Spring Security: Secure endpoint based on client authority - spring-boot

Question

I'm currently using Spring Security's OAuth2 to implement authorization across a number of micro services. Our AuthService performs all of the authentication with OAuth2 tokens etc and can create users.
Consider two clients: Client A and Client B.
Client A has authorities: CREATE_USER, CREATE_POST
Client B has authorities: READ_USER
(Yes we could use a scope instead, but this is just an example!)
Aim:
Only Client A, which has the authority CREATE_USER, should be allowed to create a user. Users are creating by posting to /users.
Problem:
The problem is that when I send a POST request to the /users endpoint with the basic authentication header for Client A, the CREATE_USER authority is not found because the request hit the AnonymousAuthenticationFilter and the only authority found is ROLE_ANONYMOUS and I receive the following:
10:38:34.852 [http-nio-9999-exec-1] DEBUG o.s.s.w.a.i.FilterSecurityInterceptor - Secure object: FilterInvocation: URL: /users; Attributes: [#oauth2.throwOnError(#oauth2.hasAuthority('CREATE_USER))]
10:38:34.852 [http-nio-9999-exec-1] DEBUG o.s.s.w.a.i.FilterSecurityInterceptor - Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken#9055c2bc: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS
10:38:34.854 [http-nio-9999-exec-1] DEBUG o.s.s.access.vote.AffirmativeBased - Voter: org.springframework.security.web.access.expression.WebExpressionVoter#a63e3e8, returned: -1
10:38:34.856 [http-nio-9999-exec-1] DEBUG o.s.s.w.a.ExceptionTranslationFilter - Access is denied (user is anonymous); redirecting to authentication entry point
org.springframework.security.access.AccessDeniedException: Access is denied
One incredibly hacky solution would be to register a custom security filter that reads the basic auth header and verifies that a client's name is equal to Client A, but this will not work for a third client, Client C which also has the CREATE_VIEWER authority, as the name and not the authorities are verified here.
// UsersController.kt
#PostMapping("/users")
#ResponseStatus(HttpStatus.OK)
#ResponseBody
fun createUser(): String {
return "Created user!"
}
Client Configuration
override fun configure(clients: ClientDetailsServiceConfigurer?) {
clients!!.inMemory()
.withClient("ClientA")
.scopes("all")
.authorities("CREATE_USER", "CREATE_POST")
.authorizedGrantTypes("refresh_token", "password")
.and()
.withClient("ClientB")
.scopes("all")
.authorities("READ_USER")
.authorizedGrantTypes("refresh_token", "password")
}
WebSecurityConfigurerAdaptor impl
override fun configure(http: HttpSecurity) {
http.requestMatchers().antMatchers("/oauth/authorize", "/oauth/confirm_access")
.and()
.authorizeRequests()
.antMatchers("/users").access("hasAuthority('CREATE_USER')")
.anyRequest().authenticated()
.and()
.csrf().disable()
}
override fun configure(auth: AuthenticationManagerBuilder) {
auth.authenticationProvider(authenticationProvider())
}
#Bean
open fun authenticationProvider(): DaoAuthenticationProvider {
val authProvider = DaoAuthenticationProvider()
authProvider.setUserDetailsService(userCredentialService)
authProvider.setPasswordEncoder(passwordEncoderService)
return authProvider
}