Spring Security Oauth2 Group

Question

My current set of permissions in Spring supports users with a permission level in a group, so the following is true:

A User (implementing UserDetails) has a Permission (joining User + Group, giving GrantedAuthority) in a Group. For HTTP authentication, a user can perform actions in their group and switch between groups.

For api access, I am trying to allow a user to grant a particular client (with an id + secret) to access different scopes data. With standard Spring Security OAuth2, if I do this, they will be able to access all Group objects with a user's credentials. Is there a way that a user can authorize on a per Group basis in Spring Security / Spring Security Oauth2?

Answer 1

You can add any kind of information (such as your group) to the access token's 'additional information', by implementing your own custom TokenEnhancer. It will be stored with the access token, and will be available in the resource server.