Adding new scopes

[hansamann]

Hi there,

the sample oauth client spec includes scopes such as read, write. What if I want to have a scope named 'customer' - is this possible? I tried it once but I got errors at startup. Is there some extra implementation required here?

Once we get the scope defined, I understand that I can use a role like SCOPE_CUSTOMER for example in the <http> tag for limiting the access, right? I guess I can use the same with the annotations on individual controller methods then.

[Dave Syer]

the sample oauth client spec includes scopes such as read, write. What if I want to have a scope named 'customer' - is this possible?

Scopes are just strings, so you can use any value you like - it's a contract between the client and the Resource Server. If there are any scopes registered with a client then no token will be issued with any other value, but that's the only restriction placed by the Authorization Server.

Once we get the scope defined, I understand that I can use a role like SCOPE_CUSTOMER for example in the <http> tag for limiting the access, right? I guess I can use the same with the annotations on individual controller methods then.

Yes that should work.