title: Spring security oauth2: get username in REST webservice
body: <p>I've created a RESTful web services to execute actions on a workflow. The web service is secured with oauth2 with my own authorization server.
  I want to add information to my workflow about who executed an action on it. What I can't figure out is who to get the user name of the one calling the web service.</p>
  
  <p>For web service implementation I'm using jersey (1.18.1) and for security I'm using spring-security-oauth2 (2.0.2.RELEASE).</p>
  
  <p>I'm using a database token store and this contains a table OAUTH_ACCESS_TOKEN (TOKEN_ID, TOKEN, AUTHENTICATION_ID, USER_NAME, CLIENT_ID, AUTHENTICATION, REFRESH_TOKEN) that looks like containing the correct information. It has the user name and token but the token looks like a serialized java object so I can't query it myself.</p>
  
  <p>Web service:</p>
  
  <pre><code>@Component
  @Path("/workflows")
  public class WorkflowRestService {
  
      @POST
      @Path("/{id}/actions")
      @Produces(MediaType.APPLICATION_JSON)
      @Transactional
      public Response executeActions(@PathParam("id") String id, Map&lt;String, Object&gt; actionArgs) throws JAXBException, HealthDataException {
  
          //would like to have/get username here.
  
          Workflow workflow = workflowService.get(id);
          Action action = actionFactory.getAction(actionArgs);
          workflow.execute(action);
          Workflow update = workflowService.update(workflow);
          return Response.ok(update).build();
      }
  }
  </code></pre>
  
  <p>Web service security config:</p>
  
  <pre><code>&lt;beans xmlns="http://www.springframework.org/schema/beans"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns:context="http://www.springframework.org/schema/context"
         xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
         xmlns:sec="http://www.springframework.org/schema/security"
         xsi:schemaLocation="http://www.springframework.org/schema/context
          http://www.springframework.org/schema/context/spring-context-3.2.xsd
          http://www.springframework.org/schema/beans
          http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
          http://www.springframework.org/schema/security
          http://www.springframework.org/schema/security/spring-security-3.2.xsd
          http://www.springframework.org/schema/security/oauth2
          http://www.springframework.org/schema/security/spring-security-oauth2-2.0.xsd"&gt;
  
      &lt;context:property-placeholder location="classpath:main.properties"/&gt;
  
      &lt;!-- Protected resources --&gt;
      &lt;http authentication-manager-ref="" pattern="/workflows/**"
            create-session="never"
            entry-point-ref="oauthAuthenticationEntryPoint"
            access-decision-manager-ref="accessDecisionManager"
            xmlns="http://www.springframework.org/schema/security"&gt;
          &lt;anonymous enabled="false"/&gt;
          &lt;intercept-url pattern="/workflows/**"
                         access="ROLE_USER"/&gt;
          &lt;custom-filter ref="resourceServerFilter"
                         before="PRE_AUTH_FILTER"/&gt;
          &lt;access-denied-handler
                  ref="oauthAccessDeniedHandler"/&gt;
      &lt;/http&gt;
  
      &lt;bean id="oauthAuthenticationEntryPoint"
            class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
          &lt;property name="realmName" value="dstest"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="oauthAccessDeniedHandler"
            class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler"/&gt;
  
      &lt;bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased"
            xmlns="http://www.springframework.org/schema/beans"&gt;
          &lt;constructor-arg&gt;
              &lt;list&gt;
                  &lt;bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter"/&gt;
                  &lt;bean class="org.springframework.security.access.vote.RoleVoter"/&gt;
                  &lt;bean class="org.springframework.security.access.vote.AuthenticatedVoter"/&gt;
              &lt;/list&gt;
          &lt;/constructor-arg&gt;
      &lt;/bean&gt;
  
      &lt;authentication-manager alias="authenticationManager" xmlns="http://www.springframework.org/schema/security"&gt;
          &lt;authentication-provider&gt;
              &lt;jdbc-user-service data-source-ref="securityDataSource"/&gt;
          &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  
      &lt;bean id="clientDetailsUserService"
            class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService"&gt;
          &lt;constructor-arg ref="clientDetails"/&gt;
      &lt;/bean&gt;
  
      &lt;!-- Token Store  --&gt;
      &lt;bean id="tokenStore" class="org.springframework.security.oauth2.provider.token.store.JdbcTokenStore"&gt;
          &lt;constructor-arg ref="securityDataSource" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="oAuth2RequestFactory" class="org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory"&gt;
          &lt;constructor-arg ref="clientDetails"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="tokenServices" class="org.springframework.security.oauth2.provider.token.DefaultTokenServices"&gt;
          &lt;property name="tokenStore" ref="tokenStore"/&gt;
          &lt;property name="supportRefreshToken" value="true"/&gt;
          &lt;property name="clientDetailsService" ref="clientDetails"/&gt;
          &lt;!-- VIV --&gt;
          &lt;property name="accessTokenValiditySeconds" value="10"/&gt;
      &lt;/bean&gt;
  
      &lt;oauth:resource-server id="resourceServerFilter"
                             resource-id="dstest"
                             token-services-ref="tokenServices"/&gt;
  
      &lt;!-- Client Definition --&gt;
      &lt;oauth:client-details-service id="clientDetails"&gt;
  
          &lt;oauth:client client-id="healthdata-client"
                        authorized-grant-types="password,authorization_code,refresh_token,implicit,redirect"
                        authorities="ROLE_CLIENT, ROLE_TRUSTED_CLIENT"
                        redirect-uri="/web"
                        scope="read,write,trust"
                        access-token-validity="300"
                        refresh-token-validity="6000"/&gt;
  
      &lt;/oauth:client-details-service&gt;
  
  
      &lt;sec:global-method-security pre-post-annotations="enabled" proxy-target-class="true"&gt;
          &lt;sec:expression-handler ref="oauthExpressionHandler"/&gt;
      &lt;/sec:global-method-security&gt;
      &lt;oauth:expression-handler id="oauthExpressionHandler"/&gt;
      &lt;oauth:web-expression-handler id="oauthWebExpressionHandler"/&gt;
  &lt;/beans&gt;
  </code></pre>
  
  <p>Authorization server config:</p>
  
  <pre><code>&lt;beans xmlns="http://www.springframework.org/schema/beans"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns:context="http://www.springframework.org/schema/context"
         xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
         xmlns:sec="http://www.springframework.org/schema/security"
         xsi:schemaLocation="http://www.springframework.org/schema/context
          http://www.springframework.org/schema/context/spring-context-3.2.xsd
          http://www.springframework.org/schema/beans
          http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
          http://www.springframework.org/schema/security
          http://www.springframework.org/schema/security/spring-security-3.2.xsd
          http://www.springframework.org/schema/security/oauth2
          http://www.springframework.org/schema/security/spring-security-oauth2-2.0.xsd"&gt;
  
      &lt;context:property-placeholder location="classpath:main.properties"/&gt;
  
      &lt;!-- Definition of the Authentication Service --&gt;
      &lt;http pattern="/oauth/token" create-session="stateless" authentication-manager-ref="clientAuthenticationManager"
            xmlns="http://www.springframework.org/schema/security"&gt;
          &lt;intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY"/&gt;
          &lt;anonymous enabled="false"/&gt;
          &lt;http-basic entry-point-ref="clientAuthenticationEntryPoint"/&gt;
          &lt;!--     include this only if you need to authenticate clients via request parameters --&gt;
          &lt;custom-filter ref="clientCredentialsTokenEndpointFilter" after="BASIC_AUTH_FILTER"/&gt;
          &lt;access-denied-handler ref="oauthAccessDeniedHandler"/&gt;
      &lt;/http&gt;
  
      &lt;!-- Protected resources --&gt;
      &lt;http pattern="/users/**"
            create-session="never"
            entry-point-ref="oauthAuthenticationEntryPoint"
            access-decision-manager-ref="accessDecisionManager"
            xmlns="http://www.springframework.org/schema/security"&gt;
          &lt;anonymous enabled="false"/&gt;
          &lt;intercept-url pattern="/users/**"
                         access="ROLE_USER"/&gt;
          &lt;custom-filter ref="resourceServerFilter"
                         before="PRE_AUTH_FILTER"/&gt;
          &lt;access-denied-handler
                  ref="oauthAccessDeniedHandler"/&gt;
      &lt;/http&gt;
  
      &lt;bean id="oauthAuthenticationEntryPoint"
            class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
          &lt;property name="realmName" value="dstest"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="clientAuthenticationEntryPoint"
            class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
          &lt;property name="realmName" value="dstest/client"/&gt;
          &lt;property name="typeName" value="Basic"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="oauthAccessDeniedHandler"
            class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler"/&gt;
  
      &lt;bean id="clientCredentialsTokenEndpointFilter"
            class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter"&gt;
          &lt;property name="authenticationManager" ref="clientAuthenticationManager"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased"
            xmlns="http://www.springframework.org/schema/beans"&gt;
          &lt;constructor-arg&gt;
              &lt;list&gt;
                  &lt;bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter"/&gt;
                  &lt;bean class="org.springframework.security.access.vote.RoleVoter"/&gt;
                  &lt;bean class="org.springframework.security.access.vote.AuthenticatedVoter"/&gt;
              &lt;/list&gt;
          &lt;/constructor-arg&gt;
      &lt;/bean&gt;
  
      &lt;!-- Authentication in config file --&gt;
      &lt;authentication-manager id="clientAuthenticationManager" xmlns="http://www.springframework.org/schema/security"&gt;
          &lt;authentication-provider user-service-ref="clientDetailsUserService"/&gt;
      &lt;/authentication-manager&gt;
  
      &lt;authentication-manager alias="authenticationManager" xmlns="http://www.springframework.org/schema/security"&gt;
          &lt;authentication-provider&gt;
              &lt;jdbc-user-service data-source-ref="securityDataSource"/&gt;
          &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  
      &lt;bean id="clientDetailsUserService"
            class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService"&gt;
          &lt;constructor-arg ref="clientDetails"/&gt;
      &lt;/bean&gt;
  
      &lt;!-- Token Store  --&gt;
      &lt;bean id="tokenStore" class="org.springframework.security.oauth2.provider.token.store.JdbcTokenStore"&gt;
          &lt;constructor-arg ref="securityDataSource" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="oAuth2RequestFactory" class="org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory"&gt;
          &lt;constructor-arg ref="clientDetails"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="tokenServices" class="org.springframework.security.oauth2.provider.token.DefaultTokenServices"&gt;
          &lt;property name="tokenStore" ref="tokenStore"/&gt;
          &lt;property name="supportRefreshToken" value="true"/&gt;
          &lt;property name="clientDetailsService" ref="clientDetails"/&gt;
          &lt;!-- VIV --&gt;
          &lt;property name="accessTokenValiditySeconds" value="10"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="userApprovalHandler"
            class="org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler"&gt;
          &lt;property name="tokenStore" ref="tokenStore"/&gt;
          &lt;property name="requestFactory" ref="oAuth2RequestFactory"/&gt;
      &lt;/bean&gt;
  
      &lt;!-- Token management --&gt;
      &lt;oauth:authorization-server client-details-service-ref="clientDetails" token-services-ref="tokenServices"
                                  user-approval-handler-ref="userApprovalHandler" token-endpoint-url="/oauth/token"&gt;
          &lt;oauth:authorization-code/&gt;
          &lt;oauth:implicit/&gt;
          &lt;oauth:refresh-token/&gt;
          &lt;oauth:client-credentials/&gt;
          &lt;oauth:password/&gt;
      &lt;/oauth:authorization-server&gt;
  
      &lt;oauth:resource-server id="resourceServerFilter"
                             resource-id="dstest"
                             token-services-ref="tokenServices"/&gt;
  
      &lt;!-- Client Definition --&gt;
      &lt;oauth:client-details-service id="clientDetails"&gt;
  
          &lt;oauth:client client-id="healthdata-client"
                        authorized-grant-types="password,authorization_code,refresh_token,implicit,redirect"
                        authorities="ROLE_CLIENT, ROLE_TRUSTED_CLIENT"
                        redirect-uri="/web"
                        scope="read,write,trust"
                        access-token-validity="300"
                        refresh-token-validity="6000"/&gt;
  
      &lt;/oauth:client-details-service&gt;
  
  
      &lt;sec:global-method-security pre-post-annotations="enabled" proxy-target-class="true"&gt;
          &lt;sec:expression-handler ref="oauthExpressionHandler"/&gt;
      &lt;/sec:global-method-security&gt;
      &lt;oauth:expression-handler id="oauthExpressionHandler"/&gt;
      &lt;oauth:web-expression-handler id="oauthWebExpressionHandler"/&gt;
  &lt;/beans&gt;
  </code></pre>