fullstop/src/main/java/org/zalando/stups/fullstop/config/OAuth2Configuration.java
@Override
    public void configure(final HttpSecurity http) throws Exception {

        http.sessionManagement().sessionCreationPolicy(NEVER)

            // configure form login
            .and().formLogin().disable()

            // configure logout
                .logout().disable()

                .authorizeRequests()
                .antMatchers(HttpMethod.OPTIONS).permitAll() // Allow preflight CORS requests from browsers
                .antMatchers("/").access("#oauth2.hasUidScopeAndAnyRealm('/employees', '/services')")
                .antMatchers("/api/**").access("#oauth2.hasUidScopeAndAnyRealm('/employees', '/services')")
                .antMatchers("/s3/**").access("#oauth2.hasUidScopeAndAnyRealm('/employees', '/services')")
                .antMatchers("/webjars/**").permitAll()
                .antMatchers("/swagger-resources").permitAll()
                .antMatchers("/api-docs").permitAll();

    }
@Override
    public void configure(final HttpSecurity http) throws Exception {

        http.sessionManagement().sessionCreationPolicy(NEVER)

            // configure form login
            .and().formLogin().disable()

            // configure logout
                .logout().disable()

                .authorizeRequests()
                .antMatchers(HttpMethod.OPTIONS).permitAll() // Allow preflight CORS requests from browsers
                .antMatchers("/").access("#oauth2.hasUidScopeAndAnyRealm('/employees', '/services')")
                .antMatchers("/api/**").access("#oauth2.hasUidScopeAndAnyRealm('/employees', '/services')")
                .antMatchers("/s3/**").access("#oauth2.hasUidScopeAndAnyRealm('/employees', '/services')")
                .antMatchers("/webjars/**").permitAll()
                .antMatchers("/swagger-resources").permitAll()
                .antMatchers("/api-docs").permitAll();

    }
@ Override public void configure ( final HttpSecurity http ) throws Exception { http . sessionManagement ( ) . sessionCreationPolicy ( NEVER ) // configure form login . and ( ) . formLogin ( ) . disable ( ) // configure logout . logout ( ) . disable ( ) . authorizeRequests ( ) . antMatchers ( HttpMethod . OPTIONS ) . permitAll ( ) // Allow preflight CORS requests from browsers . antMatchers ( "/" ) . access ( "#oauth2.hasUidScopeAndAnyRealm('/employees', '/services')" ) . antMatchers ( "/api/**" ) . access ( "#oauth2.hasUidScopeAndAnyRealm('/employees', '/services')" ) . antMatchers ( "/s3/**" ) . access ( "#oauth2.hasUidScopeAndAnyRealm('/employees', '/services')" ) . antMatchers ( "/webjars/**" ) . permitAll ( ) . antMatchers ( "/swagger-resources" ) . permitAll ( ) . antMatchers ( "/api-docs" ) . permitAll ( ) ; }
Configure scopes for specific controller/httpmethods/roles here.
Configure scopes for specific controller / httpmethods / roles here .