title: Getting Insufficient scope for this resource using Spring Boot and OAuth2
body: <p>I'm trying to run a small proof of concept for a REST API using Spring Boot 1.2.2 and secured with OAuth2. In order to do that I created two projects, one for the authentication server and another one for the REST service.</p>
  
  <p>When running the projects, everything goes right. I get a token from the authentication server and then using that token, I managed to call the service and get the expected result.</p>
  
  <p>The issue happens when I try to validate the scopes in the service. As soon as I add the line:</p>
  
  <pre class="lang-java prettyprint-override"><code>@PreAuthorize("#oauth2.hasScope('webshop')")
  </code></pre>
  
  <p>to my service, in the code:</p>
  
  <pre class="lang-java prettyprint-override"><code>@RestController
  public class ProductService {
  
      @RequestMapping("/product/{productId}")
      @PreAuthorize("#oauth2.hasScope('webshop')")
      public Product getProduct(@PathVariable int productId) {
  
          return new Product(productId, "name", 123);
      }
  }
  </code></pre>
  
  <p>I get this response:</p>
  
  <pre><code>{
     "error": "insufficient_scope",
     "error_description": "Insufficient scope for this resource",
     "scope": "webshop"
  }
  </code></pre>
  
  <p>The authentication server is configured as:</p>
  
  <pre class="lang-java prettyprint-override"><code>@Configuration
  @EnableAuthorizationServer
  protected static class OAuth2Config extends AuthorizationServerConfigurerAdapter {
  
      @Autowired
      private AuthenticationManager authenticationManager;
  
      @Override
      public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
          endpoints.authenticationManager(authenticationManager);
      }
  
      @Override
      public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
          clients.inMemory()
              .withClient("acme")
              .secret("acmesecret")
              .authorizedGrantTypes("authorization_code", "refresh_token", "implicit", "password", "client_credentials")
              .scopes("webshop");
      }
  }
  </code></pre>
  
  <p>This is the actual call to get the token:</p>
  
  <pre><code>juan@ubuntu:~/ms/core/product-service$ curl -s acme:acmesecret@localhost:9999/uaa/oauth/token -d grant_type=client_credentials -d scope=webshop
  {
    "access_token": "ac3a9768-4ebb-44e3-a49f-21e2f117d0b4",
    "token_type": "bearer",
    "expires_in": 43199,
    "scope": "webshop"
  }
  </code></pre>
  
  <p>And then, to call the service:</p>
  
  <pre><code>juan@ubuntu:~/ms/core/product-service$ TOKEN=ac3a9768-4ebb-44e3-a49f-21e2f117d0b4
  juan@ubuntu:~/ms/core/product-service$ curl 'http://localhost:8080/product/32' -H "Authorization: Bearer $TOKEN" -s
  {
    "error": "insufficient_scope",
    "error_description": "Insufficient scope for this resource",
    "scope": "webshop"
  }
  </code></pre>
  
  <p>I feel that I am just missing something simple because of lack of a concept. If the client has been created in memory and is supposed to be allowed to do "webshop" and the token has been generated successfully, why is the error generated?</p>
  
  <p>Thanks in advance for pointing to some direction or help.</p>