title: Spring Security: extract oidc role claims to spring authorities
body: <p>I am trying to get role claims from an <code>OAuth2AuthenticationToken</code> to be detected as Spring Security authorities. There is a custom role defined on OIDC provider side (Azure AD in my case) that is nested inside the <code>DefaultOidcUser</code>, but not added automatically to the authorities:
  <a href="https://i.stack.imgur.com/LQPFz.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/LQPFz.png" alt="enter image description here" /></a></p>
  <p>I tried to extract them from the Jwt Token <a href="https://stackoverflow.com/questions/58205510/spring-security-mapping-oauth2-claims-with-roles-to-secure-resource-server-endp">like this</a></p>
  <p>However, when I do that, neither of the following methods is called (neither during login, nor later, even in the default configuration):</p>
  <ul>
  <li><code>JwtGrantedAuthoritiesConverter.convert(Jwt)</code></li>
  <li><code>JwtAuthenticationConverter.convert(Jwt)</code></li>
  <li><code>JwtAuthenticationConverter.extractAuthorities(Jwt)</code></li>
  </ul>
  <p>My current configuration is:</p>
  <pre><code>@EnableWebSecurity
  @EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
  @Import(SecurityProblemSupport.class)
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
  
  @Override
      public void configure(HttpSecurity http) throws Exception {
          // @formatter:off
          http
              .csrf()
              &lt;some more config that has nothing to do with oauth/oidc&gt;
              .and()
              .oauth2Login()
              .and()
              .oauth2ResourceServer()
              .jwt()
              .jwtAuthenticationConverter(jwtAuthenticationConverter())
              .and()
              .and()
              .oauth2Client()
          ;
      }
  
      private JwtAuthenticationConverter jwtAuthenticationConverter() {
          // create a custom JWT converter to map the roles from the token as granted authorities
          JwtGrantedAuthoritiesConverter jwtGrantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
          jwtGrantedAuthoritiesConverter.setAuthoritiesClaimName(&quot;roles&quot;);     
          JwtAuthenticationConverter jwtAuthenticationConverter = new JwtAuthenticationConverter();
          jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(jwtGrantedAuthoritiesConverter);
          return jwtAuthenticationConverter;
      }
  }
  </code></pre>
  <p>I also tried with a</p>
  <pre><code>CustomJwtAuthConverter implements Converter&lt;Jwt, AbstractAuthenticationToken&gt;
  </code></pre>
  <p>but to no avail.</p>
  <p>Any help would be appreciated.</p>