anchor.diff:  
   NOTE: the `userInfoUri` is by far not the only way of hooking a resource server up with a way to decode tokens. In fact it's sort of a lowest common denominator (and not part of the spec), but quite often available from OAuth2 providers (like Facebook, Cloud Foundry, Github), and other choices are available. For instance you can encode the user authentication in the token itself (e.g. with http://jwt.io/[JWT]), or use a shared backend store. There is also a `/token_info` endpoint in CloudFoundry, which provides more detailed information than the user info endpoint, but which requires more thorough authentication. Different options (naturally) provide different benefits and trade-offs, but a full discussion of those is outside the scope of this section.
   
  -== Implementing the User Endpoint
  +//== Implementing the User Endpoint
  +== ユーザ向けエンドポイントの実装
   
   On the authorization server we can easily add that endpoint
   
  
positive.code: 
  or start the `main()` method in your IDE.
  
  === Testing the Authorization Server
  
  Our server is using the Spring Boot default security settings, so like the server in <<_spring_and_angular_js_a_secure_single_page_application,Part I>> it will be protected by HTTP Basic authentication. To initiate an https://tools.ietf.org/html/rfc6749#section-1.3.1[authorization code token grant] you visit the authorization endpoint, e.g. at http://localhost:9999/uaa/oauth/authorize?response_type=code&client_id=acme&redirect_uri=http://example.com[http://localhost:9999/uaa/oauth/authorize?response_type=code&client_id=acme&redirect_uri=http://example.com] once you have authenticated you will get a redirect to example.com with an authorization code attached, e.g. http://example.com/?code=jYWioI[http://example.com/?code=jYWioI].
  
  
negative.code: 
  (substitute the value of the access token that you obtain from your own authorization server to get that working yourself).
  
  //== The UI Server
  == UI サーバ
  
  The final piece of this application we need to complete is the UI server, extracting the authentication part and delegating to the authorization server. So, as with link:#changing-the-resource-server[the resource server], we first need to remove the Spring Session and Redis dependencies and replace them with Spring OAuth2.
  
  