Why is my token being rejected? What is a resource ID? "Invalid token does not contain resource id (oauth2-resource)" : <p>I'm trying to configure OAuth2 for a spring project. I'm using a shared UAA (<a href="https://docs.cloudfoundry.org/api/uaa/version/4.8.0" rel="noreferrer">oauth implementation from cloud foundry</a>) instance my work place provides (so I'm not trying to create an authorization server and the authorization server is separate from the resource server). The frontend is a single-page-application and it gets token directly from the authorization server using the implicit grant. I have the SPA setup where it adds the <code>Authorization: Bearer &lt;TOKEN&gt;</code> header on each web API call to microservices.</p>

<p>My issue is now with the microservices.</p>

<p>I'm trying to use this shared authorization server to authenticate the microservices. I might have a misunderstanding here, buy my current understanding is that these microservices play the role of the resource server because they host the endpoints the SPA uses to get data.</p>

<p>So I tried to configure a microservice like so:</p>

<pre><code>@Configuration
@EnableResourceServer
public class OAuth2ResourceServerConfig extends ResourceServerConfigurerAdapter {

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
        .authorizeRequests()
        .antMatchers("/api/**").authenticated();
    }

    @Bean
    public TokenStore tokenStore() {
        return new JwtTokenStore(accessTokenConverter());
    }

    @Bean
    public JwtAccessTokenConverter accessTokenConverter() {
        JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
        converter.setVerifierKey("-----BEGIN PUBLIC KEY-----&lt;key omitted&gt;-----END PUBLIC KEY-----");
        return converter;
    }

    @Bean
    @Primary
    public DefaultTokenServices tokenServices() {
        DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
        defaultTokenServices.setTokenStore(tokenStore());
        return defaultTokenServices;
    }


    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
         resources.tokenServices(tokenServices());
    }
}
</code></pre>

<p>Now whenever I hit a <code>/api/**</code> with the <code>Authorization: Bearer &lt;TOKEN&gt;</code>, I get a <code>403</code> with this error:</p>

<pre><code>{
    "error": "access_denied",
    "error_description": "Invalid token does not contain resource id (oauth2-resource)"
}
</code></pre>

<hr>

<h2>So here are my questions:</h2>

<ul>
<li><strong>How do I configure these microservices to validate the token and insert a <a href="https://docs.oracle.com/javase/8/docs/api/java/security/Principal.html" rel="noreferrer"><code>Principal</code></a> in controller methods?</strong> I currently have it setup where the SPA has and sends the token and I also have the public key used to verify the signature of the token. I have also used <a href="https://jwt.io/" rel="noreferrer">jwt.io</a> to test the token and it says "Signature Verified".</li>
<li>What is a resource id? Why do I need it and why does it cause the error above? Is that a Spring only thing??</li>
</ul>

<p>Thanks!</p>
