title: Spring oAuth2 with user rights
body: <p>I am very new to oauth and especially spring oauth2. In my project currently I am using basic spring oauth by enabling spring security provider through xml config.</p>
  
  <p>Current configuration supports the access to my service using ROLE_CLIENT.
  The db for that is just the reference db as specified in spring reference docs</p>
  
  <p><img src="https://i.stack.imgur.com/G6G9H.png" alt="enter image description here"></p>
  
  <p>But now I need to extend the spring security authorization in a user level with USER RIGHTS instead of ROLE based as spring default does.</p>
  
  <p>Now I have the following tables
  <img src="https://i.stack.imgur.com/83lqy.png" alt="enter image description here"></p>
  
  <p>What is the way to use oauth2 and authorize my apis using user rights using spring security.</p>
  
  <p>Here is my context securty.xml
  <div class="snippet" data-lang="js" data-hide="false" data-console="false" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:context="http://www.springframework.org/schema/context"
   xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
   xmlns:sec="http://www.springframework.org/schema/security"
   xsi:schemaLocation="http://www.springframework.org/schema/beans  
   http://www.springframework.org/schema/beans/spring-beans.xsd  
   http://www.springframework.org/schema/context  
   http://www.springframework.org/schema/context/spring-context.xsd  
   http://www.springframework.org/schema/security  
   http://www.springframework.org/schema/security/spring-security-3.2.xsd  
   http://www.springframework.org/schema/security/oauth2  
   http://www.springframework.org/schema/security/spring-security-oauth2-2.0.xsd"&gt;
  
   
   &lt;http pattern="/oauth/token" create-session="stateless"
    authentication-manager-ref="clientAuthenticationManager"
    xmlns="http://www.springframework.org/schema/security"&gt;
    &lt;anonymous enabled="false" /&gt;
    &lt;intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" /&gt;
    &lt;http-basic entry-point-ref="clientAuthenticationEntryPoint" /&gt;
    &lt;!-- include this only if you need to authenticate clients via request  parameters --&gt;
    &lt;custom-filter ref="clientCredentialsTokenEndpointFilter" after="BASIC_AUTH_FILTER" /&gt;
    &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
   &lt;/http&gt;
  
   &lt;!--OAuth2 protected resources are separated out into their own block so 
    can deal with authorization and error handling separately --&gt;
   &lt;http pattern="/api/**" create-session="never"
    entry-point-ref="oauthAuthenticationEntryPoint"
    access-decision-manager-ref="accessDecisionManager"
    xmlns="http://www.springframework.org/schema/security"&gt;
    &lt;anonymous enabled="false" /&gt;
    &lt;intercept-url pattern="/api/**" access="ROLE_CLIENT" requires-channel="https"/&gt;
    &lt;custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" /&gt;
    &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
   &lt;/http&gt;
   
   &lt;bean id="clientDetails" class="org.springframework.security.oauth2.provider.client.JdbcClientDetailsService"&gt;
    &lt;constructor-arg index="0"&gt;
     &lt;ref bean="dataSource" /&gt;
    &lt;/constructor-arg&gt;
   &lt;/bean&gt;
   
   &lt;!-- Configure Authentication manager --&gt;
   &lt;bean id="passwordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"&gt;
    &lt;constructor-arg name="strength" value="11" /&gt;
   &lt;/bean&gt;
   
   &lt;bean id="clientDetailsUserService" class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService"&gt;
    &lt;constructor-arg ref="clientDetails" /&gt;
   &lt;/bean&gt;
   &lt;!-- Used for the persistence of tokens (currently an in memory implementation) 
   &lt;bean id="tokenStore"
    class="org.springframework.security.oauth2.provider.token.store.InMemoryTokenStore" /&gt;
   --&gt;
   &lt;bean id="tokenStore" class="org.springframework.security.oauth2.provider.token.store.JdbcTokenStore"&gt;
    &lt;constructor-arg ref="dataSource" /&gt;
   &lt;/bean&gt;
   
   &lt;!-- Used to create token and every thing about them except for their persistence 
    that is reposibility of TokenStore --&gt;
   &lt;bean id="tokenServices"  class="org.springframework.security.oauth2.provider.token.DefaultTokenServices"&gt;
    &lt;property name="tokenStore" ref="tokenStore" /&gt;
    &lt;property name="supportRefreshToken" value="true" /&gt;
    &lt;property name="clientDetailsService" ref="clientDetails" /&gt;
    &lt;property name="accessTokenValiditySeconds" value="4500" /&gt;
   &lt;/bean&gt;
   &lt;!-- &lt;bean id="userApprovalHandler" class="org.springframework.security.oauth2.provider.approval.TokenServicesUserApprovalHandler"&gt; 
    &lt;property name="tokenServices" ref="tokenServices" /&gt; &lt;/bean&gt; --&gt;
  
   &lt;bean id="oAuth2RequestFactory" class="org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory"&gt;
    &lt;constructor-arg ref="clientDetails" /&gt;
   &lt;/bean&gt;
   
   &lt;bean id="userApprovalHandler" class="org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler"&gt;
    &lt;property name="requestFactory" ref="oAuth2RequestFactory" /&gt;
    &lt;property name="tokenStore" ref="tokenStore" /&gt;
   &lt;/bean&gt;
  
   &lt;bean id="oauthAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
    &lt;property name="realmName" value="Authorization" /&gt;
   &lt;/bean&gt;
  
   &lt;bean id="clientAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
    &lt;property name="realmName" value="Authorization/client" /&gt;
    &lt;property name="typeName" value="Basic" /&gt;
   &lt;/bean&gt;
  
   &lt;bean id="oauthAccessDeniedHandler" class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" /&gt;
  
   &lt;bean id="clientCredentialsTokenEndpointFilter" class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter"&gt;
    &lt;property name="authenticationManager" ref="authenticationManager" /&gt;
   &lt;/bean&gt;
  
   &lt;bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased"
    xmlns="http://www.springframework.org/schema/beans"&gt;
    &lt;constructor-arg&gt;
     &lt;list&gt;
      &lt;bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" /&gt;
      &lt;bean class="org.springframework.security.access.vote.RoleVoter" /&gt;
      &lt;bean class="org.springframework.security.access.vote.AuthenticatedVoter" /&gt;
     &lt;/list&gt;
    &lt;/constructor-arg&gt;
   &lt;/bean&gt;
  
   &lt;!--  
   &lt;authentication-manager id="clientAuthenticationManager" xmlns="http://www.springframework.org/schema/security"&gt;
    &lt;authentication-provider user-service-ref="clientDetailsUserService" /&gt;
   &lt;/authentication-manager&gt;
   
   &lt;authentication-manager alias="authenticationManager"
    xmlns="http://www.springframework.org/schema/security"&gt;
    &lt;authentication-provider&gt;
     &lt;user-service id="userDetailsService"&gt;
      &lt;user name="user" password="user123" authorities="ROLE_CLIENT" /&gt;
     &lt;/user-service&gt;
    &lt;/authentication-provider&gt;
   &lt;/authentication-manager&gt;
   --&gt;
   
   &lt;authentication-manager alias="clientAuthenticationManager" xmlns="http://www.springframework.org/schema/security"&gt;
    &lt;authentication-provider user-service-ref="clientDetailsUserService"&gt;
     &lt;password-encoder ref="passwordEncoder" /&gt;
    &lt;/authentication-provider&gt;
   &lt;/authentication-manager&gt;
   
   &lt;authentication-manager alias="authenticationManager" xmlns="http://www.springframework.org/schema/security"&gt;
    &lt;authentication-provider&gt;
        &lt;!--  password-encoder hash="sha" /&gt;--&gt;
        &lt;password-encoder ref="passwordEncoder" /&gt;
     &lt;jdbc-user-service  data-source-ref="dataSource"/&gt;
    &lt;/authentication-provider&gt;
    &lt;authentication-provider user-service-ref="clientDetailsUserService" /&gt;
   &lt;/authentication-manager&gt;
  
   
   &lt;!--AuthorizationServerTokenServices is an interface that defines everything 
    necessary for token management --&gt;
   &lt;oauth:authorization-server 
       client-details-service-ref="clientDetails" 
       token-services-ref="tokenServices"
    user-approval-handler-ref="userApprovalHandler"&gt;
    &lt;oauth:authorization-code /&gt;
    &lt;oauth:implicit /&gt;
    &lt;oauth:refresh-token /&gt;
    &lt;oauth:client-credentials /&gt;
    &lt;oauth:password authentication-manager-ref="authenticationManager"/&gt;
   &lt;/oauth:authorization-server&gt;
  
   &lt;oauth:resource-server 
       id="resourceServerFilter" 
       resource-id="rest_api" 
       token-services-ref="tokenServices" /&gt;
  
   &lt;sec:global-method-security pre-post-annotations="enabled" proxy-target-class="true"&gt;
    &lt;!--you could also wire in the expression handler up at the layer of the 
     http filters. See https://jira.springsource.org/browse/SEC-1452 --&gt;
    &lt;sec:expression-handler ref="oauthExpressionHandler" /&gt;
   &lt;/sec:global-method-security&gt;
   &lt;oauth:expression-handler id="oauthExpressionHandler" /&gt;
   &lt;oauth:web-expression-handler id="oauthWebExpressionHandler" /&gt;
  &lt;/beans&gt;</code></pre>
  </div>
  </div>
  </p>