# Spring Boot + KC Adapter + SCOPE mapping

**URL:** <https://forum.keycloak.org/t/spring-boot-kc-adapter-scope-mapping/1871>\
**Category:** Securing applications\
**Created:** [March 29, 2020, 2:23pm UTC](https://forum.keycloak.org/t/spring-boot-kc-adapter-scope-mapping/1871 "2020-03-29T14:23:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bilak](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/bilak/32/783_2.png) [@bilak](https://forum.keycloak.org/u/bilak)\
**Post date:** [March 29, 2020, 2:23pm UTC](https://forum.keycloak.org/t/spring-boot-kc-adapter-scope-mapping/1871/1 "2020-03-29T14:23:55Z")

</div>

Hello,  
I’m using spring boot 2.2.x + keycloak adapter 9.0.0.  
I’m wondering whether it is possible to map keycloak client’s scope to spring security.  
So for example if I want to use something like `@PreAuthorize("hasAuthority('SCOPE_message:read')")` how can this be done with keycloak spring-boot adapter? Currently only user roles are mapped, client scopes are omitted.  
I know how to do that without adapter using jwt token mapper, but I’m trying to use adapter for first time and I didn’t found the way how to do that.

Thanks

---

<div class="post-metadata">

**Author:** ![Robinyo](https://avatars.discourse-cdn.com/v4/letter/r/dec6dc/32.png) [@Robinyo](https://forum.keycloak.org/u/Robinyo)\
**Post date:** [March 30, 2020, 3:18am UTC](https://forum.keycloak.org/t/spring-boot-kc-adapter-scope-mapping/1871/2 "2020-03-30T03:18:40Z")

</div>

I use Spring Boot and leverage Spring Security’s support for OAuth 2.0 and Jason Web Tokens (JWTs). For example:

```auto
package org.serendipity.restapi.controller;

import org.serendipity.restapi.hateoas.IndividualRepresentationModelAssembler;
import org.serendipity.restapi.model.Individual;
import org.serendipity.restapi.service.IndividualService;

import org.springframework.data.rest.webmvc.BasePathAwareController;
import org.springframework.hateoas.CollectionModel;
import org.springframework.hateoas.EntityModel;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.security.core.annotation.AuthenticationPrincipal;
import org.springframework.security.oauth2.jwt.Jwt;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.server.ResponseStatusException;

@BasePathAwareController
public class IndividualController {

  private final IndividualRepresentationModelAssembler assembler;
  private final IndividualService entityService;

  public IndividualController(IndividualService entityService,
                              IndividualRepresentationModelAssembler assembler) {

    this.entityService = entityService;
    this.assembler = assembler;
  }
  
  @GetMapping("/whoami")
  public String whoami(@AuthenticationPrincipal Jwt jwt) {
    return String.format("Hello, %s!", jwt.getSubject());
  }
  
  @GetMapping("/individuals")
  @PreAuthorize("hasAuthority('SCOPE_individual:read')")
  public ResponseEntity<CollectionModel<EntityModel<Individual>>> findAll() {
    
    return ResponseEntity.ok(assembler.toCollectionModel(entityService.findAll()));
  }
  
  @GetMapping("/individuals/{id}")
  @PreAuthorize("hasAuthority('SCOPE_individual:read')")
  public ResponseEntity<EntityModel<Individual>> findById(
      @PathVariable("id") final Long id) throws ResponseStatusException {
    
    Individual entity = entityService.findById(id).orElseThrow(() -> 
        new ResponseStatusException(HttpStatus.NOT_FOUND));
    
    return ResponseEntity.ok(assembler.toModel(entity));
  }
  
}

```

Ref: [Flowable OAuth2 Resource Server](https://robferguson.org/blog/2020/02/05/flowable-oauth2-resource-server/)

---

<div class="post-metadata">

**Author:** ![bilak](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/bilak/32/783_2.png) [@bilak](https://forum.keycloak.org/u/bilak)\
**Post date:** [March 30, 2020, 6:39am UTC](https://forum.keycloak.org/t/spring-boot-kc-adapter-scope-mapping/1871/3 "2020-03-30T06:39:00Z")

</div>

Well, you are not using [keycloak adapter](https://www.keycloak.org/docs/latest/securing_apps/#_spring_boot_adapter) are you? That looks like spring customised configuration.

---

<div class="post-metadata">

**Author:** ![OLibutzki](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/olibutzki/32/1460_2.png) [@OLibutzki](https://forum.keycloak.org/u/OLibutzki)\
**Post date:** [November 9, 2020, 9:06am UTC](https://forum.keycloak.org/t/spring-boot-kc-adapter-scope-mapping/1871/4 "2020-11-09T09:06:02Z")

</div>

@bilak, did you find a solution?