How to map authorities in spring-boot OAuth2 client?

I'm building a standard spring boot mvc + thymeleaf + Oauth2. So far I added the oauth2-client lib for authentication purpose but now I need authorization to protect my app.

Does it mean I also need to configure it as a resource server?

If not, how can I map authorities from the private claim (in the ID token) my authorization-server puts roles into?

Resource-server configuration is adapted to secure REST resources.

Client configuration is just fine unless you expose your API. If so, add a second security filter-chain. Details in this other answer: Use Keycloak Spring Adapter with Spring Boot 3

Authorities mapping in OAuth2 client

As mentioned in my comment, Spring-security documentation is always better than whatever one on Stackoverflow could write (but Spring-security team members of course, who happen to post answers)

Double check the claim in which your authorization-server puts user roles into and provide an authorities mapper, either:

• explicitly with http.oauth2Login().userInfoEndpoint().userAuthoritiesMapper(userAuthoritiesMapper());
• as a @Bean of type GrantedAuthoritiesMapper which should be auto-configured by spring-boot

In both cases, the code for the mapper is the same (double check the name of the claim for user roles with your authorization-server, but it might be groups with Azure AD):

@Bean
GrantedAuthoritiesMapper userAuthoritiesMapper() {
	return (authorities) -> {
		Set<GrantedAuthority> mappedAuthorities = new HashSet<>();

		authorities.forEach(authority -> {
			if (authority instanceof OidcUserAuthority oidcAuth) {
				oidcAuth.getIdToken().getClaimAsStringList("groups").forEach(a -> mappedAuthorities.add(new SimpleGrantedAuthority(a)));

			} else if (authority instanceof OAuth2UserAuthority oauth2Auth) {
				((List<String>) oauth2Auth.getAttributes().getOrDefault("groups", List.of())).forEach(a -> mappedAuthorities.add(new SimpleGrantedAuthority(a)));

			}
		});

		return mappedAuthorities;
	};
}