title: Spring oauth: Why resource server is authorising instead of authorisation server
body: <p>What i found while using spring oauth framework is resource server making <code>check_token?token=T_O_K_E_N</code> request to authorisation server, and authorisation server is just returning CheckTokenEndPoint map with authorities something like below.</p>
  
  <pre><code>{
      "exp": 1511471427,
      "user_name": "idvelu",
      "authorities": [
          "FUNCTION_GET_USERS",
          "FUNCTION_AUTHORITY_1",
          "FUNCTION_AUTHORITY_2",
          "FUNCTION_AUTHORITY_3",
          "FUNCTION_AUTHORITY_4",
          "FUNCTION_AUTHORITY_5",
          "FUNCTION_AUTHORITY_6",
          "FUNCTION_AUTHORITY_7",
      ],
      "client_id": "c1",
      "scope": [
          "read",
          "write"
      ]
  }
  </code></pre>
  
  <p>Just visualise this with oauth service and resource service is running in two different machines/jvm.</p>
  
  <p>I think now resource server has to authorise the request against configured valid authorities in <code>ResourceServerConfiguration::configure(HttpSecurity)</code> with the authorities from the authorisation server.</p>
  
  <pre><code>@Override
  public void configure(HttpSecurity http) throws Exception {
   http.anonymous().disable().requestMatchers().antMatchers("/**").and().authorizeRequests()
  
          .antMatchers(HttpMethod.GET, "/myproject/users").hasAnyAuthority("FUNCTION_GET_USERS")
          .antMatchers(HttpMethod.POST, "/myproject/users").hasAnyAuthority("FUNCTION_POST_NEW_USER")
          .anyRequest().denyAll()
          .and().exceptionHandling().accessDeniedHandler(new OAuth2AccessDeniedHandler());
  }
  </code></pre>
  
  <p>In this case authorisation server may return all the hundreds of user authorities to resource server. Instead why not authorisation server itself can take the few of the permission required for authorisation as query params <BR><code>check_token?token=T_O_K_E_N&amp;authorities=FUNCTION_GET_USERS,FUNCTION_AUTHORITY_2,..</code><BR> from the resource server and validate it against the user's functions through DB? </p>
  
  <p>And finally my problem is; i have different services like java, node.js, NGINX... All these have to verify its authentication and authorization against one spring Authorisation server. Because of the above stated problem all my service has to implement the authorisation (resource server) part. Means comparing all the authorities of user against the API acess authorities. <BR>Java side this comparison is fine with spring resource server implementation. But all other non-java (resource) services needs authorisation/resourceServer implementation. Instead if my spring authorisation server accepts the authorities and validates then my problem is solved as single point of authorisation/comparison implementations. I just need to pass it as part of check_token.<BR></p>
  
  <p>How to implement this new check_token endpoint along with accepting the authorities?</p>