Resource Server supports hasAuthority

[jzheaux]

Summary

Under the current plan, Resource Server SpEL expressions will only support oauth2-specific expressions at the root. For example:

@PreAuthorize("hasScope('message.read')")

will work, but

@PreAuthorize("hasAuthority('message.read')")

won't. This will have two unfortunate consequences for end users.

First, it may put oauth2-specific SpEL expressions into generic interfaces, e.g.:

public interface MessageRepository implements CrudRepository {
    @PreAuthorize("hasScope('message.read')")
    Message findById(String id);
}

when we'd really like:

public interface MessageRepository implements CrudRepository {
    @PreAuthorize("hasAuthority('message.read')")
    Message findById(String id);
}

Second, it may be impossible for a service that needs to support more than just OAuth2 to do so. For example:

public interface MessageRepository implements CrudRepository {
    @PreAuthorize("hasAuthority('message.read') or hasScope('message.read')")
    Message findById(String id);
}

may be impossible.

The purpose of this issue is to provide support for hasAuthority in Security SpEL expressions when the server is configured as an OAuth2 Resource Server.

Each individual scope in the scope attribute in OAuth 2 appears to be a good mapping for the intent of hasAuthority(authority).

[jzheaux]

Relates to #4887