title: OAuth2 - get authorities in resource server for a client_credential grant type
body: <p>I'm trying to use the client-credential authentication type but I'm stuck, when I want to decode the JWT token in my resource server, impossible to access to the authority that I set in my authentication server...
  In my authentication server I have something like this:</p>
  
  <pre><code>@Override
      public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
          clients.inMemory()
                  .withClient("mkt-cms")
                  .authorizedGrantTypes("password")
                  .authorities("ROLE_ADMIN")
                  .scopes("read", "write", "trust")
                  .accessTokenValiditySeconds(accessTokenValiditySeconds)
                  .and()
                  .withClient("myClientA")
                  .authorizedGrantTypes("client_credentials")
                  .authorities("ROLE_CLIENTA")
                  .scopes("read")
                  .secret("mySecret")
                  .accessTokenValiditySeconds(accessTokenValiditySeconds);
      }
  </code></pre>
  
  <p>And in my authorization server I have:</p>
  
  <pre><code> @Override
      public void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests()
                  .antMatchers("/**/products").hasRole(""ADMIN")
  
                  .antMatchers("/**/submissions/pending-approval").access("#oauth2.clientHasRole('CLIENTA')")
                  .and()
                  .sessionManagement()
                  .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
      }
  </code></pre>
  
  <p>I'm using JWT tokens. </p>
  
  <p><strong>In the first case (working case - authentication type = password):</strong></p>
  
  <p>When the app is on the behalf of a user, it's fine I have a token decoded like this: </p>
  
  <pre><code>{"alg":"HS256"}{"user_name":"emil.brigand","scope":
      ["read","write","trust"],"exp":1426344414,"authorities":
      ["ROLE_ADMIN"],
      "jti":"5f03d88f-d5bc-497d-b2f3-054cb6389407","client_id":"mkt-cms","username":"emil.brigand"}W.d0Þ.Óy®wÊ_Ì¸ÃR%¬ç
  </code></pre>
  
  <p>Where the role is set by the UserDetailsService (define in the provider) in my authentication server.</p>
  
  <p>the Authentication object I ve got is ok, the role is set:</p>
  
  <pre><code>    org.springframework.security.authentication.UsernamePasswordAuthenticationToken
  @a02f59a4: Principal: emil.brigand; Credentials: [PROTECTED]; Authenticated:
   true; Details: null; Granted Authorities: ROLE_ADMIN
  </code></pre>
  
  <p>So the URLS like <code>"/**/products"</code> are accessible by the user.</p>
  
  <p><strong>In the second case (not working case - authentication type = cleint_credentials):</strong></p>
  
  <p>When the app get a token, the token decoded is like this: </p>
  
  <pre><code>{"alg":"HS256"}{"scope":["read"],"exp":1426345300,"authorities":
      [{"authority":"ROLE_CLIENTA"}],"jti":"2b16b2fb-67ea-4068-a96a-
      7d8314fa0cde","client_id":"myClientA"}vÊ»w¤qØ:LÉ¯@½'ö$'11è
  </code></pre>
  
  <p>I don't have any authentication provider, so I son't have a userDetailsService to set a role, the only thing I have is the authority set in the authentication server with this line: <code>.authorities("ROLE_CLIENTA")</code>
  And I want to be able add a rule on it in my resource server when I'm doing something like this:</p>
  
  <pre><code>.antMatchers("/**/submissions/pending-
  approval").access("#oauth2.clientHasRole('CLIENTA')")
  </code></pre>
  
  <p>I tried :  <code>.antMatchers("/**/submissions/pending-approval").hasAuthority("CLIENTA")</code>
  But not working as well...</p>
  
  <p>the Authentication object I ve got is like this:</p>
  
  <pre><code>org.springframework.security.oauth2.provider.OAuth2Authentication@75ae9843:
       Principal: myClientA; Credentials: [PROTECTED]; Authenticated: true; Details: 
      remoteAddress=0:0:0:0:0:0:0:1, tokenValue=&lt;TOKEN&gt;; Not granted any authorities
  </code></pre>
  
  <p>EDIT:</p>
  
  <p>I found that when the token is extracted and the OAuth2Authentication object is set, the authorities is ignored (set to null), we can see that in the Spring class: DefaultAccessTokenConverter.extractAuthentication, the third parameter of the OAuth2Request constructor is null and it should be the authorities... I don't understand why this behavior...</p>