title: Spring boot OAuth2 custom roles on Resource server
body: <p><strong>TL;DR:</strong> How to assign users custom roles/authorities on Resource server side (that means without JWT) based on their access_token?</p>
  
  <p><strong>The whole story:</strong> I have a working Auth server and a client (which is SPA), which can obtain access_token from the Auth server. With that access_token the client can request data on my Resource server (which is separated from Auth server). The Resource server can get username from Auth server using the access_token.</p>
  
  <p>I can access the username in code by injection <code>Authentication</code> object into method like this:</p>
  
  
  
  <pre class="lang-kotlin prettyprint-override"><code>@RequestMapping("/ping")
  fun pingPong(auth: Authentication): String = "pong, " + auth.name
  </code></pre>
  
  <p>My question is how to add my custom roles or authorities (<code>auth.authorities</code> - there is only USER_ROLE) to this object which would be managed on the Resource server, not Auth server, based on the username.</p>
  
  <p>I have tried several ways to do it but none has helped. The most promising was this:</p>
  
  <pre class="lang-kotlin prettyprint-override"><code>@Configuration
  @EnableWebSecurity
  @EnableResourceServer
  class ResourceServerConfigurer(val userDetailsService: MyUserDetailsService) : ResourceServerConfigurerAdapter() {
  
      override fun configure(http: HttpSecurity) {
          http.userDetailsService(userDetailsService) // userDetailsService is autowired
                  .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                  .and().authorizeRequests()
                  .antMatchers("/", "/index.html").permitAll()
                  .anyRequest().authenticated()
      }
  }
  </code></pre>
  
  <p>And my custom UserDetailsService:</p>
  
  <pre class="lang-kotlin prettyprint-override"><code>@Service
  class UserDetailsService : org.springframework.security.core.userdetails.UserDetailsService {
  
      override fun loadUserByUsername(username: String): UserDetails {
          return org.springframework.security.core.userdetails.User(username, "password", getAuthorities(username))
  
      }
  
      private fun getAuthorities(user: String): Set&lt;GrantedAuthority&gt; {
          val authorities = HashSet&lt;GrantedAuthority&gt;()
          authorities.addAll(listOf(
                  SimpleGrantedAuthority("ROLE_ONE"),  //let's grant some roles to everyone
                  SimpleGrantedAuthority("ROLE_TWO")))
          return authorities
      }
  }
  </code></pre>
  
  <p>Everything worked (I mean I was successfully authenticated) except that I still had only ROLE_USER. Next what I tried was providing a custom implementation of AbstractUserDetailsAuthenticationProvider:</p>
  
  <pre class="lang-kotlin prettyprint-override"><code>@Bean
  fun authenticationProvider(): AbstractUserDetailsAuthenticationProvider {
      return object : AbstractUserDetailsAuthenticationProvider() {
          override fun retrieveUser(username: String, authentication: UsernamePasswordAuthenticationToken): UserDetails {
              return User(username, "password", getAuthorities(username))
  
          }
  
          private fun getAuthorities(user: String): Set&lt;GrantedAuthority&gt; {
              val authorities = HashSet&lt;GrantedAuthority&gt;()
              authorities.addAll(listOf(
                      SimpleGrantedAuthority("ROLE_ONE"),
                      SimpleGrantedAuthority("ROLE_TWO")))
              return authorities
          }
  
          override fun additionalAuthenticationChecks(userDetails: UserDetails, authentication: UsernamePasswordAuthenticationToken?) {
          }
      }
  }
  </code></pre>
  
  <p>with same result, only the ROLE_USER was present.</p>
  
  <p>I would really appreciate any ideas from you guys how add some roles to the Authentication object after the access_token was validated and username obtained from Auth server.</p>