerAdapter {
  
      @Autowired
      @Qualifier("authenticationManagerBean")
      private AuthenticationManager authenticationManager;
  
      @Override
      public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
          endpoints.authenticationManager(authenticationManager);
      }
  
      @Override
      public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
          clients.inMemory()
              .withClient("manager-client")
                  .authorizedGrantTypes("password", "refresh_token")
                  .authorities("ROLE_MANAGER")
                  .scopes("trust")
                  .resourceIds(RESOURCE_ID);
      }
  }
  }
  </code></pre>