Spring OAuth2(JWT tokens) multi-tenancy based on clientId
<p>In my Spring Boot application I have a single back-end application that exposes REST API.</p>

<p>I'm going to consume this API from different client applications(for example written in AngularJS).</p>

<p>Based on different OAuth2 <code>clientId</code> I'd like to allow or restrict user access to different functionalities or data how it was described in my previous question <a href="https://stackoverflow.com/questions/40213727/spring-oauth-2-spring-data-neo4j-multi-tenancy">Spring OAuth 2 + Spring Data Neo4j multi-tenancy</a></p>

<p>For example I have 3 different web domains:</p>

<pre><code>example1.com
example2.com
example3.com
</code></pre>

<p>and for domain <code>example1.com</code> I'd like to allow user login only with <code>clientapp1</code></p>

<p>My current login url:</p>

<p><a href="http://localhost:8080/oauth/authorize?response_type=token&amp;client_id=clientapp1&amp;redirect_uri=http%3A%2F%2Flocalhost%3A8080" rel="nofollow noreferrer">http://localhost:8080/oauth/authorize?response_type=token&amp;client_id=clientapp1&amp;redirect_uri=http%3A%2F%2Flocalhost%3A8080</a></p>

<p>In my Spring OAuth2 server(with JWT tokens) I have configured multiple clients - <code>clientapp1</code>, <code>clientapp2</code>, <code>clientapp3</code></p>

<pre><code>@Configuration
@EnableAuthorizationServer
protected static class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        // @formatter:off
        clients
            .inMemory()
                .withClient("clientapp1")
                    .authorizedGrantTypes("password","refresh_token")
                    .authorities("ROLE_CLIENT")
                    .scopes("read", "write")
                    .resourceIds(RESOURCE_ID)
                    .secret("123456")
                .and()
                .withClient("clientapp2")
                    .authorizedGrantTypes("implicit")
                    .scopes("read", "write")
                    .autoApprove(true)
                .and()
                .withClient("clientapp3")
                    .authorizedGrantTypes("password", "authorization_code", "refresh_token", "implicit")
                    .authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT")
                    .scopes("read", "write", "trust")
                    .accessTokenValiditySeconds(60);
        // @formatter:on
    }

}
</code></pre>

<p>The issue is that right now any user in the system can login into the applications with any <code>clientId</code> and thus can use for example <code>domain3.com</code> with <code>clientapp1</code></p>

<p>I need the following behavior:</p>

<p>REST API calls from <code>domain1.com</code> must be only allowed with OAuth2 JWT token only with <code>clientapp1</code> inside, for <code>domain2.com</code> only with <code>clientapp2</code> and so on. </p>

<p>How to configure my application in order to be able only login user with a correct <code>clientId</code> for appropriate domain ?</p>

<p>Is it safe to store and directly use <code>clientId</code> value on client side(in user browser) ?</p>

<p>Also, if my approach is wrong  - please suggest how to correctly implement multi-tenancy with OAuth2. </p>