Repository: SAP/cloud-security-xsuaa-integration
Pull request #45 (2019-01-23 15:27:51)

version 1.2.0 - revised version
- revised and tested sample `samples/spring-security-xsuaa-usage` 
- revised and tested sample `spring-security-basic-auth`
- cleaned up pom.xml of samples
- cleaned up pom.xml of libraries
- Token.getAuthorities() should be configurable to provide local scopes, default behaviour remains.
  - Howto configure that is explained in the [samples/spring-security-xsuaa-usage/Readme.md`](https://github.com/SAP/cloud-security-xsuaa-integration/blob/master/samples/spring-security-xsuaa-usage/README.md)
- updated copyright to 2018-2019
- updates READMEs of libraries


Patch:
diff --git a/LICENSE b/LICENSE
index 55e7ca40..b70b372d 100644
--- a/LICENSE
+++ b/LICENSE
@@ -187,7 +187,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2018 SAP SE
+   Copyright 2018-2019 SAP SE
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
diff --git a/NOTICE.txt b/NOTICE.txt
index 3e7c2bea..2c96a16f 100644
--- a/NOTICE.txt
+++ b/NOTICE.txt
@@ -1,1 +1,1 @@
-Copyright (c) 2018 SAP SE or an SAP affiliate company.
+Copyright (c) 2018-2019 SAP SE or an SAP affiliate company.
diff --git a/README.md b/README.md
index 0ddf1f6e..af82403a 100644
--- a/README.md
+++ b/README.md
@@ -1,11 +1,12 @@
 # Description
 Authentication services provided by the xsuaa service on [SAP Cloud Platform](https://cloudplatform.sap.com) or [SAP HANA XS Advanced](https://help.sap.com/viewer/4505d0bdaf4948449b7f7379d24d0f0d/2.0.00/en-US) rely on usage of the [OAuth 2.0](https://oauth.net) protocol and OAuth 2.0 access tokens.
+
 ## Web Flow for Authentication
 Typical UI5 applications consist of a server providing the HTML content and one or more application serving REST APIs used by the application. Web application use the OAuth Authorization Code Flow for interactive authentication:
 1. A user accesses the web application using a browser or mobile device
-2. The web application (in typical SAP Cloud Platform applications, this is an approuter) acts as OAuth client and redirects to the OAuth server for authorization
-3. Upon authentication, the web application uses the code issued by the authorization server to request an access token
-4. The web application uses the access token to request data from the OAuth resource server. The OAuth resource server validates the token using online or offline validation.
+1. The web application (in typical SAP Cloud Platform applications, this is an approuter) acts as OAuth client and redirects to the OAuth server for authorization
+1. Upon authentication, the web application uses the code issued by the authorization server to request an access token
+1. The web application uses the access token to request data from the OAuth resource server. The OAuth resource server validates the token using online or offline validation.
 
 ![OAuth 2.0 Authorization code flow](./images/oauth.png)
 
@@ -13,22 +14,29 @@ OAuth resource servers (as the one in step 4) require libraries for validating a
 
 ## Token Validation for Java web applications using SAP Java Buildpack
 The SAP Java Buildpack integrates token validation into the tomcat server. Application developers requiring authentication and authorization information in their application use the interfaces defined in [api](./api) to obtain like user name and scopes.
+
 ### Requirements
 - Java 8
 - maven 3.3.9 or later
 - The application is deployed using the SAP Java Buildpack
+
 ### Sample
 See [sap-java-builpack-api-uage](samples/sap-java-buildpack-api-usage) for an example.
 
 ## Token Validation for Java Spring Boot web applications
-Spring Boot provides OAuth resource servers. Application developers requiring authentication and authorization information in their application use the libraries defined in [spring-xsuaa](./spring-xsuaa) to obtain like user name and scopes.
+Spring Boot provides OAuth resource servers. Application developers requiring authentication and authorization information in their application use the libraries defined in [spring-xsuaa](./spring-xsuaa) to obtain token information like user name and scopes.
+
 ### Requirements
 - Java 8
 - maven 3.3.9 or later
 - Spring Boot 2.1 and later
+
 ### Sample
 See [spring-security-xsuaa-usage](samples/spring-security-xsuaa-usage) for an example.
 
+### Additional (test) utilities
+- [spring-xsuaa-mock](./spring-xsuaa-mock) offers a Mock web server to provide token keys for offline token validation in case xsuaa service (OAuth resource-server) is not in place. Its use is only intended for unit tests and when running your Spring boot application on a Webserver locally.
+- [spring-xsuaa-test](./spring-xsuaa-test) offers test utilities to generate custom JWT tokens for the purpose of tests.
 
 # Download and Installation
 Build results are published to maven central: https://search.maven.org/search?q=com.sap.cloud.security 
@@ -46,9 +54,7 @@ Libraries and information provided here is around the topic of integrating with
 
 # How to obtain support
 Open an issue in GitHub
-# To-Do (upcoming changes)
-The initial version will contain the api used by SAP Java Buildpack. Upcoming version will also provide integration into the Spring framework.
 
 # License
-Copyright (c) 2018 SAP SE or an SAP affiliate company. All rights reserved.
+Copyright (c) 2018-2019 SAP SE or an SAP affiliate company. All rights reserved.
 This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file [LICENSE.md].
diff --git a/samples/sap-java-buildpack-api-usage/README.md b/samples/sap-java-buildpack-api-usage/README.md
index 5c7759b7..09525344 100644
--- a/samples/sap-java-buildpack-api-usage/README.md
+++ b/samples/sap-java-buildpack-api-usage/README.md
@@ -5,7 +5,7 @@ In a typcal UI5 application, the approuter would server HTML files and REST data
 # Coding
 The web.xml of the application must use auth-method with value XSUAA. This enables authentication of requests using incoming OAuth authentication tokens.
 
-```
+```xml
 <web-app>
 <display-name>sample</display-name>
   <login-config> 
@@ -15,7 +15,7 @@ The web.xml of the application must use auth-method with value XSUAA. This enabl
 ```
 
 In the Java coding, use the @ServletSecurity annotations:
-```
+```java
 package com.sap.cloud.security.xssec.samples.sapbuildpack;
 
 import java.io.IOException;
diff --git a/samples/spring-security-basic-auth/README.md b/samples/spring-security-basic-auth/README.md
index e2db452b..19f02778 100644
--- a/samples/spring-security-basic-auth/README.md
+++ b/samples/spring-security-basic-auth/README.md
@@ -9,9 +9,6 @@ Note: OAuth JWT tokens can be combined with either password grant or client cred
 # Coding
 This sample is using the spring-security project. As of version 5 of spring-security, this includes the OAuth resource-server functionality. The security configuration needs to configure JWT for authentication.
 
-
-
-
 Configure the OAuth resource server by:
 - Enable caching to avoid requesting new tokens for every call
 - setting the property source to integrate with xsuaa configuration properties
@@ -20,60 +17,71 @@ Configure the OAuth resource server by:
 - configuring the jwtDecoder
 - enable the bearerTokenResolver
 
-```
+```java
 @EnableWebSecurity
 @EnableCaching
 @PropertySource(factory = XsuaaServicePropertySourceFactory.class, value = { "" })
 public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
 
-	@Autowired
-	XsuaaServiceConfigurationDefault xsuaaServiceConfiguration;
-
-	@Autowired
-	CacheManager cacheManager;
-	
-	@Override
-	protected void configure(HttpSecurity http) throws Exception {
-		TokenBrokerResolver tokenBrokerResolver = new TokenBrokerResolver(xsuaaServiceConfiguration, cacheManager.getCache("token"),AuthenticationMethod.BASIC);
-		http.authorizeRequests().antMatchers("/hello-token").hasAuthority("openid").
-			anyRequest().authenticated().and().
-				sessionManagement().
-				sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
-			.oauth2ResourceServer()
-				.bearerTokenResolver(tokenBrokerResolver)
-				.jwt()
-				  .jwtAuthenticationConverter(new TokenAuthenticationConverter(xsuaaServiceConfiguration));
-	}
-
-	@Bean
-	JwtDecoder jwtDecoder() {
-		return new XsuaaJwtDecoderBuilder(xsuaaServiceConfiguration).build();
-	}
-
-	@Bean
-	XsuaaServiceConfigurationDefault config() {
-		return new XsuaaServiceConfigurationDefault();
-	}
+   @Autowired
+   XsuaaServiceConfigurationDefault xsuaaServiceConfiguration;
+
+   @Autowired
+   CacheManager cacheManager;
+   
+   @Override
+   protected void configure(HttpSecurity http) throws Exception {
+      TokenBrokerResolver tokenBrokerResolver = new TokenBrokerResolver(xsuaaServiceConfiguration, cacheManager.getCache("token"),AuthenticationMethod.BASIC);
+      
+      http
+            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
+            .and()
+                .authorizeRequests()
+                .antMatchers("/hello-token").hasAuthority("openid")
+                .anyRequest().authenticated()
+            .and()
+                .oauth2ResourceServer()
+                .bearerTokenResolver(tokenBrokerResolver)
+                .jwt()
+                .jwtAuthenticationConverter(getJwtAuthoritiesConverter());
+   }
+   
+   Converter<Jwt, AbstractAuthenticationToken> getJwtAuthoritiesConverter() {
+        TokenAuthenticationConverter converter = new TokenAuthenticationConverter(xsuaaServiceConfiguration);
+        converter.setLocalScopeAsAuthorities(true);
+        return converter;
+   }
+
+   @Bean
+   JwtDecoder jwtDecoder() {
+        return new XsuaaJwtDecoderBuilder(xsuaaServiceConfiguration).build();
+   }
+
+   @Bean
+   XsuaaServiceConfigurationDefault xsuaaConfig() {
+        return new XsuaaServiceConfigurationDefault();
+   }
 }
 ```
 
 In the Java coding, use the `Token` to extract user information:
 
-```
-	@GetMapping("/hello-token")
-	public Map<String, String> message(@AuthenticationPrincipal Token token) {
-		Map<String, String> result = new HashMap<>();
-		result.put("grant type", token.getGrantType());
-		result.put("client id", token.getClientId());
-		result.put("subaccount id", token.getSubaccountId());
-		result.put("logon name", token.getLogonName());
-		result.put("family name", token.getFamilyName());
-		result.put("given name", token.getGivenName());
-		result.put("email", token.getEmail());
-		result.put("token", token.getAppToken());
-
-		return result;
-	}
+```java
+   @GetMapping("/hello-token")
+   public Map<String, String> message(@AuthenticationPrincipal Token token) {
+      Map<String, String> result = new HashMap<>();
+      result.put("grant type", token.getGrantType());
+      result.put("client id", token.getClientId());
+      result.put("subaccount id", token.getSubaccountId());
+      result.put("logon name", token.getLogonName());
+      result.put("family name", token.getFamilyName());
+      result.put("given name", token.getGivenName());
+      result.put("email", token.getEmail());
+      result.put("authorities", String.valueOf(token.getAuthorities()));
+      result.put("scopes", String.valueOf(token.getScopes()));
+
+      return result;
+   }
 ```
 # Deployment on Cloud Foundry or SAP HANA Advanced
 To deploy the application, the following steps are required:
@@ -86,12 +94,12 @@ To deploy the application, the following steps are required:
 ## Compile the Java application
 Run maven to package the application
 ```shell
-    spring-security-basic-auth$ mvn package
+spring-security-basic-auth$ mvn package
 ```
 ## Create the xsuaa service instance
 Use the [xs-security.json](./xs-security.json) to define the authentication settings and create a service instance
 ```shell
-    spring-security-xsuaa-usage$ cf create-service xsuaa application xsuaa-authentication -c xs-security.json
+spring-security-xsuaa-usage$ cf create-service xsuaa application xsuaa-authentication -c xs-security.json
 ```
 ## Configuration the manifest
 The [vars](../vars.yml) contains hosts and paths that need to be adopted.
@@ -100,14 +108,16 @@ The [vars](../vars.yml) contains hosts and paths that need to be adopted.
 Deploy the application using cf push. It will expect 1 GB of free memory quota.
 
 ```shell
-    spring-security-basic-auth$ cf push --vars-file ../vars.yml
+spring-security-basic-auth$ cf push --vars-file ../vars.yml
 ```
 
 ## Access the application
 After deployment, the spring service can be called with basic authentication.
+```shell
+curl -i --user "<SAP ID Service User>:<SAP ID Service Password>" https://spring-security-basic-auth-<ID>.<LANDSCAPE_APPS_DOMAIN>/hello-token
+```
+You will get a response like:
 ```
-curl -i --user "<SAP ID Service User>:<SAP ID Service Password>" https://spring-security-basic-auth-00-00-00.cfapps.eu10.hana.ondemand.com/hello-token
-
 {
   "client id": "sb-spring-security-xsuaa-usage!t291",
   "family name": "Jones",
@@ -116,7 +126,8 @@ curl -i --user "<SAP ID Service User>:<SAP ID Service Password>" https://spring-
   "logon name": "bob.jones@example.com",
   "email": "bob.jones@example.com",
   "grant type": "password",
-  "token": "ey..."
+  "authorities": "[openid]",
+  "scopes": "[openid]"
 }
 ```
 
diff --git a/samples/spring-security-basic-auth/manifest.yml b/samples/spring-security-basic-auth/manifest.yml
index 36a0d41d..c27607e0 100644
--- a/samples/spring-security-basic-auth/manifest.yml
+++ b/samples/spring-security-basic-auth/manifest.yml
@@ -1,9 +1,8 @@
 ---
 # Configuration:
-# configured for EU10. For other landscapes, please adopt the destination
-# If the routes are occupied, you might need to change the host in sap-java-buildpack-api-usage, the host in approuter- sap-java-buildpack-api-usage and the url in the destination 
+# configured for EU10. For other landscapes, please adopt LANDSCAPE_APPS_DOMAIN in ../vars.yml
+# If the route is occupied, you might need to change ID in in ../vars.yml
 applications:
-# Application spring-security-basic-auth
 - name: spring-security-basic-auth
   instances: 1
   memory: 896M
diff --git a/samples/spring-security-basic-auth/pom.xml b/samples/spring-security-basic-auth/pom.xml
index 0520fad2..f06936c5 100644
--- a/samples/spring-security-basic-auth/pom.xml
+++ b/samples/spring-security-basic-auth/pom.xml
@@ -1,13 +1,13 @@
 <?xml version="1.0"?>
 <project
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"
-	xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+		xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"
+		xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
 	<modelVersion>4.0.0</modelVersion>
 	<parent>
 		<groupId>org.springframework.boot</groupId>
 		<artifactId>spring-boot-starter-parent</artifactId>
 		<version>2.1.0.RELEASE</version>
-		<relativePath />
+		<relativePath/>
 	</parent>
 
 	<artifactId>spring-security-basic-auth</artifactId>
@@ -18,7 +18,6 @@
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 		<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
 		<java.version>1.8</java.version>
-		<spring-cloud.version>Finchley.RELEASE</spring-cloud.version>
 	</properties>
 
 	<dependencies>
@@ -38,17 +37,6 @@
 			<groupId>org.springframework.security</groupId>
 			<artifactId>spring-security-oauth2-resource-server</artifactId>
 		</dependency>
-		<dependency>
-			<groupId>org.springframework.security</groupId>
-			<artifactId>spring-security-test</artifactId>
-			<scope>test</scope>
-		</dependency>
-
-		<dependency>
-			<groupId>com.squareup.okhttp3</groupId>
-			<artifactId>mockwebserver</artifactId>
-			<version>3.9.1</version>
-		</dependency>
 		<dependency>
 			<groupId>com.sap.cloud.security.xsuaa</groupId>
 			<artifactId>spring-xsuaa</artifactId>
@@ -56,18 +44,6 @@
 		</dependency>
 	</dependencies>
 
-	<dependencyManagement>
-		<dependencies>
-			<dependency>
-				<groupId>org.springframework.cloud</groupId>
-				<artifactId>spring-cloud-dependencies</artifactId>
-				<version>${spring-cloud.version}</version>
-				<type>pom</type>
-				<scope>import</scope>
-			</dependency>
-		</dependencies>
-	</dependencyManagement>
-
 	<build>
 		<finalName>${project.artifactId}</finalName>
 		<plugins>
diff --git a/samples/spring-security-basic-auth/src/main/java/sample/spring/xsuaa/SecurityConfiguration.java b/samples/spring-security-basic-auth/src/main/java/sample/spring/xsuaa/SecurityConfiguration.java
index fa1944bd..84ea8af2 100644
--- a/samples/spring-security-basic-auth/src/main/java/sample/spring/xsuaa/SecurityConfiguration.java
+++ b/samples/spring-security-basic-auth/src/main/java/sample/spring/xsuaa/SecurityConfiguration.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2018 the original author or authors.
+ * Copyright 2002-2019 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,10 +20,13 @@ import org.springframework.cache.CacheManager;
 import org.springframework.cache.annotation.EnableCaching;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.PropertySource;
+import org.springframework.core.convert.converter.Converter;
+import org.springframework.security.authentication.AbstractAuthenticationToken;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.oauth2.jwt.Jwt;
 import org.springframework.security.oauth2.jwt.JwtDecoder;
 
 import com.sap.cloud.security.xsuaa.XsuaaServiceConfigurationDefault;
@@ -47,25 +50,37 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
 	@Override
 	protected void configure(HttpSecurity http) throws Exception {
 		TokenBrokerResolver tokenBrokerResolver = new TokenBrokerResolver(xsuaaServiceConfiguration, cacheManager.getCache("token"), AuthenticationMethod.BASIC);
+
 		// @formatter:off
-		http.authorizeRequests().antMatchers("/hello-token").hasAuthority("openid").
-			anyRequest().authenticated().and().
-				sessionManagement().
-				sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
-			.oauth2ResourceServer()
+		http.authorizeRequests()
+				.antMatchers("/hello-token").hasAuthority("openid")
+				.anyRequest().authenticated()
+			.and()
+				.sessionManagement()
+				.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
+			.and()
+				.oauth2ResourceServer()
 				.bearerTokenResolver(tokenBrokerResolver)
 				.jwt()
-				  .jwtAuthenticationConverter(new TokenAuthenticationConverter(xsuaaServiceConfiguration));
+				.jwtAuthenticationConverter(jwtAuthenticationConverter());
 		// @formatter:on
 	}
 
+	@Bean
+	Converter<Jwt, AbstractAuthenticationToken> jwtAuthenticationConverter() {
+		TokenAuthenticationConverter converter = new TokenAuthenticationConverter(xsuaaServiceConfiguration);
+//		converter.setLocalScopeAsAuthorities(true);
+		return converter;
+	}
+
+
 	@Bean
 	JwtDecoder jwtDecoder() {
 		return new XsuaaJwtDecoderBuilder(xsuaaServiceConfiguration).build();
 	}
 
 	@Bean
-	XsuaaServiceConfigurationDefault config() {
+	XsuaaServiceConfigurationDefault xsuaaConfig() {
 		return new XsuaaServiceConfigurationDefault();
 	}
 }
diff --git a/samples/spring-security-basic-auth/src/main/resources/application.yml b/samples/spring-security-basic-auth/src/main/resources/application.yml
index 09b38867..b3d0e591 100644
--- a/samples/spring-security-basic-auth/src/main/resources/application.yml
+++ b/samples/spring-security-basic-auth/src/main/resources/application.yml
@@ -1,9 +1,3 @@
-spring:
-  security:
-    oauth2:
-      resourceserver:
-        jwt:
-          jwk-set-uri: 
 server:
   port: 9999
 debug: true  
\ No newline at end of file
diff --git a/samples/spring-security-xsuaa-usage/README.md b/samples/spring-security-xsuaa-usage/README.md
index 5ea239ef..90e04b45 100644
--- a/samples/spring-security-xsuaa-usage/README.md
+++ b/samples/spring-security-xsuaa-usage/README.md
@@ -6,65 +6,73 @@ In a typcal UI5 application, the approuter would server HTML files and REST data
 This sample is using the spring-security project. As of version 5 of spring-security, this includes the OAuth resource-server functionality.The security configuration needs to configure JWT for authentication.
 
 
-
-
 Configure the OAuth resource server by:
 - setting the property source to integrate with xsuaa configuration properties
 - adding a bean for the configuration
 - using the xsuaa token converter
 - configuring  the jwtDecoder
 
-```
+```java
 @EnableWebSecurity
 @PropertySource(factory = XsuaaServicePropertySourceFactory.class, value = { "" })
 public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
 
-	@Autowired
-	XsuaaServiceConfigurationDefault xsuaaServiceConfiguration;
-
-	@Override
-	protected void configure(HttpSecurity http) throws Exception {
-		// @formatter:off
-		http.authorizeRequests().
-				antMatchers("/hello-token/**").hasAuthority("openid")
-				.anyRequest().authenticated().
-				and()
-				.oauth2ResourceServer().jwt()
-				.jwtAuthenticationConverter(new TokenAuthenticationConverter(xsuaaServiceConfiguration));
-		// @formatter:on
-	}
-
-
-	@Bean
-	JwtDecoder jwtDecoder() {
-		return new XsuaaJwtDecoderBuilder(xsuaaServiceConfiguration).build();
-	}
-
-	@Bean
-	XsuaaServiceConfigurationDefault config() {
-		return new XsuaaServiceConfigurationDefault();
-	}
-
+    @Autowired
+XsuaaServiceConfigurationDefault xsuaaServiceConfiguration;
+
+    @Override
+    protected void configure(HttpSecurity http) throws Exception {
+        // @formatter:off
+        http
+            .sessionManagement()
+                .sessionCreationPolicy(SessionCreationPolicy.STATELESS) // session is created by approuter 
+            .and()
+                .authorizeRequests()
+                .antMatchers("/hello-token").hasAuthority("openid")
+                .anyRequest().authenticated()
+            .and()
+                .oauth2ResourceServer()
+                .jwt()
+                .jwtAuthenticationConverter(getJwtAuthenticationConverter());
+        // @formatter:on
+    }
+    
+    Converter<Jwt, AbstractAuthenticationToken> getJwtAuthoritiesConverter() {
+        TokenAuthenticationConverter converter = new TokenAuthenticationConverter(xsuaaServiceConfiguration);
+        converter.setLocalScopeAsAuthorities(true);
+        return converter;
+    }
+
+    @Bean
+    JwtDecoder jwtDecoder() {
+        return new XsuaaJwtDecoderBuilder(xsuaaServiceConfiguration).build();
+    }
+
+    @Bean
+    XsuaaServiceConfigurationDefault xsuaaConfig() {
+        return new XsuaaServiceConfigurationDefault();
+    }
 }
 ```
 
 In the Java coding, use the `Token` to extract user information:
 
-```
-	@GetMapping("/hello-token")
-	public Map<String, String> message(@AuthenticationPrincipal Token token) {
-		Map<String, String> result = new HashMap<>();
-		result.put("grant type", token.getGrantType());
-		result.put("client id", token.getClientId());
-		result.put("subaccount id", token.getSubaccountId());
-		result.put("logon name", token.getLogonName());
-		result.put("family name", token.getFamilyName());
-		result.put("given name", token.getGivenName());
-		result.put("email", token.getEmail());
-		result.put("token", token.getAppToken());
-
-		return result;
-	}
+```java
+@GetMapping("/hello-token")
+public Map<String, String> message(@AuthenticationPrincipal Token token) {
+    Map<String, String> result = new HashMap<>();
+    result.put("grant type", token.getGrantType());
+    result.put("client id", token.getClientId());
+    result.put("subaccount id", token.getSubaccountId());
+    result.put("logon name", token.getLogonName());
+    result.put("family name", token.getFamilyName());
+    result.put("given name", token.getGivenName());
+    result.put("email", token.getEmail());
+    result.put("authorities", String.valueOf(token.getAuthorities()));
+    result.put("scopes", String.valueOf(token.getScopes()));
+
+    return result;
+}
 ```
 # Deployment on Cloud Foundry or SAP HANA Advanced
 To deploy the application, the following steps are required:
@@ -74,18 +82,19 @@ To deploy the application, the following steps are required:
 - Configure the manifest
 - Deploy the application
 - Access the application
+
 ## Download the approuter
 The [Application Router](./approuter/package.json) is used to provide a single entry point to a business application that consists of several different apps (microservices). It dispatches requests to backend microservices and acts as a reverse proxy. The rules that determine which request should be forwarded to which _destinations_ are called _routes_. The application router can be configured to authenticate the users and propagate the user information. Finally, the application router can serve static content.
 
 ## Compile the Java application
 Run maven to package the application
 ```shell
-    spring-security-xsuaa-usage$ mvn package
+spring-security-xsuaa-usage$ mvn package
 ```
 ## Create the xsuaa service instance
 Use the [xs-security.json](./xs-security.json) to define the authentication settings and create a service instance
 ```shell
-    spring-security-xsuaa-usage$ cf create-service xsuaa application xsuaa-authentication -c xs-security.json
+spring-security-xsuaa-usage$ cf create-service xsuaa application xsuaa-authentication -c xs-security.json
 ```
 ## Configuration the manifest
 The [vars](../vars.yml) contains hosts and paths that need to be adopted.
@@ -94,21 +103,22 @@ The [vars](../vars.yml) contains hosts and paths that need to be adopted.
 Deploy the application using cf push. It will expect 1 GB of free memory quota.
 
 ```shell
-    spring-security-xsuaa-usage$ cf push --vars-file ../vars.yml
+spring-security-xsuaa-usage$ cf push --vars-file ../vars.yml
 ```
 
 ## Access the application
-After deployment, the application router will trigger authentication. If you have assigned the role provided in the xs-security.json to your user, you will see an output like:
-```
+After deployment, the application router will trigger authentication. If you access the application via the approuter `approuter-spring-security-xsuaa-usage` route e.g. `https://spring-security-xsuaa-usage-web-<ID>.<LANDSCAPE_APPS_DOMAIN>/`, you will see an output like:
+```json
 {
-client id: "sb-spring-security-xsuaa-usage!t291",
-family name: "Jones",
-given name: "Bill",
-subaccount id: "2f047cc0-4364-4d8b-ae70-b8bd39d15bf0",
-logon name: "bill.jones@mail.com",
-email: "bill.jones@mail.com",
-grant type: "authorization_code",
-token: "eyJhb..."
+    client id: "sb-spring-security-xsuaa-usage!t291",
+    family name: "Jones",
+    given name: "Bill",
+    subaccount id: "2f047cc0-4364-4d8b-ae70-b8bd39d15bf0",
+    logon name: "bill.jones@mail.com",
+    email: "bill.jones@mail.com",
+    grant type: "authorization_code",
+    authorities: "[openid]",
+    scopes: "[openid]"
 }
 ```
 
diff --git a/samples/spring-security-xsuaa-usage/manifest.yml b/samples/spring-security-xsuaa-usage/manifest.yml
index 87f7b629..a9b9f830 100644
--- a/samples/spring-security-xsuaa-usage/manifest.yml
+++ b/samples/spring-security-xsuaa-usage/manifest.yml
@@ -1,7 +1,7 @@
 ---
 # Configuration:
-# configured for EU10. For other landscapes, please adopt the destination
-# If the routes are occupied, you might need to change the host in sap-java-buildpack-api-usage, the host in approuter- sap-java-buildpack-api-usage and the url in the destination 
+# configured for EU10. For other landscapes, please adopt LANDSCAPE_APPS_DOMAIN in ../vars.yml
+# If the route is occupied, you might need to change ID in in ../vars.yml
 applications:
 # Application sap-java-buildpack-api-usage
 - name: spring-security-xsuaa-usage
diff --git a/samples/spring-security-xsuaa-usage/pom.xml b/samples/spring-security-xsuaa-usage/pom.xml
index 4f3b177a..231e0b4d 100644
--- a/samples/spring-security-xsuaa-usage/pom.xml
+++ b/samples/spring-security-xsuaa-usage/pom.xml
@@ -1,13 +1,13 @@
 <?xml version="1.0"?>
 <project
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"
-	xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+		xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"
+		xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
 	<modelVersion>4.0.0</modelVersion>
 	<parent>
 		<groupId>org.springframework.boot</groupId>
 		<artifactId>spring-boot-starter-parent</artifactId>
 		<version>2.1.0.RELEASE</version>
-		<relativePath />
+		<relativePath/>
 	</parent>
 
 	<artifactId>spring-security-xsuaa-usage</artifactId>
@@ -18,7 +18,6 @@
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 		<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
 		<java.version>1.8</java.version>
-		<spring-cloud.version>Finchley.RELEASE</spring-cloud.version>
 	</properties>
 
 	<dependencies>
@@ -38,17 +37,6 @@
 			<groupId>org.springframework.security</groupId>
 			<artifactId>spring-security-oauth2-resource-server</artifactId>
 		</dependency>
-		<dependency>
-			<groupId>org.springframework.security</groupId>
-			<artifactId>spring-security-test</artifactId>
-			<scope>test</scope>
-		</dependency>
-
-		<dependency>
-			<groupId>com.squareup.okhttp3</groupId>
-			<artifactId>mockwebserver</artifactId>
-			<version>3.9.1</version>
-		</dependency>
 		<dependency>
 			<groupId>com.sap.cloud.security.xsuaa</groupId>
 			<artifactId>spring-xsuaa</artifactId>
@@ -56,18 +44,6 @@
 		</dependency>
 	</dependencies>
 
-	<dependencyManagement>
-		<dependencies>
-			<dependency>
-				<groupId>org.springframework.cloud</groupId>
-				<artifactId>spring-cloud-dependencies</artifactId>
-				<version>${spring-cloud.version}</version>
-				<type>pom</type>
-				<scope>import</scope>
-			</dependency>
-		</dependencies>
-	</dependencyManagement>
-
 	<build>
 		<finalName>${project.artifactId}</finalName>
 
diff --git a/samples/spring-security-xsuaa-usage/src/main/java/sample/spring/xsuaa/SecurityConfiguration.java b/samples/spring-security-xsuaa-usage/src/main/java/sample/spring/xsuaa/SecurityConfiguration.java
index 10c27da2..046d410e 100644
--- a/samples/spring-security-xsuaa-usage/src/main/java/sample/spring/xsuaa/SecurityConfiguration.java
+++ b/samples/spring-security-xsuaa-usage/src/main/java/sample/spring/xsuaa/SecurityConfiguration.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2018 the original author or authors.
+ * Copyright 2002-2019 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,9 +18,13 @@ package sample.spring.xsuaa;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.PropertySource;
+import org.springframework.core.convert.converter.Converter;
+import org.springframework.security.authentication.AbstractAuthenticationToken;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.oauth2.jwt.Jwt;
 import org.springframework.security.oauth2.jwt.JwtDecoder;
 
 import com.sap.cloud.security.xsuaa.XsuaaServiceConfigurationDefault;
@@ -38,13 +42,29 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
 	@Override
 	protected void configure(HttpSecurity http) throws Exception {
 		// @formatter:off
-		http.authorizeRequests().antMatchers("/hello-token").hasAuthority("openid").
-		anyRequest().authenticated().and()
-				.oauth2ResourceServer().jwt()
-				.jwtAuthenticationConverter(new TokenAuthenticationConverter(xsuaaServiceConfiguration));
+		http
+			.sessionManagement()
+				.sessionCreationPolicy(SessionCreationPolicy.STATELESS) // session is created by approuter
+			.and()
+				.authorizeRequests()
+				.antMatchers("/hello-token").hasAuthority("openid")
+				.anyRequest().authenticated()
+			.and()
+				.oauth2ResourceServer()
+				.jwt()
+				.jwtAuthenticationConverter(getJwtAuthenticationConverter());
 		// @formatter:on
 	}
 
+	/**
+	 * Customizes how GrantedAuthority are derived from a Jwt
+	 */
+	Converter<Jwt, AbstractAuthenticationToken> getJwtAuthenticationConverter() {
+		TokenAuthenticationConverter converter = new TokenAuthenticationConverter(xsuaaServiceConfiguration);
+//		converter.setLocalScopeAsAuthorities(true);
+		return converter;
+	}
+
 	@Bean
 	JwtDecoder jwtDecoder() {
 		return new XsuaaJwtDecoderBuilder(xsuaaServiceConfiguration).build();
diff --git a/samples/spring-security-xsuaa-usage/src/main/resources/application.yml b/samples/spring-security-xsuaa-usage/src/main/resources/application.yml
index 09b38867..b3d0e591 100644
--- a/samples/spring-security-xsuaa-usage/src/main/resources/application.yml
+++ b/samples/spring-security-xsuaa-usage/src/main/resources/application.yml
@@ -1,9 +1,3 @@
-spring:
-  security:
-    oauth2:
-      resourceserver:
-        jwt:
-          jwk-set-uri: 
 server:
   port: 9999
 debug: true  
\ No newline at end of file
diff --git a/spring-xsuaa-mock/README.md b/spring-xsuaa-mock/README.md
index 4cf6b8cb..fa3a461c 100644
--- a/spring-xsuaa-mock/README.md
+++ b/spring-xsuaa-mock/README.md
@@ -1,11 +1,27 @@
-# XSUAA Security Xsuaa Mock library
+# XSUAA Security Xsuaa Mock Library
 
+## Description
 This library enhances the spring-xsuaa project. This includes a `XsuaaMockWebServer` web server for the Xsuaa service that can provide *token_keys* for an offline JWT token validation. This is required only when there is no Xsuaa service (OAuth resource-server) in place, which is only the case in context of unit tests, as well as when running your Spring boot application locally.
 
 The default implementation offers already valid *token_keys* for JWT tokens, that are generated by the [`JwtGenerator`](/spring-xsuaa-test/src/main/java/com/sap/cloud/security/xsuaa/test/JwtGenerator.java) (`spring-xsuaa-test` library).
 
-## Integrate in your Spring-Boot application
+## Requirements
+- Java 8
+- maven 3.3.9 or later
+- Spring Boot 2.1 and later
 
+## Configuration
+
+### Maven Dependency
+```xml
+<dependency>
+    <groupId>com.sap.cloud.security.xsuaa</groupId>
+    <artifactId>spring-xsuaa-mock</artifactId>
+    <version>1.2.0</version>
+</dependency>
+```
+
+### Setup Mock Web Server
 Add the following class, which makes sure, that the Xsuaa mock web server is only started in case a dedicated profile e.g. `uaamock` is active. Make sure that this profile (`uaamock`) is never active in production!
 
 ```java
@@ -27,8 +43,6 @@ public class XsuaaMockPostProcessor implements EnvironmentPostProcessor, Disposa
 }
 ```
 
-> Note: it is possible to enhance / overwrite the dispatcher and pass this to the `XsuaaMockWebServer` constructor. An example `XsuaaMockPostProcessor` implementation can be found [here](src/test/java/com/sap/cloud/security/xsuaa/mock/XsuaaMockPostProcessor.java).
-
 Then you have to register this class to `META-INF/spring.factories`:
 
 ```
@@ -38,3 +52,6 @@ org.springframework.boot.env.EnvironmentPostProcessor=<<your package>>.XsuaaMock
 
 And finally you need to configure the `spring.security.oauth2.resourceserver.jwt.jwk-set-uri`, the `xsuaa.url` and the `xsuaa.identityzoneid` properties in the same way as done in this [`application-uaamock.properties`](src/test/resources/application-uaamock.properties) file.
 
+
+### Extendability
+Note: it is possible to extend the dispatcher and pass this to the `XsuaaMockWebServer` constructor. An example `XsuaaMockPostProcessor` implementation can be found [here](src/test/java/com/sap/cloud/security/xsuaa/mock/XsuaaMockPostProcessor.java).
diff --git a/spring-xsuaa-mock/pom.xml b/spring-xsuaa-mock/pom.xml
index 65c7f876..8e4adfa5 100644
--- a/spring-xsuaa-mock/pom.xml
+++ b/spring-xsuaa-mock/pom.xml
@@ -1,166 +1,166 @@
 <?xml version="1.0"?>
 <project
-        xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"
-        xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
-    <modelVersion>4.0.0</modelVersion>
+		xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"
+		xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+	<modelVersion>4.0.0</modelVersion>
 
-    <parent>
-        <groupId>com.sap.cloud.security.xsuaa</groupId>
-        <artifactId>parent</artifactId>
-        <version>1.2.0</version>
-    </parent>
+	<parent>
+		<groupId>com.sap.cloud.security.xsuaa</groupId>
+		<artifactId>parent</artifactId>
+		<version>1.2.0</version>
+	</parent>
 
-    <artifactId>spring-xsuaa-mock</artifactId>
-    <name>spring-xsuaa-mock</name>
-    <packaging>jar</packaging>
+	<artifactId>spring-xsuaa-mock</artifactId>
+	<name>spring-xsuaa-mock</name>
+	<packaging>jar</packaging>
 
-    <dependencyManagement>
-        <dependencies>
-            <dependency>
-                <groupId>org.springframework.boot</groupId>
-                <artifactId>spring-boot-dependencies</artifactId>
-                <version>2.1.0.RELEASE</version>
-                <type>pom</type>
-                <scope>import</scope>
-            </dependency>
-        </dependencies>
-    </dependencyManagement>
+	<dependencyManagement>
+		<dependencies>
+			<dependency>
+				<groupId>org.springframework.boot</groupId>
+				<artifactId>spring-boot-dependencies</artifactId>
+				<version>2.1.0.RELEASE</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+		</dependencies>
+	</dependencyManagement>
 
-    <dependencies>
-        <dependency> <!-- XsuaaMockWebServer WebServer for offline Token validation-->
-            <groupId>org.springframework.security</groupId>
-            <artifactId>spring-security-oauth2-resource-server</artifactId>
-            <version>${spring.security.version}</version>
-        </dependency>
-        <dependency>
-            <groupId>com.squareup.okhttp3</groupId>
-            <artifactId>mockwebserver</artifactId>
-            <version>3.9.1</version>
-            <exclusions>
-                <exclusion>
-                    <groupId>org.bouncycastle</groupId>
-                    <artifactId>bcprov-jdk15on</artifactId>
-                </exclusion>
-            </exclusions>
-        </dependency>
-        <dependency>
-            <groupId>commons-io</groupId>
-            <artifactId>commons-io</artifactId>
-            <version>2.6</version>
-            <scope>provided</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.hamcrest</groupId>
-            <artifactId>hamcrest-all</artifactId>
-            <version>1.3</version>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-starter-web</artifactId>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-starter-test</artifactId>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.springframework.security</groupId>
-            <artifactId>spring-security-oauth2-jose</artifactId>
-            <version>5.2.0.BUILD-SNAPSHOT</version>
-        </dependency>
-        <dependency>
-            <groupId>org.springframework.security</groupId>
-            <artifactId>spring-security-jwt</artifactId>
-            <version>1.0.9.RELEASE</version>
-        </dependency>
-    </dependencies>
+	<dependencies>
+		<dependency> <!-- XsuaaMockWebServer WebServer for offline Token validation-->
+			<groupId>org.springframework.security</groupId>
+			<artifactId>spring-security-oauth2-resource-server</artifactId>
+			<scope>provided</scope>
+		</dependency>
+		<dependency>
+			<groupId>org.springframework.security</groupId>
+			<artifactId>spring-security-oauth2-jose</artifactId>
+			<scope>provided</scope>
+		</dependency>
+		<dependency>
+			<groupId>com.squareup.okhttp3</groupId>
+			<artifactId>mockwebserver</artifactId>
+			<version>3.9.1</version>
+			<exclusions>
+				<exclusion>
+					<groupId>org.bouncycastle</groupId>
+					<artifactId>bcprov-jdk15on</artifactId>
+				</exclusion>
+			</exclusions>
+		</dependency>
+		<dependency>
+			<groupId>org.springframework.security</groupId>
+			<artifactId>spring-security-jwt</artifactId>
+			<version>1.0.9.RELEASE</version>
+		</dependency>
+		<dependency>
+			<groupId>commons-io</groupId>
+			<artifactId>commons-io</artifactId>
+			<version>2.6</version>
+			<scope>compile</scope>
+		</dependency>
+		<dependency>
+			<groupId>org.hamcrest</groupId>
+			<artifactId>hamcrest-all</artifactId>
+			<version>1.3</version>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter-web</artifactId>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter-test</artifactId>
+			<scope>test</scope>
+		</dependency>
+	</dependencies>
 
-    <build>
-        <plugins>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-javadoc-plugin</artifactId>
-                <executions>
-                    <execution>
-                        <id>attach-javadocs</id>
-                        <goals>
-                            <goal>jar</goal>
-                        </goals>
-                    </execution>
-                </executions>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-source-plugin</artifactId>
-                <executions>
-                    <execution>
-                        <id>attach-sources</id>
-                        <goals>
-                            <goal>jar</goal>
-                        </goals>
-                    </execution>
-                </executions>
-            </plugin>
-            <plugin>
-                <groupId>org.jacoco</groupId>
-                <artifactId>jacoco-maven-plugin</artifactId>
-                <version>0.8.2</version>
-                <executions>
-                    <execution>
-                        <id>default-prepare-agent</id>
-                        <goals>
-                            <goal>prepare-agent</goal>
-                        </goals>
-                    </execution>
-                    <execution>
-                        <id>default-report</id>
-                        <phase>prepare-package</phase>
-                        <goals>
-                            <goal>report</goal>
-                        </goals>
-                    </execution>
-                    <execution>
-                        <id>default-check</id>
-                        <goals>
-                            <goal>check</goal>
-                        </goals>
-                        <configuration>
-                            <rules>
-                            </rules>
-                        </configuration>
-                    </execution>
-                </executions>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-pmd-plugin</artifactId>
-                <version>3.10.0</version>
-                <executions>
-                    <execution>
-                        <phase>verify</phase>
-                        <goals>
-                            <goal>pmd</goal>
-                            <goal>cpd</goal>
-                        </goals>
-                    </execution>
-                </executions>
-            </plugin>
-            <plugin>
-                <groupId>org.codehaus.mojo</groupId>
-                <artifactId>findbugs-maven-plugin</artifactId>
-                <version>3.0.5</version>
-                <executions>
-                    <execution>
-                        <phase>verify</phase>
-                        <goals>
-                            <goal>findbugs</goal>
-                        </goals>
-                    </execution>
-                </executions>
-            </plugin>
-        </plugins>
-    </build>
+	<build>
+		<plugins>
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-javadoc-plugin</artifactId>
+				<executions>
+					<execution>
+						<id>attach-javadocs</id>
+						<goals>
+							<goal>jar</goal>
+						</goals>
+					</execution>
+				</executions>
+			</plugin>
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-source-plugin</artifactId>
+				<executions>
+					<execution>
+						<id>attach-sources</id>
+						<goals>
+							<goal>jar</goal>
+						</goals>
+					</execution>
+				</executions>
+			</plugin>
+			<plugin>
+				<groupId>org.jacoco</groupId>
+				<artifactId>jacoco-maven-plugin</artifactId>
+				<version>0.8.2</version>
+				<executions>
+					<execution>
+						<id>default-prepare-agent</id>
+						<goals>
+							<goal>prepare-agent</goal>
+						</goals>
+					</execution>
+					<execution>
+						<id>default-report</id>
+						<phase>prepare-package</phase>
+						<goals>
+							<goal>report</goal>
+						</goals>
+					</execution>
+					<execution>
+						<id>default-check</id>
+						<goals>
+							<goal>check</goal>
+						</goals>
+						<configuration>
+							<rules>
+							</rules>
+						</configuration>
+					</execution>
+				</executions>
+			</plugin>
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-pmd-plugin</artifactId>
+				<version>3.10.0</version>
+				<executions>
+					<execution>
+						<phase>verify</phase>
+						<goals>
+							<goal>pmd</goal>
+							<goal>cpd</goal>
+						</goals>
+					</execution>
+				</executions>
+			</plugin>
+			<plugin>
+				<groupId>org.codehaus.mojo</groupId>
+				<artifactId>findbugs-maven-plugin</artifactId>
+				<version>3.0.5</version>
+				<executions>
+					<execution>
+						<phase>verify</phase>
+						<goals>
+							<goal>findbugs</goal>
+						</goals>
+					</execution>
+				</executions>
+			</plugin>
+		</plugins>
+	</build>
 
 </project>
diff --git a/spring-xsuaa/README.md b/spring-xsuaa/README.md
index 3429a658..ad00b10d 100644
--- a/spring-xsuaa/README.md
+++ b/spring-xsuaa/README.md
@@ -4,25 +4,31 @@
 
 This library enhances the [spring-security](https://github.com/spring-projects/spring-security/) project. As of version 5 of spring-security, this includes the OAuth resource-server functionality. A Spring boot application needs a security configuration class that enables the resource server and configures authentication using JWT tokens.
 
-## Setup
-Set the property source for xsuaa service binding on the application:
-
-```java
-@SpringBootApplication
-@ComponentScan
-public class Application {
-
-    public static void main(String[] args) {
-        SpringApplication.run(Application.class, args);
-    }
-
-    @Bean
-    XsuaaServiceConfigurationDefault xsuaaDefaultConfig() {
-        return new XsuaaServiceConfigurationDefault();
-    }
-}
+## Configuration
+
+### Maven Dependencies
+```xml
+<dependency>
+    <groupId>org.springframework.security</groupId>
+    <artifactId>spring-security-oauth2-jose</artifactId>
+</dependency>
+<dependency>
+    <groupId>org.springframework.security</groupId>
+    <artifactId>spring-security-config</artifactId>
+</dependency>
+<dependency>
+    <groupId>org.springframework.security</groupId>
+    <artifactId>spring-security-oauth2-resource-server</artifactId>
+</dependency>
+<dependency>
+    <groupId>com.sap.cloud.security.xsuaa</groupId>
+    <artifactId>spring-xsuaa</artifactId>
+    <version>1.2.0</version>
+</dependency>
 ```
 
+
+### Setup
 Configure the OAuth resource server
 
 ```java
@@ -37,26 +43,34 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
     @Override
     protected void configure(HttpSecurity http) throws Exception {
         // @formatter:off
-        http.authorizeRequests()
+        http
+            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
+        .and()
+            .authorizeRequests()
             .antMatchers("/hello-token/**").hasAuthority("Read") // checks whether it has scope "<xsappId>.Read"
             .antMatchers("/actuator/**").authenticated()
             .anyRequest().denyAll()
         .and()
             .oauth2ResourceServer()
             .jwt()
-            .decoder(jwtDecoder())
-            .jwtAuthenticationConverter(jwtAuthenticationConverter());
+            .jwtAuthenticationConverter(getJwtAuthoritiesConverter());
         // @formatter:on
     }
 
+    Converter<Jwt, AbstractAuthenticationToken> getJwtAuthoritiesConverter() {
+        TokenAuthenticationConverter converter = new TokenAuthenticationConverter(xsuaaServiceConfiguration);
+        converter.setLocalScopeAsAuthorities(true);
+        return converter;
+    }
+
     @Bean
     JwtDecoder jwtDecoder() {
         return new XsuaaJwtDecoderBuilder(xsuaaServiceConfiguration).build();
     }
 
     @Bean
-    Converter<Jwt, AbstractAuthenticationToken> jwtAuthenticationConverter() {
-        return new TokenAuthenticationConverter(xsuaaServiceConfiguration);
+    XsuaaServiceConfigurationDefault xsuaaConfig() {
+        return new XsuaaServiceConfigurationDefault();
     }
 }
 ```
diff --git a/spring-xsuaa/pom.xml b/spring-xsuaa/pom.xml
index c8a83bee..03afa520 100644
--- a/spring-xsuaa/pom.xml
+++ b/spring-xsuaa/pom.xml
@@ -24,7 +24,7 @@
 		<dependency>
 			<groupId>org.springframework.security</groupId>
 			<artifactId>spring-security-oauth2-jose</artifactId>
-			<version>${spring.core.version}</version>
+			<version>${spring.security.version}</version>
 			<scope>provided</scope>
 		</dependency>
 		<dependency>
diff --git a/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/AuthenticationToken.java b/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/AuthenticationToken.java
index 500f5cf5..79244419 100644
--- a/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/AuthenticationToken.java
+++ b/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/AuthenticationToken.java
@@ -1,11 +1,11 @@
 package com.sap.cloud.security.xsuaa.token;
 
+import java.util.Collection;
+
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.oauth2.jwt.Jwt;
 import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
 
-import java.util.Collection;
-
 public class AuthenticationToken extends JwtAuthenticationToken {
 
 	String appId;
@@ -17,7 +17,9 @@ public class AuthenticationToken extends JwtAuthenticationToken {
 
 	@Override
 	public Object getPrincipal() {
-		return new TokenImpl(getToken(), appId);
+		TokenImpl token = new TokenImpl(getToken(), appId);
+		token.setAuthorities(this.getAuthorities());
+		return token;
 	}
 
 }
diff --git a/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/Token.java b/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/Token.java
index 132bbb76..75cacb54 100644
--- a/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/Token.java
+++ b/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/Token.java
@@ -1,12 +1,12 @@
 package com.sap.cloud.security.xsuaa.token;
 
-import java.net.URISyntaxException;
-import java.util.Collection;
-
+import com.sap.xsa.security.container.XSTokenRequest;
 import org.springframework.lang.Nullable;
+import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.userdetails.UserDetails;
 
-import com.sap.xsa.security.container.XSTokenRequest;
+import java.net.URISyntaxException;
+import java.util.Collection;
 
 public interface Token extends UserDetails {
 	String CLAIM_XS_USER_ATTRIBUTES = "xs.user.attributes";
@@ -87,8 +87,7 @@ public interface Token extends UserDetails {
 	/**
 	 * User attribute
 	 *
-	 * @param attributeName
-	 *            name of the attribute
+	 * @param attributeName name of the attribute
 	 * @return attribute values array
 	 */
 	@Nullable
@@ -98,8 +97,7 @@ public interface Token extends UserDetails {
 	 * Additional custom authentication attributes included by the OAuth client component. Note: this is data controlled by the requester of a token.
 	 * Might be not trustworthy.
 	 *
-	 * @param attributeName
-	 *            name of the authentication attribute
+	 * @param attributeName name of the authentication attribute
 	 * @return additional attribute value
 	 */
 	@Nullable
@@ -115,7 +113,7 @@ public interface Token extends UserDetails {
 
 	/**
 	 * Get the encoded authentication token, e.g. for token forwarding to another app.
-	 *
+	 * <p>
 	 * Never expose this token via log or via HTTP.
 	 *
 	 * @return token
@@ -125,18 +123,27 @@ public interface Token extends UserDetails {
 	/**
 	 * Exchange a token into a token from another service instance
 	 *
-	 * @param tokenRequest
-	 *            request data
-	 * @throws URISyntaxException
-	 *             in case of wron URLs
+	 * @param tokenRequest request data
 	 * @return requested token
+	 * @throws URISyntaxException in case of wron URLs
 	 */
 	String requestToken(XSTokenRequest tokenRequest) throws URISyntaxException;
 
 	/**
-	 * Returns list of scopes with appId prefix, e.g. "&lt;my-xsapp!123&gt;.Display"
-	 * 
+	 * Returns list of scopes with appId prefix, e.g. "&lt;my-xsapp!123&gt;.Display".
+	 *
 	 * @return all scopes
 	 */
 	Collection<String> getScopes();
+
+	/**
+	 * Returns by default list of scopes {@link #getScopes()}.
+	 *
+	 * The default behavior can be adapted as part of
+	 * {@link com.sap.cloud.security.xsuaa.token.TokenAuthenticationConverter} class
+	 *
+	 * @return all authorities such as scopes or an empty list
+	 */
+	@Override
+	Collection<? extends GrantedAuthority> getAuthorities();
 }
\ No newline at end of file
diff --git a/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/TokenAuthenticationConverter.java b/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/TokenAuthenticationConverter.java
index 0981b73a..88bda730 100644
--- a/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/TokenAuthenticationConverter.java
+++ b/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/TokenAuthenticationConverter.java
@@ -15,11 +15,13 @@ import org.springframework.security.oauth2.jwt.Jwt;
 import com.sap.cloud.security.xsuaa.XsuaaServiceConfiguration;
 
 /**
- * Converter for xsuaa jwt token that stores authorization data like scopes inside the token.
+ * Converter for xsuaa jwt token that stores authorization data like scopes
+ * inside the token.
  */
 public class TokenAuthenticationConverter implements Converter<Jwt, AbstractAuthenticationToken> {
 
 	protected String appId;
+	protected boolean provideLocalScopesOnly;
 
 	public TokenAuthenticationConverter(String appId) {
 		this.appId = appId;
@@ -27,12 +29,28 @@ public class TokenAuthenticationConverter implements Converter<Jwt, AbstractAuth
 
 	public TokenAuthenticationConverter(XsuaaServiceConfiguration xsuaaServiceConfiguration) {
 		this.appId = xsuaaServiceConfiguration.getAppId();
+		this.provideLocalScopesOnly = false;
 	}
 
-	public final AbstractAuthenticationToken convert(Jwt jwt) {
+	@Override
+	public AbstractAuthenticationToken convert(Jwt jwt) {
 		return new AuthenticationToken(appId, jwt, extractAuthorities(jwt));
 	}
 
+	/**
+	 * This method allows to overwrite the default behavior of the
+	 * {@link Token#getAuthorities()} implementation.
+	 *
+	 * @param extractLocalScopesOnly
+	 *            true when {@link Token#getAuthorities()} should only extract local
+	 *            scopes. Local scopes means that non-application specific scopes
+	 *            are filtered out and scopes are returned without appId prefix,
+	 *            e.g. "Display".
+	 */
+	public void setLocalScopeAsAuthorities(boolean extractLocalScopesOnly) {
+		this.provideLocalScopesOnly = extractLocalScopesOnly;
+	}
+
 	protected Collection<GrantedAuthority> extractAuthorities(Jwt jwt) {
 		Collection<String> scopeAuthorities = getScopes(jwt);
 		Collection<String> customAuthorities = getCustomAuthorities(new TokenImpl(jwt, appId));
@@ -47,9 +65,17 @@ public class TokenAuthenticationConverter implements Converter<Jwt, AbstractAuth
 
 	protected Collection<String> getScopes(Jwt jwt) {
 		List<String> scopesList = jwt.getClaimAsStringList(Token.CLAIM_SCOPES);
-		if (scopesList != null) {
-			return scopesList.stream().filter(scope -> scope.startsWith(appId + ".")).map(scope -> scope.replace(appId + ".", "")).collect(Collectors.toList());
+		if (scopesList == null) {
+			return Collections.emptyList();
 		}
-		return Collections.emptyList();
+		if (provideLocalScopesOnly == true) {
+			return scopesList.stream()
+					.filter(scope -> scope.startsWith(appId + "."))
+					.map(scope -> scope.replaceFirst(appId + ".", ""))
+					.collect(Collectors.toList());
+		} else {
+			return scopesList.stream().collect(Collectors.toList());
+		}
+
 	}
 }
\ No newline at end of file
diff --git a/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/TokenImpl.java b/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/TokenImpl.java
index fb2589a5..a38f5907 100644
--- a/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/TokenImpl.java
+++ b/spring-xsuaa/src/main/java/com/sap/cloud/security/xsuaa/token/TokenImpl.java
@@ -47,6 +47,7 @@ public class TokenImpl implements Token {
 
 	private final Log logger = LogFactory.getLog(getClass());
 	private String appId = null;
+	private Collection<GrantedAuthority> authorities = Collections.emptyList();
 	private Jwt jwt;
 
 	/**
@@ -62,8 +63,7 @@ public class TokenImpl implements Token {
 
 	@Override
 	public Collection<? extends GrantedAuthority> getAuthorities() {
-		TokenAuthenticationConverter converter = new TokenAuthenticationConverter(appId);
-		return converter.extractAuthorities(jwt);
+		return this.authorities;
 	}
 
 	@Override
@@ -279,6 +279,11 @@ public class TokenImpl implements Token {
 		return jwt;
 	}
 
+	void setAuthorities(Collection<GrantedAuthority> authorities) {
+		Assert.notNull(authorities, "authorities are required");
+		this.authorities = authorities;
+	}
+
 	private void raiseMethodUnsupportedWhenClientCredentialGrantType(String method) {
 		String errorMessage = "Method %s() is not supported for grant type GRANTTYPE_CLIENTCREDENTIAL";
 		Assert.state(getGrantType() != GRANTTYPE_CLIENTCREDENTIAL, String.format(errorMessage, method));


Test patch:
diff --git a/samples/spring-security-basic-auth/src/main/java/sample/spring/xsuaa/TestController.java b/samples/spring-security-basic-auth/src/main/java/sample/spring/xsuaa/TestController.java
index 02e4e10f..4b35b9d7 100644
--- a/samples/spring-security-basic-auth/src/main/java/sample/spring/xsuaa/TestController.java
+++ b/samples/spring-security-basic-auth/src/main/java/sample/spring/xsuaa/TestController.java
@@ -37,7 +37,8 @@ public class TestController {
 		result.put("family name", token.getFamilyName());
 		result.put("given name", token.getGivenName());
 		result.put("email", token.getEmail());
-		result.put("token", token.getAppToken());
+		result.put("authorities", String.valueOf(token.getAuthorities()));
+		result.put("scopes", String.valueOf(token.getScopes()));
 
 		return result;
 	}
diff --git a/samples/spring-security-xsuaa-usage/src/main/java/sample/spring/xsuaa/TestController.java b/samples/spring-security-xsuaa-usage/src/main/java/sample/spring/xsuaa/TestController.java
index 02e4e10f..4b35b9d7 100644
--- a/samples/spring-security-xsuaa-usage/src/main/java/sample/spring/xsuaa/TestController.java
+++ b/samples/spring-security-xsuaa-usage/src/main/java/sample/spring/xsuaa/TestController.java
@@ -37,7 +37,8 @@ public class TestController {
 		result.put("family name", token.getFamilyName());
 		result.put("given name", token.getGivenName());
 		result.put("email", token.getEmail());
-		result.put("token", token.getAppToken());
+		result.put("authorities", String.valueOf(token.getAuthorities()));
+		result.put("scopes", String.valueOf(token.getScopes()));
 
 		return result;
 	}
diff --git a/spring-xsuaa-it/src/main/java/testservice/api/basic/SecurityConfiguration.java b/spring-xsuaa-it/src/main/java/testservice/api/basic/SecurityConfiguration.java
index 140b725a..a6c415e5 100644
--- a/spring-xsuaa-it/src/main/java/testservice/api/basic/SecurityConfiguration.java
+++ b/spring-xsuaa-it/src/main/java/testservice/api/basic/SecurityConfiguration.java
@@ -23,9 +23,12 @@ import org.springframework.cache.CacheManager;
 import org.springframework.cache.annotation.EnableCaching;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Profile;
+import org.springframework.core.convert.converter.Converter;
+import org.springframework.security.authentication.AbstractAuthenticationToken;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.oauth2.jwt.Jwt;
 import org.springframework.security.oauth2.jwt.JwtDecoder;
 
 import com.sap.cloud.security.xsuaa.XsuaaServiceConfiguration;
@@ -40,10 +43,10 @@ import com.sap.cloud.security.xsuaa.token.TokenAuthenticationConverter;
 public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
 
 	public static TokenBrokerResolver tokenBrokerResolver; //make static for tests
+
 	@Value("${mockxsuaaserver.url}")
 	String mockServerUrl;
 
-	
 	@Autowired
 	CacheManager cacheManager;
 
@@ -52,13 +55,21 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
 		tokenBrokerResolver =  new TokenBrokerResolver(getXsuaaServiceConfiguration(), cacheManager.getCache("token"),
 				AuthenticationMethod.BASIC);
 		// @formatter:off
-		http.authorizeRequests().antMatchers("/message/**").hasAuthority("SCOPE_openid").anyRequest().authenticated()
+		http.authorizeRequests()
+				.antMatchers("/user/**").hasAuthority("java-hello-world.Display")
+				.anyRequest().denyAll()
 				.and().oauth2ResourceServer()
 				.bearerTokenResolver(tokenBrokerResolver)
-				.jwt().jwtAuthenticationConverter(new TokenAuthenticationConverter(getXsuaaServiceConfiguration()));
+				.jwt().jwtAuthenticationConverter(getJwtAuthenticationConverter());
 		// @formatter:on
 	}
 
+	Converter<Jwt, AbstractAuthenticationToken> getJwtAuthenticationConverter() throws MalformedURLException {
+		TokenAuthenticationConverter converter = new TokenAuthenticationConverter(getXsuaaServiceConfiguration());
+		return converter;
+	}
+
+
 	@Bean
 	XsuaaServiceConfiguration getXsuaaServiceConfiguration() throws MalformedURLException {
 		return new MockXsuaaServiceConfiguration(mockServerUrl, "java-hello-world");
diff --git a/spring-xsuaa-it/src/main/java/testservice/api/v1/SecurityConfiguration.java b/spring-xsuaa-it/src/main/java/testservice/api/v1/SecurityConfiguration.java
index ea365085..7a514ad9 100644
--- a/spring-xsuaa-it/src/main/java/testservice/api/v1/SecurityConfiguration.java
+++ b/spring-xsuaa-it/src/main/java/testservice/api/v1/SecurityConfiguration.java
@@ -18,45 +18,53 @@ package testservice.api.v1;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Profile;
+import org.springframework.core.convert.converter.Converter;
+import org.springframework.security.authentication.AbstractAuthenticationToken;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.oauth2.jwt.Jwt;
 import org.springframework.security.oauth2.jwt.JwtDecoder;
 
 import com.sap.cloud.security.xsuaa.XsuaaServiceConfiguration;
-import com.sap.cloud.security.xsuaa.token.authentication.XsuaaJwtDecoderBuilder;
 import com.sap.cloud.security.xsuaa.token.TokenAuthenticationConverter;
+import com.sap.cloud.security.xsuaa.token.authentication.XsuaaJwtDecoderBuilder;
+
+import java.net.MalformedURLException;
 
 @Profile({ "test.api.v1" })
 @EnableWebSecurity
 public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
-	
+
 	@Value("${mockxsuaaserver.url}")
 	String mockServerUrl;
-	
+
 	@Override
 	protected void configure(HttpSecurity http) throws Exception {
 		// @formatter:off
-		http.authorizeRequests().
-			antMatchers("/message/**").
-			hasAuthority("SCOPE_openid").
-			anyRequest().
-			authenticated().and().oauth2ResourceServer().
-			jwt()
-				.jwtAuthenticationConverter(new TokenAuthenticationConverter(getXsuaaServiceConfiguration()));
+		http.authorizeRequests()
+				.antMatchers("/user/**").hasAuthority("Display")
+				.anyRequest().denyAll()
+			.and().oauth2ResourceServer()
+			.jwt()
+				.jwtAuthenticationConverter(getJwtAuthenticationConverter());
 		// @formatter:on
 	}
 
+	Converter<Jwt, AbstractAuthenticationToken> getJwtAuthenticationConverter() throws MalformedURLException {
+		TokenAuthenticationConverter converter = new TokenAuthenticationConverter(getXsuaaServiceConfiguration());
+		converter.setLocalScopeAsAuthorities(true);
+		return converter;
+	}
+
 	@Bean
-	XsuaaServiceConfiguration getXsuaaServiceConfiguration()
-	{
-		return new MockXsuaaServiceConfiguration(mockServerUrl,"java-hello-world");
+	XsuaaServiceConfiguration getXsuaaServiceConfiguration() {
+		return new MockXsuaaServiceConfiguration(mockServerUrl, "java-hello-world");
 	}
 
 	@Bean
-	JwtDecoder jwtDecoder() {	
+	JwtDecoder jwtDecoder() {
 		return new XsuaaJwtDecoderBuilder(getXsuaaServiceConfiguration()).build();
 	}
 
-
 }
diff --git a/spring-xsuaa-test/README.md b/spring-xsuaa-test/README.md
index 2308b319..cab9cb20 100644
--- a/spring-xsuaa-test/README.md
+++ b/spring-xsuaa-test/README.md
@@ -1,5 +1,6 @@
-# XSUAA Security Test library
+# XSUAA Security Test Library
 
+## Description
 This library enhances the `spring-xsuaa` project.
 This includes for example a `JwtGenerator` that generates JSON Web Tokens (JWT) that can be used for JUnit tests, as well as for local testing.
 
@@ -13,4 +14,22 @@ This includes for example a `JwtGenerator` that generates JSON Web Tokens (JWT)
 
  > In most cases the Jwt gets Base64 encoded and signed with this [private key](/src/main/resources/privateKey.txt).
 
+
+## Requirements
+- Java 8
+- maven 3.3.9 or later
+- Spring Boot 2.1 and later
+
+## Configuration
+
+### Maven Dependency
+```xml
+<dependency>
+    <groupId>com.sap.cloud.security.xsuaa</groupId>
+    <artifactId>spring-xsuaa-test</artifactId>
+    <version>1.2.0</version>
+</dependency>
+```
+
+## Usage
 Find examples on how to use the `JwtGenerator` [here](src/test/java/com/sap/cloud/security/xsuaa/test/JwtGeneratorTest.java).
\ No newline at end of file
diff --git a/spring-xsuaa-test/pom.xml b/spring-xsuaa-test/pom.xml
index 6e93fca3..15180f4a 100644
--- a/spring-xsuaa-test/pom.xml
+++ b/spring-xsuaa-test/pom.xml
@@ -31,13 +31,12 @@
 			<groupId>org.springframework.security</groupId>
 			<artifactId>spring-security-jwt</artifactId>
 			<version>1.0.9.RELEASE</version>
-			<scope>provided</scope>
 		</dependency>
 		<dependency>
 			<groupId>commons-io</groupId>
 			<artifactId>commons-io</artifactId>
 			<version>2.6</version>
-			<scope>provided</scope>
+			<scope>compile</scope>
 		</dependency>
 		<dependency>
 			<groupId>junit</groupId>
diff --git a/spring-xsuaa/src/test/java/com/sap/cloud/security/xsuaa/token/TokenAuthenticationConverterTest.java b/spring-xsuaa/src/test/java/com/sap/cloud/security/xsuaa/token/TokenAuthenticationConverterTest.java
index b4ee4af6..1091796e 100644
--- a/spring-xsuaa/src/test/java/com/sap/cloud/security/xsuaa/token/TokenAuthenticationConverterTest.java
+++ b/spring-xsuaa/src/test/java/com/sap/cloud/security/xsuaa/token/TokenAuthenticationConverterTest.java
@@ -17,21 +17,25 @@ import com.sap.cloud.security.xsuaa.test.JwtGenerator;
 
 public class TokenAuthenticationConverterTest {
 	private String xsAppName = "my-app-name!400";
-	private TokenAuthenticationConverter tokenConverter;
+	private TokenAuthenticationConverter tokenConverterDefault;
+	private TokenAuthenticationConverter tokenConverterLocalScopesOnly;
 	String scopeAdmin = xsAppName + "." + "Admin";
 	String scopeRead = xsAppName + "." + "Read";
 	String scopeOther = "other-app!234" + "." + "Other";
 
 	@Before
 	public void setup() {
-		tokenConverter = new TokenAuthenticationConverter(xsAppName);
+		tokenConverterDefault = new TokenAuthenticationConverter(xsAppName);
+
+		tokenConverterLocalScopesOnly = new TokenAuthenticationConverter(xsAppName);
+		tokenConverterLocalScopesOnly.setLocalScopeAsAuthorities(true);
 	}
 
 	@Test
 	public void extractAuthoritiesWithoutScopes() {
 		Jwt jwt = new JwtGenerator().getToken();
 
-		AbstractAuthenticationToken authenticationToken = tokenConverter.convert(jwt);
+		AbstractAuthenticationToken authenticationToken = tokenConverterDefault.convert(jwt);
 		assertThat(authenticationToken.getAuthorities().size(), is(0));
 	}
 
@@ -39,24 +43,25 @@ public class TokenAuthenticationConverterTest {
 	public void extractAuthoritiesIgnoresForeignScopes() {
 		Jwt jwt = new JwtGenerator().addScopes(scopeAdmin, scopeOther, scopeRead).getToken();
 
-		AbstractAuthenticationToken authenticationToken = tokenConverter.convert(jwt);
+		AbstractAuthenticationToken authenticationToken = tokenConverterLocalScopesOnly.convert(jwt);
 		assertThat(authenticationToken.getAuthorities().size(), is(2));
 		assertThat(authenticationToken.getAuthorities(), not(hasItem(new SimpleGrantedAuthority("Other"))));
 	}
 
 	@Test
 	public void extractAuthoritiesWithScopes() {
-		Jwt jwt = new JwtGenerator().addScopes(scopeAdmin, scopeRead).getToken();
+		Jwt jwt = new JwtGenerator().addScopes(scopeAdmin, scopeRead, scopeOther).getToken();
 
-		AbstractAuthenticationToken authenticationToken = tokenConverter.convert(jwt);
-		assertThat(authenticationToken.getAuthorities().size(), is(2));
-		assertThat(authenticationToken.getAuthorities(), hasItem(new SimpleGrantedAuthority("Read")));
-		assertThat(authenticationToken.getAuthorities(), hasItem(new SimpleGrantedAuthority("Admin")));
+		AbstractAuthenticationToken authenticationToken = tokenConverterDefault.convert(jwt);
+		assertThat(authenticationToken.getAuthorities().size(), is(3));
+		assertThat(authenticationToken.getAuthorities(), hasItem(new SimpleGrantedAuthority(scopeRead)));
+		assertThat(authenticationToken.getAuthorities(), hasItem(new SimpleGrantedAuthority(scopeAdmin)));
+		assertThat(authenticationToken.getAuthorities(), hasItem(new SimpleGrantedAuthority(scopeOther)));
 	}
 
 	@Test
 	public void extractCustomAuthoritiesWithScopes() {
-		tokenConverter = new MyTokenAuthenticationConverter(xsAppName, "cost-center", "country");
+		TokenAuthenticationConverter tokenConverterCustom = new MyTokenAuthenticationConverter(xsAppName, "cost-center", "country");
 
 		Jwt jwt = new JwtGenerator()
 				.addScopes(scopeAdmin)
@@ -64,12 +69,29 @@ public class TokenAuthenticationConverterTest {
 				.addAttribute("country", new String[] { "DE", "IL" })
 				.getToken();
 
-		AbstractAuthenticationToken authenticationToken = tokenConverter.convert(jwt);
+		AbstractAuthenticationToken authenticationToken = tokenConverterCustom.convert(jwt);
 		assertThat(authenticationToken.getAuthorities().size(), is(4));
 		assertThat(authenticationToken.getAuthorities(), hasItem(new SimpleGrantedAuthority("ATTR:COST-CENTER=0815")));
 		assertThat(authenticationToken.getAuthorities(), hasItem(new SimpleGrantedAuthority("ATTR:COUNTRY=DE")));
 		assertThat(authenticationToken.getAuthorities(), hasItem(new SimpleGrantedAuthority("ATTR:COUNTRY=IL")));
-		assertThat(authenticationToken.getAuthorities(), hasItem(new SimpleGrantedAuthority("Admin")));
+		assertThat(authenticationToken.getAuthorities(), hasItem(new SimpleGrantedAuthority(scopeAdmin)));
+	}
+
+	@Test
+	public void authoritiesHaveLocalScopesWithoutAppIdPrefix() {
+		String scopeWithNamespace = xsAppName + ".iot.Delete";
+		String scopeWithOtherAppId = "anyAppId!200."+ xsAppName + ".iot.Delete";
+
+		Jwt jwt = new JwtGenerator()
+				.addScopes(xsAppName + "." + scopeAdmin, scopeRead, scopeWithNamespace, scopeWithOtherAppId)
+				.getToken();
+
+		AbstractAuthenticationToken authenticationToken = tokenConverterLocalScopesOnly.convert(jwt);
+
+		assertThat(authenticationToken.getAuthorities().size(), is(3));
+		assertThat(authenticationToken.getAuthorities(), hasItem(new SimpleGrantedAuthority(scopeAdmin)));
+		assertThat(authenticationToken.getAuthorities(), hasItem(new SimpleGrantedAuthority("iot.Delete")));
+		assertThat(authenticationToken.getAuthorities(), hasItem(new SimpleGrantedAuthority("Read")));
 	}
 
 	private static class MyTokenAuthenticationConverter extends TokenAuthenticationConverter {
diff --git a/spring-xsuaa/src/test/java/com/sap/cloud/security/xsuaa/token/TokenImplTest.java b/spring-xsuaa/src/test/java/com/sap/cloud/security/xsuaa/token/TokenImplTest.java
index ea9d5ef2..0d2f596c 100644
--- a/spring-xsuaa/src/test/java/com/sap/cloud/security/xsuaa/token/TokenImplTest.java
+++ b/spring-xsuaa/src/test/java/com/sap/cloud/security/xsuaa/token/TokenImplTest.java
@@ -78,14 +78,20 @@ public class TokenImplTest {
 	}
 
 	@Test
-	public void getAuthoritiesReturnsApplicationScopes() {
+	public void authenticationConverterShouldSetAuthorities() {
+		TokenAuthenticationConverter converter = new TokenAuthenticationConverter(xsAppName);
+		converter.setLocalScopeAsAuthorities(true);
+
 		List<String> scopesList = new ArrayList<>();
 		scopesList.add(scopeWrite);
 		scopesList.add(scopeRead);
 		scopesList.add(scopeOther);
 		claimsSetBuilder.claim("scope", scopesList);
 
-		token = createToken(claimsSetBuilder);
+		Jwt jwt = JwtGenerator.createFromClaims(claimsSetBuilder.build());
+
+		AuthenticationToken authToken = (AuthenticationToken) converter.convert(jwt);
+		token = (Token) authToken.getPrincipal();
 
 		Collection<GrantedAuthority> authorities = (Collection<GrantedAuthority>) token.getAuthorities();
 		assertThat(authorities.size(), is(2));
@@ -93,6 +99,20 @@ public class TokenImplTest {
 		assertThat(authorities, hasItem(new SimpleGrantedAuthority("Write")));
 	}
 
+	@Test
+	public void getAuthoritiesReturnsSetAuthorities() {
+		Collection<GrantedAuthority> authorities = new ArrayList<>();
+		authorities.add(new SimpleGrantedAuthority(scopeRead));
+		authorities.add(new SimpleGrantedAuthority(scopeOther));
+
+		TokenImpl token = new TokenImpl(jwtSaml, xsAppName);
+		token.setAuthorities(authorities);
+
+		Collection<GrantedAuthority> actAuthorities = (Collection<GrantedAuthority>) token.getAuthorities();
+		assertThat(actAuthorities.size(), is(2));
+		assertThat(actAuthorities, hasItem(new SimpleGrantedAuthority(scopeOther)));
+	}
+
 	@Test
 	public void getScopesReturnsAllScopes() {
 		List<String> scopesList = new ArrayList<>();
@@ -186,16 +206,6 @@ public class TokenImplTest {
 		Assert.assertEquals("client/sb-java-hello-world", token.getUsername());
 	}
 
-	@Test
-	public void getAuthoritiesReturnsAllAppScopes() {
-		Token token = new TokenImpl(jwtSaml, "java-hello-world");
-		Collection<GrantedAuthority> authorities = (Collection<GrantedAuthority>) token.getAuthorities();
-		assertThat(authorities.size(), is(3)); // no openid scope
-		assertThat(authorities, hasItem(new SimpleGrantedAuthority("Delete")));
-		assertThat(authorities, hasItem(new SimpleGrantedAuthority("Display")));
-		assertThat(authorities, hasItem(new SimpleGrantedAuthority("Create")));
-	}
-
 	@Test
 	public void getXsUserAttributeValues() {
 		Token token = new TokenImpl(jwtSaml, xsAppName);