public void validateParameters ( Map < String , String > parameters , ClientDetails clientDetails ) { if ( parameters . containsKey ( "scope" ) ) { Set < String > validScope = clientDetails . getScope ( ) ; if ( GRANT_TYPE_CLIENT_CREDENTIALS . equals ( parameters . get ( "grant_type" ) ) ) { validScope = AuthorityUtils . authorityListToSet ( clientDetails . getAuthorities ( ) ) ; } Set < Pattern > validWildcards = constructWildcards ( validScope ) ; Set < String > scopes = OAuth2Utils . parseParameterList ( parameters . get ( "scope" ) ) ; for ( String scope : scopes ) { if ( ! matches ( validWildcards , scope ) ) { throw new InvalidScopeException ( scope + " is invalid. Please use a valid scope name in the request" ) ; } } } }
Apply UAA rules to validate the requested scopes scope . For client credentials grants the valid requested scopes are actually in the authorities of the client .