title: Oauth2 / Password flow / check permission for a specific entity
body: <p>The main data information and information in my API is linked to a project(Entity),
  What is good approach for password flow: to manage specific permission linked to a project with spring security and OAuth2?</p>
  
  <p>In this application you have <strong>5 micro service</strong>:</p>
  
  <ul>
  <li>UAA microservice : the authorization server</li>
  <li>Catalog microservice</li>
  <li>Order microservice</li>
  <li>Invoice microservice</li>
  <li>Customer microservice</li>
  </ul>
  
  <p><strong>Zoom  permission :</strong></p>
  
  <p><a href="https://i.stack.imgur.com/d2hbI.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/d2hbI.png" alt="UUAMICROSERVICE"></a></p>
  
  <p>Each user can have many project, and can have the permission for each project:</p>
  
  <ul>
  <li>CAN_MANAGE_CATALOG</li>
  <li>CAN_VIEW_CATALOG</li>
  <li>CAN_MANAGE_ORDER</li>
  <li>CAN_VIEW_ORDER</li>
  <li>CAN_MANAGE_INVOICE</li>
  <li>CAN_VIEW_INVOICE</li>
  <li>...</li>
  </ul>
  
  <p>I have many idea but i am not sure if i have the good approach :</p>
  
  <p>USE CASE : I want to securise the endpoint :</p>
  
  <pre><code>http://catalog-service/{project_key}/catalogs
  </code></pre>
  
  <p>Only USER who have permission VIEW_CATALOG OR MANAGE_CATALOG for the project {project_key} can list all catalog present in the project</p>
  
  <p><strong>My first idea : USE ProjectAccessExpression with preauthorize</strong></p>
  
  <p><em>CatalogController.java</em></p>
  
  <pre><code>@Controller
  public class CatalogController {
       @PreAuthorize("@projectAccessExpression.hasPermission(#projectKey, 'manageCatalog', principal)" +
          " or @projectAccessExpression.hasPermission(#projectKey,  'viewCatalog', principal)")
      @RequestMapping(
              value = "/{projectKey}/catalogs",
              method = RequestMethod.GET,
              produces = MediaType.APPLICATION_JSON_VALUE
      )
      public @ResponseBody List&lt;Catalog&gt; findByProject(@PathVariable("projectKey") String projectKey) {
          return catalogService.find();
      }
  }
  </code></pre>
  
  <p><em>ProjectAccessExpression.java</em></p>
  
  <pre><code>@Component
  public class ProjectAccessExpression {
  
          private RestTemplate restTemplate;
          public boolean havePermission(String projectKey, String permission , String username) {
              Boolean havePermission = restTemplate.getForObject(String.format("http://uaa-service/permission/check?project=%1&amp;permission=%2&amp;username=%3",
                      projectKey, permission, username
                      ), Boolean.class);
              return havePermission;
          }
  }
  </code></pre>
  
  <p>The inconvenient : is need to call UAA Service for each time</p>
  
  <p><strong>Second idea : USE USER_ROLE</strong></p>
  
  <p>With user_role</p>
  
  <ul>
  <li>username | role</li>
  <li>mylogin1 | <strong>SHOP1</strong>.CAN_MANAGE_CATALOG </li>
  <li>mylogin1 | <strong>SHOP1</strong>.CAN_VIEW_CATALOG</li>
  <li>mylogin1 | <strong>SHOP2</strong>.CAN_MANAGE_CATALOG</li>
  <li>mylogin1 | <strong>SHOP2</strong>.CAN_VIEW_CATALOG</li>
  <li>mylogin1 | <strong>SHOP2</strong>.CAN_MANAGE_ORDER</li>
  <li>mylogin1 | <strong>SHOP2</strong>.CAN_VIEW_ORDER</li>
  <li>...</li>
  </ul>
  
  <p><strong>SHOP1</strong> is <strong>SHOP2</strong> is projectKey</p>
  
  <p>The inconvenient : i am not sure but if user change permission, i need to revoke all token associate</p>
  
  <p><strong>Third idea : add specific permission in authentication blob</strong></p>
  
  <p>I don't know how to do for storing...</p>
  
  <p>And in controller a annotation :</p>
  
  <pre><code>@PreAuthorize("@ProjectAccessExpression.hasPermission(authentication, 'manageCatalog||viewCatalog', #projectKey)
  </code></pre>
  
  <p>The inconvenient : same inconvenient at second idea</p>