content: package demo.config;
  
  import org.springframework.beans.factory.annotation.Autowired;
  import org.springframework.context.annotation.Configuration;
  import org.springframework.context.annotation.Import;
  import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  import org.springframework.security.config.http.SessionCreationPolicy;
  import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
  import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
  import org.springframework.security.oauth2.provider.token.TokenStore;
  import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter;
  
  /**
   * @author Peter Schneider-Manzell
   */
  @Configuration
  @EnableResourceServer
  @Import(PublicJWTConfig.class)
  public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
  
      @Autowired
      TokenStore tokenStore;
  
      @Autowired
      JwtAccessTokenConverter tokenConverter;
  
      @Override
      public void configure(HttpSecurity http) throws Exception {
          super.configure(http);
          // @formatter:off
          http
                  .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.NEVER)
                  .and()
                  .requestMatchers()
                  .antMatchers("/**")
                  .and()
                  .authorizeRequests()
                  .antMatchers("/api/**").access("hasRole('ROLE_USER')")
                  .antMatchers("/admin/**").access("hasRole('ROLE_ADMIN')");
  
          // @formatter:on
      }
  
  
  
  }
  