title: User based permissions/scopes in Spring oAuth2
body: <p>In my current setup I have standalone spring oAuth2 server, standalone resource server and angularJs app with reverse proxy. </p>
  
  <p>On the authentication server side I have register 2 clients (web-app and internal client for service communication). I correctly receive client scopes and Users roles.</p>
  
  <p><strong>Question 1</strong>
  I need different permission (e.g. scopes) per user not client (web-app, mobile,...)</p>
  
  <p>I tried providing my own ClientsDetailService where I would build ClientDetails for each user, but only thing I receive is client id ("web-app") and I have no way of knowing which user is logged in.</p>
  
  <p>Is there a way to inject user context?</p>
  
  <p>related <a href="https://stackoverflow.com/questions/31345466/mapping-user-roles-to-oauth2-scopes-authorities">stack question</a> </p>
  
  <p><strong>Question 2</strong> I can somehow work around this if I put all of the available permissions in the JWT and do the "hasPermission(...)" logic on the resource servers. Basically client app works in N scopes and server based on the Users role builds list of permissions and creates JWT. But...</p>
  
  <ul>
  <li>What happens when I remove users permission? Is the JWT invalidated?</li>
  <li>What is the oAuth workflow in this scenario? (will refresh_token get updated permissions or user has to enter credentials again?)</li>
  <li>Since this seems like bad practice, is there better solution?</li>
  </ul>
  
  <p><strong>Question 3</strong> Is there a standard way of implementing more granular permission logic with spring oauth2? (think of 100+ different permissions with method level security)</p>