OAuth2AuthenticationToken против OAuth2Authentication

Question

1-В чем разница между OAuth2AuthenticationToken и OAuth2Authentication?

2-В моем клиентском веб-приложении весенней загрузки для реализации я использовал зависимость "spring-boot-starter-oauth2-client" (singleвойдите в систему) sso с сервером авторизации, поэтому основным в клиентском приложении является OAuth2AuthenticationToken. Это верно?

3-я не мог использовать @PreAuthorize (# oauth2.hasScope ('xxx')), потому что он работает на OAuth2Authentication, а не на OAuth2AuthenticationToken, почему? Buth Когда я использую @PreAuthorize (hasRole ('SomeRole')), все работает нормально.

4 - Вот пример объекта аутентификации (Принципал)

{
    "authorities": [
        {
            "authority": "ROLE_USER",
            "attributes": {
                "authorities": [
                    {
                        "authority": "ROLE_ADMINISTRATORS"
                    }
                ],
                "details": {
                    "remoteAddress": "127.0.0.1",
                    "sessionId": null,
                    "tokenValue": "184dd32f-7c70-4bf5-9d7f-43c8d565f996",
                    "tokenType": "Bearer",
                    "decodedDetails": null
                },
                "authenticated": true,
                "userAuthentication": {
                    "authorities": [
                        {
                            "authority": "ROLE_ADMINISTRATORS"
                        }
                    ],
                    "details": {
                        "remoteAddress": "0:0:0:0:0:0:0:1",
                        "sessionId": "A9ADB8153471994D338F0FDEAF98FF07"
                    },
                    "authenticated": true,
                    "principal": {
                        "enabled": true,
                        "password": null,
                        "username": "bob",
                        "dn": "uid=bob,ou=people,dc=springframework,dc=org",
                        "authorities": [
                            {
                                "authority": "ROLE_ADMINISTRATORS"
                            }
                        ],
                        "accountNonLocked": true,
                        "credentialsNonExpired": true,
                        "accountNonExpired": true
                    },
                    "credentials": null,
                    "name": "bob"
                },
                "principal": {
                    "enabled": true,
                    "password": null,
                    "username": "bob",
                    "dn": "uid=bob,ou=people,dc=springframework,dc=org",
                    "authorities": [
                        {
                            "authority": "ROLE_ADMINISTRATORS"
                        }
                    ],
                    "accountNonLocked": true,
                    "credentialsNonExpired": true,
                    "accountNonExpired": true
                },
                "oauth2Request": {
                    "clientId": "demo",
                    "scope": [
                        "demo_scope"
                    ],
                    "requestParameters": {
                        "code": "yymxbk",
                        "grant_type": "authorization_code",
                        "scope": "demo_scope",
                        "response_type": "code",
                        "state": "osBji_UdByl9XG5O4Jy3lavSHSiU1FRo-knhY7gTsI8=",
                        "redirect_uri": "http:\/\/localhost:8081\/login\/oauth2\/code\/",
                        "client_id": "demo"
                    },
                    "resourceIds": [
                        "demo_resource",
                        "auth_resource"
                    ],
                    "authorities": [
                        {
                            "authority": "demo_auth"
                        }
                    ],
                    "approved": true,
                    "refresh": false,
                    "redirectUri": "http:\/\/localhost:8081\/login\/oauth2\/code\/",
                    "responseTypes": [
                        "code"
                    ],
                    "extensions": {},
                    "grantType": "authorization_code",
                    "refreshTokenRequest": null
                },
                "credentials": "",
                "clientOnly": false,
                "name": "bob"
            }
        }
    ],
    "details": null,
    "authenticated": true,
    "principal": {
        "authorities": [
            {
                "authority": "ROLE_USER",
                "attributes": {
                    "authorities": [
                        {
                            "authority": "ROLE_ADMINISTRATORS"
                        }
                    ],
                    "details": {
                        "remoteAddress": "127.0.0.1",
                        "sessionId": null,
                        "tokenValue": "184dd32f-7c70-4bf5-9d7f-43c8d565f996",
                        "tokenType": "Bearer",
                        "decodedDetails": null
                    },
                    "authenticated": true,
                    "userAuthentication": {
                        "authorities": [
                            {
                                "authority": "ROLE_ADMINISTRATORS"
                            }
                        ],
                        "details": {
                            "remoteAddress": "0:0:0:0:0:0:0:1",
                            "sessionId": "A9ADB8153471994D338F0FDEAF98FF07"
                        },
                        "authenticated": true,
                        "principal": {
                            "enabled": true,
                            "password": null,
                            "username": "bob",
                            "dn": "uid=bob,ou=people,dc=springframework,dc=org",
                            "authorities": [
                                {
                                    "authority": "ROLE_ADMINISTRATORS"
                                }
                            ],
                            "accountNonLocked": true,
                            "credentialsNonExpired": true,
                            "accountNonExpired": true
                        },
                        "credentials": null,
                        "name": "bob"
                    },
                    "principal": {
                        "enabled": true,
                        "password": null,
                        "username": "bob",
                        "dn": "uid=bob,ou=people,dc=springframework,dc=org",
                        "authorities": [
                            {
                                "authority": "ROLE_ADMINISTRATORS"
                            }
                        ],
                        "accountNonLocked": true,
                        "credentialsNonExpired": true,
                        "accountNonExpired": true
                    },
                    "oauth2Request": {
                        "clientId": "demo",
                        "scope": [
                            "demo_scope"
                        ],
                        "requestParameters": {
                            "code": "yymxbk",
                            "grant_type": "authorization_code",
                            "scope": "demo_scope",
                            "response_type": "code",
                            "state": "osBji_UdByl9XG5O4Jy3lavSHSiU1FRo-knhY7gTsI8=",
                            "redirect_uri": "http:\/\/localhost:8081\/login\/oauth2\/code\/",
                            "client_id": "demo"
                        },
                        "resourceIds": [
                            "demo_resource",
                            "auth_resource"
                        ],
                        "authorities": [
                            {
                                "authority": "demo_auth"
                            }
                        ],
                        "approved": true,
                        "refresh": false,
                        "redirectUri": "http:\/\/localhost:8081\/login\/oauth2\/code\/",
                        "responseTypes": [
                            "code"
                        ],
                        "extensions": {},
                        "grantType": "authorization_code",
                        "refreshTokenRequest": null
                    },
                    "credentials": "",
                    "clientOnly": false,
                    "name": "bob"
                }
            }
        ],
        "attributes": {
            "authorities": [
                {
                    "authority": "ROLE_ADMINISTRATORS"
                }
            ],
            "details": {
                "remoteAddress": "127.0.0.1",
                "sessionId": null,
                "tokenValue": "184dd32f-7c70-4bf5-9d7f-43c8d565f996",
                "tokenType": "Bearer",
                "decodedDetails": null
            },
            "authenticated": true,
            "userAuthentication": {
                "authorities": [
                    {
                        "authority": "ROLE_ADMINISTRATORS"
                    }
                ],
                "details": {
                    "remoteAddress": "0:0:0:0:0:0:0:1",
                    "sessionId": "A9ADB8153471994D338F0FDEAF98FF07"
                },
                "authenticated": true,
                "principal": {
                    "enabled": true,
                    "password": null,
                    "username": "bob",
                    "dn": "uid=bob,ou=people,dc=springframework,dc=org",
                    "authorities": [
                        {
                            "authority": "ROLE_ADMINISTRATORS"
                        }
                    ],
                    "accountNonLocked": true,
                    "credentialsNonExpired": true,
                    "accountNonExpired": true
                },
                "credentials": null,
                "name": "bob"
            },
            "principal": {
                "enabled": true,
                "password": null,
                "username": "bob",
                "dn": "uid=bob,ou=people,dc=springframework,dc=org",
                "authorities": [
                    {
                        "authority": "ROLE_ADMINISTRATORS"
                    }
                ],
                "accountNonLocked": true,
                "credentialsNonExpired": true,
                "accountNonExpired": true
            },
            "oauth2Request": {
                "clientId": "demo",
                "scope": [
                    "demo_scope"
                ],
                "requestParameters": {
                    "code": "yymxbk",
                    "grant_type": "authorization_code",
                    "scope": "demo_scope",
                    "response_type": "code",
                    "state": "osBji_UdByl9XG5O4Jy3lavSHSiU1FRo-knhY7gTsI8=",
                    "redirect_uri": "http:\/\/localhost:8081\/login\/oauth2\/code\/",
                    "client_id": "demo"
                },
                "resourceIds": [
                    "demo_resource",
                    "auth_resource"
                ],
                "authorities": [
                    {
                        "authority": "demo_auth"
                    }
                ],
                "approved": true,
                "refresh": false,
                "redirectUri": "http:\/\/localhost:8081\/login\/oauth2\/code\/",
                "responseTypes": [
                    "code"
                ],
                "extensions": {},
                "grantType": "authorization_code",
                "refreshTokenRequest": null
            },
            "credentials": "",
            "clientOnly": false,
            "name": "bob"
        },
        "name": "bob"
    },
    "authorizedClientRegistrationId": "custom-client",
    "credentials": "",
    "name": "bob"
}

Что это за поля? Почему существует некоторая избыточная информация? Почему существует несколько прав доступа с разными значениями?

5 - Если я перешел на использование JWT на сервере авторизации, нужно ли что-то менять на клиенте? приложение?

Спасибо