title: Why is my token being rejected? What is a resource ID? "Invalid token does not contain resource id (oauth2-resource)"
body: <p>I'm trying to configure OAuth2 for a spring project. I'm using a shared UAA (<a href="https://docs.cloudfoundry.org/api/uaa/version/4.8.0" rel="noreferrer">oauth implementation from cloud foundry</a>) instance my work place provides (so I'm not trying to create an authorization server and the authorization server is separate from the resource server). The frontend is a single-page-application and it gets token directly from the authorization server using the implicit grant. I have the SPA setup where it adds the <code>Authorization: Bearer &lt;TOKEN&gt;</code> header on each web API call to microservices.</p>
  
  <p>My issue is now with the microservices.</p>
  
  <p>I'm trying to use this shared authorization server to authenticate the microservices. I might have a misunderstanding here, buy my current understanding is that these microservices play the role of the resource server because they host the endpoints the SPA uses to get data.</p>
  
  <p>So I tried to configure a microservice like so:</p>
  
  <pre><code>@Configuration
  @EnableResourceServer
  public class OAuth2ResourceServerConfig extends ResourceServerConfigurerAdapter {
  
      @Override
      public void configure(HttpSecurity http) throws Exception {
          http.csrf().disable()
          .authorizeRequests()
          .antMatchers("/api/**").authenticated();
      }
  
      @Bean
      public TokenStore tokenStore() {
          return new JwtTokenStore(accessTokenConverter());
      }
  
      @Bean
      public JwtAccessTokenConverter accessTokenConverter() {
          JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
          converter.setVerifierKey("-----BEGIN PUBLIC KEY-----&lt;key omitted&gt;-----END PUBLIC KEY-----");
          return converter;
      }
  
      @Bean
      @Primary
      public DefaultTokenServices tokenServices() {
          DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
          defaultTokenServices.setTokenStore(tokenStore());
          return defaultTokenServices;
      }
  
  
      @Override
      public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
           resources.tokenServices(tokenServices());
      }
  }
  </code></pre>
  
  <p>Now whenever I hit a <code>/api/**</code> with the <code>Authorization: Bearer &lt;TOKEN&gt;</code>, I get a <code>403</code> with this error:</p>
  
  <pre><code>{
      "error": "access_denied",
      "error_description": "Invalid token does not contain resource id (oauth2-resource)"
  }
  </code></pre>
  
  <hr>
  
  <h2>So here are my questions:</h2>
  
  <ul>
  <li><strong>How do I configure these microservices to validate the token and insert a <a href="https://docs.oracle.com/javase/8/docs/api/java/security/Principal.html" rel="noreferrer"><code>Principal</code></a> in controller methods?</strong> I currently have it setup where the SPA has and sends the token and I also have the public key used to verify the signature of the token. I have also used <a href="https://jwt.io/" rel="noreferrer">jwt.io</a> to test the token and it says "Signature Verified".</li>
  <li>What is a resource id? Why do I need it and why does it cause the error above? Is that a Spring only thing??</li>
  </ul>
  
  <p>Thanks!</p>