This sample application shows how spring security works :)
There are 4 resources
1 public resource : no authorization needed can be accessed

2 Admin resource which can be only accessed by users having ADMIN authority
3 User resource can be accessed by USER as well as ADMIN
Auth controller creates JWTs. If role= admin the creates JWT with authority ADMIN else USER

Ideally Auth controller will have a more complex logic like getting authority from LDAP etc but for this POC this is OK :)