title: Spring OAuth2, access ROLE with userInfoUri?
body: <p>I'm in the process of building separate resource server and authhorization server. For now i'm using the user-info-uri in resource server to extract the Principal from the authorization server matching the access-token, with config:</p>
  
  <pre><code>spring:
    oauth2:
      resource:
        userInfoUri: http://localhost:9999/uaa/user
  </code></pre>
  
  <p>In the resource server I have protected endpoints, based on role, as follows:</p>
  
  <pre><code>http
      .authorizeRequests()
          .antMatchers("/invoices/**").hasRole("END_USER")            
          .anyRequest().authenticated();  
  </code></pre>
  
  <p>When I manually access the user-info-uri, I can see that the the authorities contain: </p>
  
  <pre><code>"authority": "ROLE_END_USER"
  </code></pre>
  
  <p>But when I try to access the /invoices resource I get an Access-Denied exception, and in the log I see:</p>
  
  <pre><code>OAuth2Authentication@bc5074a8: Principal: my-login; Credentials: [PROTECTED]; Authenticated: true; Details: remoteAddress=0:0:0:0:0:0:0:1, tokenType=BearertokenValue=&lt;TOKEN&gt;; Granted Authorities: ROLE_USER
  </code></pre>
  
  <p>Authoriteis = "ROLE_USER". Where does that come from, should'nt it be "ROLE_END_USER" at this point also?</p>
  
  <p>I've seen implementations using a shared database for the storage of tokens, is that really necessary for what I want to achive?</p>
  
  <p>Resource Server:</p>
  
  <pre><code>@SpringBootApplication
  @EnableOAuth2Resource
  public class EndUserResourceServiceApplication extends ResourceServerConfigurerAdapter {
  
      @Override
      public void configure(HttpSecurity http) throws Exception {
          http
              .authorizeRequests()                
                  .antMatchers("/invoices/**").hasRole("END_USER")                
                  .anyRequest().authenticated();  
      }
  
      public static void main(String[] args) {
          SpringApplication.run(EndUserResourceServiceApplication.class, args);
      }   
  }
  </code></pre>
  
  <p>Auth Server:</p>
  
  <pre><code>@SpringBootApplication
  @RestController
  @EnableResourceServer
  public class ApiAuthServerApplication  extends ResourceServerConfigurerAdapter {
  
      @Configuration
      @EnableWebSecurity
      @Order(-10)
      protected static class LoginConfig extends WebSecurityConfigurerAdapter {
  
          @Autowired
          private CustomUserDetailsService userDetailsService;
  
          @Bean(name = "authenticationManagerBean")
          @Override       
          public AuthenticationManager authenticationManagerBean() throws Exception {
              return super.authenticationManagerBean();
          }
  
          @Override
          @Autowired
          public void configure(AuthenticationManagerBuilder auth) throws Exception {                 
              auth
              .userDetailsService(userDetailsService)
              .passwordEncoder(passwordEncoder());                
          }
  
          @Override
          protected void configure(HttpSecurity http) throws Exception {          
              http            
              .formLogin().permitAll()
              .and()
              .requestMatchers().antMatchers("/login", "/oauth/authorize", "/oauth/confirm_access")               
              .and()
              .authorizeRequests().anyRequest().authenticated();
          }
  
          @Bean
          public PasswordEncoder passwordEncoder() {
              return new BCryptPasswordEncoder();
          }
      }
  
      @Configuration
      @EnableAuthorizationServer
      protected static class OAuth2Config extends AuthorizationServerConfigurerAdapter {
  
          @Autowired
          private TokenStore tokenStore;
  
          @Autowired
          @Qualifier("authenticationManagerBean")
          private AuthenticationManager authenticationManager;
  
          @Autowired
          private CustomUserDetailsService userDetailsService;
  
          @Override
          public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
              endpoints
              .authenticationManager(this.authenticationManager)
              .userDetailsService(this.userDetailsService)                
              .tokenStore(this.tokenStore);
          }
  
          @Override
          public void configure(ClientDetailsServiceConfigurer clients) throws Exception {            
  
              clients.inMemory()
              .withClient("my-client")    
              .secret("our_s3cret")
              .authorities("ROLE_CLIENT")         
              .authorizedGrantTypes("implicit", "password", "refresh_token")
              .redirectUris("http://anywhere")
              .scopes("read")
              .autoApprove(true);
          }
  
          @Bean
          public TokenStore tokenStore() {
              return new InMemoryTokenStore();
          }
      }
  
      public static void main(String[] args) {
          SpringApplication.run(ApiAuthServerApplication.class, args);
      }
  
      @RequestMapping("/user")
      public Principal user(Principal user) {
          return user;
      }
  }
  </code></pre>
  
  <p>Summary:</p>
  
  <ol>
  <li>Can I use user-info-uri for validating access-tokens and to use "hasRole"</li>
  <li>Is it necessary to use shared database for token storage when using separate resource server and authorization server?</li>
  </ol>