java - Spring OAuth2 checkUserScopes is not working as expected -

first of all, according spring doc , if want map user roles scopes, should use setcheckuserscopes(true) defaultoauth2requestfactory. 1 way this, injecting own defaultoauth2requestfactory bean, doc says:

the authorizationserverendpointsconfigurer allows inject custom oauth2requestfactory can use feature set factory if use @enableauthorizationserver. 

then do

@configuration @enableauthorizationserver public class oauth2authorizationserverconfig extends         authorizationserverconfigureradapter {      ...      @override     public void configure(authorizationserverendpointsconfigurer endpoints)             throws exception {         endpoints.authenticationmanager(authenticationmanager)                 .tokenstore(tokenstore)                 .tokenservices(tokenservices());         endpoints             .getoauth2requestfactory(); // doesn't return me own defaultoauth2requestfactory       }      @bean     @primary     public oauth2requestfactory defaultoauth2requestfactory() {         defaultoauth2requestfactory defaultoauth2requestfactory = new defaultoauth2requestfactory(                 clientdetailsservice);         defaultoauth2requestfactory.setcheckuserscopes(true);         return defaultoauth2requestfactory;     } } 

---

edit

i've overlooked method requestfactory() authorizationserverendpointsconfigurer. correct way pass spring security. setting oauth2requestfactory bean primary didn't work. i've deleted things focus on real problem:

---

after observation, actual problem:

as understand, if user has authorities , b, , app has scope a, gets 'a' scope. not happening. happening if app has scope a, , app (not user) has authorities , b, user gets a. doesn't make sense. defaultoauth2requestfactory method resolve user's scopes:

private set<string> extractscopes(map<string, string> requestparameters, string clientid) {     ... // avoid unimportant lines not make post long     if ((scopes == null || scopes.isempty())) {         scopes = clientdetails.getscope();     }      if (checkuserscopes) {         scopes = checkuserscopes(scopes, clientdetails);     }     return scopes; }  private set<string> checkuserscopes(set<string> scopes, clientdetails clientdetails) {     if (!securitycontextaccessor.isuser()) {         return scopes;     }     set<string> result = new linkedhashset<string>();     set<string> authorities = authorityutils.authoritylisttoset(securitycontextaccessor.getauthorities());     (string scope : scopes) {         if (authorities.contains(scope) || authorities.contains(scope.touppercase())                 || authorities.contains("role_" + scope.touppercase())) {             result.add(scope);         }     }     return result; }  

is bug? please tell me if wrong. regards

you need wire oauth2requestfactory code like here.

if authorities set clientdetailsservice should good. if looking map logged-in user authorities don't have luck there either.