Q: Spring Security - Adding a custom filter for Authorization we are implementing some api. 
The authentification is done in the Front, and it send us a Bearer in the authorization Header.
We have created a method with validates the token  (it calls some rest services xxx )  and another method with returns a list of roles that the user has .
Is it possible to create a filter that will do this verification ??
public class JWTAuthorizationFilter extends BasicAuthenticationFilter {
    @Override
    protected void doFilter(HttpServletRequest req,
                            HttpServletResponse res,
                            FilterChain chain) throws IOException, ServletException {

        System.out.println("IN FILTER");
        String header = req.getHeader("Authorization");

        if (header == null || !header.startsWith("Bearer")) {
            chain.doFilter(req, res);
            return;
        }
        String token = request.getHeader(HEADER_STRING);
        if (validateMyToken(token)) {
            List<String> mygroups = getMyGroups(token);
        } else {
            throw new InvalidTokenException("Token is not Ok :(");
        }

        #HOW DO I PUT MY GROUPS, SOMEWHERE  FOR VERIFICATION ???
    }
} 

And use it in my controller :
@RestController
@RequestMapping(value = "/applications/")
public class TestController {

    @PreAuthorize("hasRole('ROLE_ADMIN')")
    @GetMapping(value = "/test")
    public String getContacts() {

        System.out.println("IN CONTROLLER");
        return "toto";
    }
}

I know I have to do something in WebSecurity, but don't know how

A: You need to create a custom UserDetails implementation https://docs.spring.io/spring-security/site/docs/4.2.6.RELEASE/apidocs/org/springframework/security/core/userdetails/UserDetails.html . After that create a proper Authorities collection according to your List<String> mygroups = getMyGroups(token);. If you want to secure methods with roles just mark them with @Secured / @RolesAllowed or just like you wrote with @PreAuthorize("hasRole('ROLE_ADMIN')")
