baso53

INSERT INTO COMPANY(ID, NAME, TYPE) VALUES(1, 'Imaginary Solutions', 'LLC');
INSERT INTO COMPANY(ID, NAME, TYPE) VALUES(2, 'Green Innovations', 'LLC');

INSERT INTO SUBSIDIARY(ID, NAME, CITY, COMPANY_ID) VALUES(1, 'Imaginary Solutions California', 'Palo Alto', 1);
INSERT INTO SUBSIDIARY(ID, NAME, CITY, COMPANY_ID) VALUES(2, 'Imaginary Solutions Texas', 'Austin', 1);
INSERT INTO SUBSIDIARY(ID, NAME, CITY, COMPANY_ID) VALUES(3, 'Green Innovations Canada', 'Quebec', 2);

baso53

@Entity
@Getter
@Setter
public class Subsidiary {

    @Id
    private Long id;

    private String name;

baso53

@Entity
@Getter
@Setter
public class Company {

    @Id
    private Long id;

    private String name;

baso53

spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https://www.googleapis.com/service_accounts/v1/jwk/securetoken%40system.gserviceaccount.com

# added
spring.jpa.generate-ddl=true
spring.jpa.defer-datasource-initialization=true

baso53

dependencies {
  // ...
    implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
    runtimeOnly 'com.h2database:h2'
  // ...
}

baso53

@RestController
@RequestMapping("/app")
public class AppController {

    @GetMapping(path = "/test")
    @PreAuthorize("hasAuthority('READ')")
    public String test(Principal principal) {
        return principal.getName();
    }
}

baso53

@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable();

        http.oauth2ResourceServer()
                .jwt()
                .jwtAuthenticationConverter(jwtAuthenticationConverter());

baso53

{
  "custom_claims": [
    "READ",
    "WRITE"
  ],
  "iss": "https://securetoken.google.com/fir-auth-springsecurity",
  "aud": "fir-auth-springsecurity",
  "auth_time": 1636840111,
  "user_id": "WsD5H21KFKYyCOTIbkOwjXLQRsu1",
  "sub": "WsD5H21KFKYyCOTIbkOwjXLQRsu1",

baso53

curl --location --request POST 'http://localhost:8080/admin/user-claims/WsD5H21KFKYyCOTIbkOwjXLQRsu1' \
--header 'Content-Type: application/json' \
--data-raw '["READ", "WRITE"]'

baso53

@RestController
@RequestMapping("/admin")
@RequiredArgsConstructor
public class AdminController {

    private final UserManagementService userManagementService;

    @Secured("ROLE_ANONYMOUS")
    @PostMapping(path = "/user-claims/{uid}")
    public void setUserClaims(