...
Finally OAuthDataProvider may need to convert opaque scope values such as "readCalendar" into a list of OAuthPermissions. AuthorizationCodeGrantService and OAuth2 security filters will depend on it (assuming scopes are used in the first place). In the former case AuthorizationCodeGrantService will use this list to populate OAuthAuthorizationData - the reason this bean only sees Permissions is that some of the properties OAuthPermission keeps are of no interest to OAuthAuthorizationData handlers.
Default Providers
Starting from CXF 3.0.2 default Ehcache-based OAuthDataProvider and AuthorizationCodeDataProvider implementations are shipped:
org.apache.cxf.rs.security.oauth2.grants.code.DefaultEHCacheCodeDataProvider and org.apache.cxf.rs.security.oauth2.provider.DefaultEHCacheOAuthDataProvider.
Users who are happy with using EHCache are encouraged to experiment with these default providers, customize them if needed and provide the feedback.
OAuth Server JAX-RS endpoints
...
