title: How to add secured administrative endpoints to Spring OAuth2 Server?
body: <p>We are developing an Auth Server based on Spring Oauth2. We have managed to add custom data,  via custom <code>UserDetails</code> implementation (and some other custom components), to the tokens so that we can map Users in the Auth server to Entities in the application.</p>
  
  <p>The application backoffice will also support the creation of new users through an administrative interface. For this reason we have opened some endpoints starting at <code>/users</code>.</p>
  
  <p>We want this ednpoints to be only accessible to authenticated clients that have a trust scope. So requests to these endpoints are expected to supply an <code>Authorization</code> header with a valid <code>Bearer</code> token obtained via a Client Credentials Grant.</p>
  
  <p>We have tried configuring the security of these endpoints extending the <code>WebSecurityConfigurerAdapter</code>. Here are different versions of the <code>configure(HttpSecurity http)</code> method and the outcomes:</p>
  
  <pre><code>http.csrf().disable().authorizeRequests().antMatchers("/users/**").permitAll();
  </code></pre>
  
  <p>This one works! But is not secured.</p>
  
  <pre><code>http.csrf().disable().authorizeRequests().antMatchers("/users/**").authenticated();
  </code></pre>
  
  <p>Fails!. It seems that the filter that does the authentication is not applied and I get a <code>403 Forbidden</code> response. The same happens substituting <code>authenticated()</code> with <code>hasRole(...)</code> or <code>hasAuthority(...)</code> or any other configuration that suggests an authenticated client.</p>
  
  <p>The question is how can I configure the endpoint to secure it for clients with trusted scope?</p>