diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/token/DefaultAccessTokenConverter.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/token/DefaultAccessTokenConverter.java
index <HASH>..<HASH> 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/token/DefaultAccessTokenConverter.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/token/DefaultAccessTokenConverter.java
@@ -155,7 +155,7 @@ public class DefaultAccessTokenConverter implements AccessTokenConverter {
 				scope = Collections.singleton(String.class.cast(scopeObj));
 			} else if (Collection.class.<String>isAssignableFrom(scopeObj.getClass())) {
 				Collection scopeColl = Collection.class.<String>cast(scopeObj);
-				scope = new HashSet<String>(scopeColl);
+				scope = new LinkedHashSet<String>(scopeColl);	// Preserve ordering
 			}
 		}
 		return scope;
Fix broken test for DefaultAccessTokenConverter

The 'scope' ordering needs to be preserved when converting the raw token
into an Authentication or AccessToken or else tests will break.

Fixes gh-<I>