title: Spring Security OAuth2 - How to use OAuth2Authentication object?
body: <p>I have OAuth2 authorization server which provides user information:</p>
  
  <pre><code>public class User implements Serializable, UserDetails {
      private Long userID;
      private String username;
      private String password;
      private String fullName;
      private String email;
      private String avatar;
      private boolean enabled;
      // etc
  }
  
  @RestController
  @RequestMapping("/api")
  public class APIController {
  
      @RequestMapping("/me")
      public User me(@AuthenticationPrincipal User activeUser) {
          return activeUser;
      }
  }
  </code></pre>
  
  <p>Also I've implemented OAuth2 client as separate Spring Boot application.</p>
  
  <pre><code>@Configuration
  @EnableOAuth2Sso
  public class OAuth2ClientConfig extends WebSecurityConfigurerAdapter {
  
      @Override
      public void configure(HttpSecurity http) throws Exception {
          http.logout()
              .and()
              .antMatcher("/**").authorizeRequests()
              .antMatchers("/login").permitAll()
              .anyRequest().authenticated();
      }
  }
  </code></pre>
  
  <p><strong>application.yml</strong></p>
  
  <pre><code>security:
    user:
      password: none
    oauth2:
      client:
        clientId:     acme
        clientSecret: acmepassword
        accessTokenUri:       http://localhost:9080/sso/oauth/token
        userAuthorizationUri: http://localhost:9080/sso/oauth/authorize
      resource:
        userInfoUri:    http://localhost:9080/sso/api/me
  </code></pre>
  
  <p>User authenticates successfully:</p>
  
  <pre><code>@Controller
  public class MainController {
  
      @RequestMapping(value = "/")
      public String index(Principal principal) {
          System.out.println(principal);
          // org.springframework.security.oauth2.provider.OAuth2Authentication@c2e723e8: Principal: superadmin; Credentials: [PROTECTED]; Authenticated: true; Details: remoteAddress=&lt;ADDRESS&gt;, sessionId=&lt;SESSION&gt;, tokenType=bearertokenValue=&lt;TOKEN&gt;; Granted Authorities: {userRoleID=1, authority=ROLE_SUPERUSER}
          OAuth2Authentication auth = (OAuth2Authentication) principal;
          System.out.println(auth.getUserAuthentication().getDetails());
          // {userID=1, username=superadmin, password=***, fullName=SuperUser, email=superadmin@example.org, avatar=null, enabled=true ...
          return "index";
      }
  }
  </code></pre>
  
  <p>But I can't understand how to use provided OAuth2Authentication object in my application. It almost useless.</p>
  
  <p>When I'm trying to use any Thymeleaf security tag</p>
  
  <pre><code>&lt;span sec:authentication="principal.fullName"&gt;Username&lt;/span&gt;
  &lt;span sec:authentication="principal.authorities"&gt;Authorities&lt;/span&gt;
  &lt;span sec:authentication="principal.userAuthentication.details.fullName"&gt;Usernames&lt;/span&gt;
  </code></pre>
  
  <p>.. the following exception occurs:</p>
  
  <pre><code>Error retrieving value for property "property name here" of authentication object of class org.springframework.security.oauth2.provider.OAuth2Authentication
  </code></pre>
  
  <p>Standard Spring Security methods <code>isUserInRole()</code> not working too:</p>
  
  <pre><code>System.out.println(servletRequest.isUserInRole("ROLE_SUPERUSER"));
  // false
  </code></pre>
  
  <p>Should I implement custom Thymeleaf security dialect and hasRole() method? Or maybe simpler solution exists?</p>