Spring Authorization Server

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security-oauth2-authorization-server</artifactId>
</dependency>

# application.yml of auth-server (port 9000)
server:
  port: 9000
spring:
  security:
    user:
      name: asha
      password: "{noop}user123"      # demo only — use a real UserDetailsService
    oauth2:
      authorizationserver:
        issuer: http://localhost:9000
        client:
          web-app:
            registration:
              client-id: web-app
              client-secret: "{bcrypt}$2a$10$6hN5E3sQ8kK6f6YwQ2iY6eJ0b5n0m2J0yJ3dO6oQ3bHk8lE9uF0bK"
              client-authentication-methods: client_secret_basic
              authorization-grant-types: authorization_code, refresh_token
              redirect-uris: http://localhost:8080/login/oauth2/code/webnest
              scopes: openid, profile, orders.read
            require-authorization-consent: true
            require-proof-key: true
          reporting-service:
            registration:
              client-id: reporting-service
              client-secret: "{bcrypt}$2a$10$Vd1Wm9aYxJgYv6k1v0k5mO2nK7n8V1a0cS6oR2wQ1bT9uZ4pA3hXe"
              client-authentication-methods: client_secret_basic
              authorization-grant-types: client_credentials
              scopes: orders.read

curl -s -u reporting-service:reporting-secret \
     -d "grant_type=client_credentials&scope=orders.read" \
     http://localhost:9000/oauth2/token

@Configuration
public class AuthServerConfig {

    // Put the user's roles into every access token
    @Bean
    OAuth2TokenCustomizer<JwtEncodingContext> rolesClaim() {
        return context -> {
            if (OAuth2TokenType.ACCESS_TOKEN.equals(context.getTokenType())
                    && context.getPrincipal() != null) {
                Set<String> roles = context.getPrincipal().getAuthorities().stream()
                    .map(GrantedAuthority::getAuthority)
                    .filter(a -> a.startsWith("ROLE_"))
                    .map(a -> a.substring(5))
                    .collect(Collectors.toSet());
                context.getClaims().claim("roles", roles);
            }
        };
    }

    // Production: store clients, authorizations and consents in the database
    @Bean
    RegisteredClientRepository registeredClientRepository(JdbcTemplate jdbc) {
        return new JdbcRegisteredClientRepository(jdbc);
    }

    @Bean
    OAuth2AuthorizationService authorizationService(JdbcTemplate jdbc,
                                                    RegisteredClientRepository clients) {
        return new JdbcOAuth2AuthorizationService(jdbc, clients);
    }

    @Bean
    OAuth2AuthorizationConsentService consentService(JdbcTemplate jdbc,
                                                     RegisteredClientRepository clients) {
        return new JdbcOAuth2AuthorizationConsentService(jdbc, clients);
    }
}

# web-app (port 8080) — OAuth2 client
spring:
  security:
    oauth2:
      client:
        registration:
          webnest:
            provider: webnest
            client-id: web-app
            client-secret: ${WEB_APP_SECRET}
            authorization-grant-type: authorization_code
            scope: openid, profile, orders.read
        provider:
          webnest:
            issuer-uri: http://localhost:9000

# orders-api (port 8081) — resource server
spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: http://localhost:9000