title: OAuth 2.0 using Spring Security + WSO2 Identity Server
body: <p>I'm developing a web application to expose a number of RESTful services secured by OAuth 2.0. Here is the planned architecture:</p>
  <p><strong>1- OAuth Authorization Provider:</strong> WSO2 Identity Server (IS)</p>
  <p><strong>2- OAuth Resource Server:</strong> Java web application using the following technologies:</p>
  <ul>
  <li>Jersey (to implement and expose the web services)</li>
  <li>Spring Security (to implement the OAuth Resource Server part)</li>
  </ul>
  <p>I've seen several examples (<a href="https://docs.wso2.com/display/IS500/2-legged+OAuth+for+Securing+a+RESTful+Service" rel="nofollow noreferrer">ex1</a>, <a href="http://wso2.com/library/articles/2014/02/securing-your-web-service-with-oauth2-using-wso2-identity-server-1/" rel="nofollow noreferrer">ex2</a>, <a href="http://blog.facilelogin.com/2011/07/integrating-3-legged-oauth-with-xacml.html" rel="nofollow noreferrer">ex3</a>, etc...) on how to secure RESTful services using WSO2 IS as an authorization server + WSO2 ESB as a resource server. This is NOT what I need in my case.</p>
  <p>Unfortunately, the interaction between the authorization server and the resource server is beyond the scope of the <a href="https://www.rfc-editor.org/rfc/rfc6749#page-6" rel="nofollow noreferrer">OAuth2 RFC</a>. So, I couldn't find much about how should it look like.</p>
  <p>Here are my questions:</p>
  <ul>
  <li>How to configure spring security to act as a resource server to validate an access token issued by an external OAuth provider (e.g. WSO2 IS)?</li>
  <li>How should the resource server identify the scope of a given access token?</li>
  <li>How to identify the resource owner given an access token from WSO2 IS?</li>
  </ul>
  <p>Thanks</p>