title: OAuth2 (Okta): How to set authorization
body: <p>I'm writing an application using Oauth2 using Okta, and I'm running into a problem:</p>
  
  <p>What I would like to do is have Okta (or some other method) to automatically set up and provide <strong>authorization</strong> details of my user.  I already have Okta able to support <strong>authentication</strong> of the user, I am specifically looking for help regarding <strong>authorization</strong>.  In particular, what I would like to do is divide authorization of my APIs into 3 segments:</p>
  
  <p>1) A group of APIs which are available to any user, even ones who are not authenticated.</p>
  
  <p>2) A group of APIs which are only available to authenticated users.</p>
  
  <p>3) A group of APIs which are locked under permission-based (authorization) requirements.</p>
  
  <p>It's the 3rd group I'm having trouble with.  I have my security context set up as follows:</p>
  
  <pre><code>@Configuration
  @EnableOAuth2Sso
  public class SecurityConfig extends OAuth2SsoDefaultConfiguration {
  
      public SecurityConfig(ApplicationContext applicationContext) {
          super(applicationContext);
      }
  
      @Override
      public void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests()
                  .antMatchers("/anyaccess/**").permitAll()
                  .antMatchers("/credential/**").hasRole("ADMIN");
          super.configure(http);
          http.logout().logoutSuccessUrl("/");
      }
  }
  </code></pre>
  
  <p>So /anyaccess can be accessed by anyone, and anything else except /credential can be accessed by any authenticated user.</p>
  
  <p>When I log into my application through Okta, I get an Authentication and Principal object which seem to be automatically generated somewhere, somehow (it's this somewhere, somehow that I'm mostly looking for clarification on).  However, those objects do not have any set permissions, nor do they appear to provide a way to add additional permissions for future requests.  How can I:</p>
  
  <p>1) Set up these Authentication and Principal objects to contain the permissions I want per user?</p>
  
  <p>2) Make sure that these are set up automatically on user sign-in through Okta and don't require an additional API call?</p>
  
  <p>3) Persist changes to this configuration and make that part of my application authorization service?</p>
  
  <p>4) Is there any way I can manage this through Okta configuration, or so I need to have a separate service set up to manage this and tack that onto my Okta authentication service?</p>
  
  <p>Thanks.</p>