title: Retrieving user info in oauth2 resource server
body: <p>I've been developing a web app with OAuth2 sign-in and I'm not quite sure I should identify the user based on his access_token in my resource server. I think I'm missing some crucial step or I did something wrong in my implementation. I use Gitlab as OAuth2.0 provider, Spring boot as API and resource server and of course a web client.</p>
  <p>Resource server config:</p>
  <pre><code>@SpringBootApplication
  @EnableResourceServer
  public class MyApi {
  
      public static void main(String[] args) {
          SpringApplication.run(MyApi.class, args);
      }
  }
  
  @Configuration
  @EnableWebSecurity
  public class SecurityConfiguration extends ResourceServerConfigurerAdapter {
  
      @Value(&quot;${client.address}&quot;)
      private String clientAddress;
  
      @Value(&quot;${oauth2.gitlab.client.id}&quot;)
      private String clientId;
  
      @Value(&quot;${oauth2.gitlab.client.secret}&quot;)
      private String clientSecret;
  
      @Value(&quot;${oauth2.gitlab.check_token}&quot;)
      private String checkTokenUri;
  
      @Override
      public void configure(HttpSecurity http) throws Exception {
          http
                  .cors()
                  .and()
                  .csrf()
                  .disable()
                  .authorizeRequests()
                  .anyRequest().authenticated();
      }
  
      @Override
      public void configure(final ResourceServerSecurityConfigurer resources) throws Exception {
          resources
                  .resourceId(&quot;user&quot;)
                  .tokenServices(tokenService());
      }
  
      @Primary
      @Bean
      public RemoteTokenServices tokenService() {
          RemoteTokenServices tokenService = new RemoteTokenServices();
          tokenService.setClientId(clientId);
          tokenService.setClientSecret(clientSecret);
          tokenService.setCheckTokenEndpointUrl(checkTokenUri);
          return tokenService;
      }
  }
  </code></pre>
  <p>I overrode RemoteTokenServices and the endpoint I use is /oauth/introspect. With that setup, every HTTP request coming to my API must be authenticated and must have valid access_token. The thing is that this endpoint returns the following response. It seems that based on that I can only check whether the request is authenticated, not who is the owner of it and I should somehow start using user_info_endpoint in my resource server. Can anyone put me on a right track?</p>
  <pre><code>{
      &quot;active&quot;: true,
      &quot;scope&quot;: &quot;api&quot;,
      &quot;client_id&quot;: &quot;my-client-api&quot;,
      &quot;token_type&quot;: &quot;Bearer&quot;,
      &quot;exp&quot;: 0,
      &quot;iat&quot;: 1606119799
  }
  </code></pre>