title: What's the right way to separate the Resource Server and the Authorization Server?
body: <p>Using spring-security-oauth2 to secure my resources against a SSO endpoint that can act as an authorization server. I'm a bit confused when the documentation states:</p>
  
  <blockquote>
    <p>The provider role in OAuth 2.0 is actually split between Authorization Service and Resource Service, and while these sometimes reside in the same application, with Spring Security OAuth you have the option to split them across two applications, and also to have multiple Resource Services that share an Authorization Service. </p>
  </blockquote>
  
  <p>But I don't think I have found an example of this happening. In sparklr/tonr the authorization server and the resource server reside in the same application. The only example I've seen from searching is <a href="https://github.com/cloudfoundry/uaa/blob/master/samples/api/src/main/webapp/WEB-INF/spring-servlet.xml">this spring-servlet.xml</a>, which requires <a href="https://github.com/cloudfoundry/uaa/blob/master/common/src/main/java/org/cloudfoundry/identity/uaa/oauth/RemoteTokenServices.java">this</a> custom implementation of <code>ResourceServerTokenServices</code> to work.</p>
  
  <p>I'd like to avoid writing a custom implementation of <code>ResourceServerTokenServices</code> if at all possible. Is there another way to support an external authorization server in a resource server? Something along the lines of:</p>
  
  <pre><code>&lt;bean class="com.example.ExternalAuthorizationServerTokenServices" 
      p:remote-url="https://my-oauth-compatible-sso.com" 
      p:token-endpoint="/oauth/access_token" 
      p:authorize-endpoint="/oauth/authorize" /&gt;
  </code></pre>
  
  <p>Is this possible?</p>
  
  <p>*EDIT: I'll add that as a workaround (or maybe this is the intended solution) I'm using a jdbc token store and relying on the fact that both servers happen to have access to that database.</p>