title: Microservices and Spring Security OAuth2
body: <p>I already have a OAuth2 authorization server running in another project. Now I would need to secure several simple spring-boot rest-servers with OAuth2. But I'm finding the <a href="http://projects.spring.io/spring-security-oauth/docs/oauth2.html" rel="nofollow noreferrer">Spring documentation</a> really really limited when it comes to separating Authorization and Resource servers.</p>
  
  <p>I've also found several questions where <a href="https://stackoverflow.com/questions/23778134/spring-oauth2-resource-and-authorization-servers">the answer</a> has been "Well they can be different boxes as long as they share the same tokenStore datasource". Can this really be true? How could this ever work for microservices? It would seem like a really odd thing that every rest service would need to implement it's own OAuth authorization server.</p>
  
  <p>So how do I setup Oauth2.0 security for spring-boot rest-endpoints that refer to a remote oauth authorization server (possibly not even written with Spring)?</p>
  
  <p>There's this thing called <a href="http://docs.spring.io/spring-security/oauth/apidocs/org/springframework/security/oauth2/provider/token/RemoteTokenServices.html" rel="nofollow noreferrer">RemoteTokenServices</a> that seems promising but it's not really documented at all.</p>