title: Spring Boot 2.5.3 OAuth2 - Auth-Server and Webservice separate, after Login no endpont works
body: <p>Following the example on <a href="https://developer.okta.com/blog/2019/03/12/oauth2-spring-security-guide" rel="nofollow noreferrer">https://developer.okta.com/blog/2019/03/12/oauth2-spring-security-guide</a> using the projects <code>Create an OAuth 2.0 Server</code> and <code>Build Your Client App</code> after the login, any endpoint accessed jumps to the root endpoint <code>localhost:8082</code>.</p>
  <p>I don't use <code>Thymeleaf</code>, as my webservice returns data, not a page.</p>
  <p>OAuth 2.0 Server project</p>
  <pre><code>@SpringBootApplication
  @EnableResourceServer
  public class Demo2Application {
      public static void main(String[] args) {
          SpringApplication.run(Demo2Application.class, args);
      }
  }
  
  @Configuration
  @EnableAuthorizationServer
  public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
      private final PasswordEncoder passwordEncoder;
      
      public AuthorizationServerConfig(PasswordEncoder passwordEncoder) {
          this.passwordEncoder = passwordEncoder;
      }    
      
      @Override
      public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
          clients.inMemory()
              .withClient(&quot;abcd&quot;)
              .secret(passwordEncoder.encode(&quot;fDw7Mpkk5czHNuSRtmhGmAGL42CaxQB9&quot;))
              .authorizedGrantTypes(&quot;authorization_code&quot;)
              .scopes(&quot;user_info&quot;)
              .autoApprove(true)
              .redirectUris(&quot;http://localhost:8082/login/oauth2/code/&quot;);
      }
  
      @Override
      public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
          security
              .tokenKeyAccess(&quot;permitAll()&quot;)
              .checkTokenAccess(&quot;isAuthenticated()&quot;);;
      }
  }
  
  
  @Configuration
  @Order(1)
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.requestMatchers()
              .antMatchers(&quot;/login&quot;, &quot;/oauth/authorize&quot;)
              .and()
              .authorizeRequests()
              .anyRequest().authenticated()
              .and()
              .formLogin().permitAll();
      }
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth.inMemoryAuthentication()
              .withUser(&quot;john&quot;)
              .password(passwordEncoder().encode(&quot;doe&quot;))
              .roles(&quot;USER&quot;);
      }
      
      @Bean
      public BCryptPasswordEncoder passwordEncoder() {
          return new BCryptPasswordEncoder();
      }    
  }
  
  @RestController
  public class UserController {
      @GetMapping(&quot;/user/me&quot;)
      public Principal user(Principal principal) {
          return principal;
      }    
  }
  
  application.properties
  server.port=8090
  
  pom.xml
  &lt;dependency&gt;
      &lt;groupId&gt;org.springframework.security.oauth&lt;/groupId&gt;
      &lt;artifactId&gt;spring-security-oauth2&lt;/artifactId&gt;
      &lt;version&gt;2.5.1.RELEASE&lt;/version&gt;
  &lt;/dependency&gt;     
  &lt;dependency&gt;
      &lt;groupId&gt;org.springframework.security.oauth.boot&lt;/groupId&gt;
      &lt;artifactId&gt;spring-security-oauth2-autoconfigure&lt;/artifactId&gt;
      &lt;version&gt;2.5.2&lt;/version&gt;
  &lt;/dependency&gt;           
  &lt;dependency&gt;
      &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
      &lt;artifactId&gt;spring-boot-starter-web&lt;/artifactId&gt;
  &lt;/dependency&gt;
  </code></pre>
  <p>I omit the context path, which the project originally uses.</p>
  <p>Webservice project</p>
  <pre><code>@RestController
  public class MyRESTController {
  
      @GetMapping(&quot;/securedPage&quot;)
      public String securedPage(Principal principal) {
          return &quot;securedPage&quot;;
      }
  
      @GetMapping(&quot;/&quot;)
      public String index(Principal principal) {
          return &quot;index&quot;;
      }   
  }
  
  @Configuration
  @EnableWebSecurity
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.antMatcher(&quot;/**&quot;).authorizeRequests()
              .antMatchers(&quot;/&quot;, &quot;/login**&quot;).permitAll()
              .anyRequest().authenticated()
              .and()
              .oauth2Login();
      }
  }
  
  
  application.properties
  server.port=8082
  server.servlet.session.cookie.name=UISESSION
  
  spring.security.oauth2.client.registration.custom-client.client-id=abcd
  spring.security.oauth2.client.registration.custom-client.client-secret=fDw7Mpkk5czHNuSRtmhGmAGL42CaxQB9
  spring.security.oauth2.client.registration.custom-client.client-name=Auth Server
  spring.security.oauth2.client.registration.custom-client.provider=custom-provider
  spring.security.oauth2.client.registration.custom-client.scope=user_info
  spring.security.oauth2.client.registration.custom-client.redirect-uri=http://localhost:8082/login/oauth2/code/
  spring.security.oauth2.client.registration.custom-client.client-authentication-method=basic
  spring.security.oauth2.client.registration.custom-client.authorization-grant-type=authorization_code
  
  spring.security.oauth2.client.provider.custom-provider.authorization-uri=http://localhost:8090/oauth/authorize
  spring.security.oauth2.client.provider.custom-provider.token-uri=http://localhost:8090/oauth/token
  spring.security.oauth2.client.provider.custom-provider.user-info-uri=http://localhost:8090/user/me
  spring.security.oauth2.client.provider.custom-provider.user-name-attribute=name
  
  pom.xml
  &lt;dependency&gt;
      &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
      &lt;artifactId&gt;spring-boot-starter-oauth2-client&lt;/artifactId&gt;
  &lt;/dependency&gt;
  &lt;dependency&gt;
      &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
      &lt;artifactId&gt;spring-boot-starter-web&lt;/artifactId&gt;
  &lt;/dependency&gt;
  </code></pre>
  <p>That works fine.</p>
  <p>Now, when I use the OAuth 2.0 Server project with my webservice project, means I add the application properties from the demo webservice project into my <code>application.properties</code> I cannot access any other endpoints but the root endpoint <code>http://localhost:8082</code>.</p>
  <p>I assume that the <code>WebSecurityConfig</code> in my webservice project is the reason for that. It looks like this:</p>
  <pre><code>@Configuration
  @EnableWebSecurity
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
      public static final String ROLE_MYUSER = &quot;MYUSER&quot;;
      public static final String ROLE_MYADMIN = &quot;MYADMIN&quot;;
      
      private MyUserProperties myUserProperties;
  
      public WebSecurityConfig(MyUserProperties myUserProperties) {
          // Load usernames and passwords from properties file
          this.myUserProperties = myUserProperties;
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              //.httpBasic()
              .and()
              .authorizeRequests()
                  .antMatchers(&quot;/&quot;).permitAll()
              
                  .antMatchers(&quot;/abc/**&quot;).hasRole(ROLE_MYUSER)
                  .mvcMatchers(HttpMethod.GET, &quot;/def1/{name}&quot;, &quot;/def2/{name}&quot;).hasRole(ROLE_MYUSER)
                  .mvcMatchers(HttpMethod.PATCH, &quot;/def/{name}&quot;, &quot;/def2/{name}&quot;).hasRole(ROLE_MYUSER)           
                  .antMatchers(&quot;/ghi/**&quot;).hasRole(ROLE_MYUSER)
                  //... and so on
              
                  .antMatchers(&quot;/**&quot;).hasRole(ROLE_MYADMIN)
              .and()
              .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
              .and()
              .oauth2Login();    
              //.csrf().disable()
              //.formLogin().disable();
      }    
  
      @Bean
      @Override
      public UserDetailsService userDetailsService() {
          UserDetails myuser = User
              .withUsername(myUserProperties.getPortal().get(&quot;user&quot;))
              .password(&quot;{noop}&quot; + myUserProperties.getPortal().get(&quot;pass&quot;))
              .roles(ROLE_MYUSER)
              .build();
  
          UserDetails myadmin = User
              .withUsername(myUserProperties.getAdmin().get(&quot;user&quot;))
              .password(&quot;{noop}&quot; + myUserProperties.getAdmin().get(&quot;pass&quot;))
              .roles(ROLE_MYUSER, ROLE_MYADMIN)
              .build();
  
          InMemoryUserDetailsManager userDetailsManager = new InMemoryUserDetailsManager();
  
          userDetailsManager.createUser(myuser);
          userDetailsManager.createUser(myadmin);
  
          return userDetailsManager;
      }   
  }
  </code></pre>
  <p>I had <code>Basic Auth</code> so far, I defined my two users with the two roles in a</p>
  <pre><code>@Bean
  @Override
  public UserDetailsService userDetailsService() {
  </code></pre>
  <p>Now switching to OAuth2 I removed in</p>
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
  </code></pre>
  <p>the lines</p>
  <pre><code>.httpBasic()
  .csrf().disable()
  .formLogin().disable()
  </code></pre>
  <p>and added</p>
  <pre><code>.oauth2Login()
  </code></pre>
  <p>The behavior in the web browser is the following</p>
  <pre><code>http://localhost:8082
  </code></pre>
  <p>delivers correctly the data from that root endpoint, without any login.</p>
  <p>Any other endpoint, like for example</p>
  <pre><code>http://localhost:8082/abc
  </code></pre>
  <p>first leads to the login page, where I enter the defined user <code>john / doe</code> from the OAuth 2.0 Server project, after that it doesn't show the expected data from the endpoint <code>http://localhost:8082/abc</code> , but jumps back to the root endpoint <code>http://localhost:8082</code>.</p>
  <p>The first step I tried is to place</p>
  <pre><code>@Bean
  @Override
  public UserDetailsService userDetailsService() {
  </code></pre>
  <p>in the OAuth 2.0 Server project, into the class</p>
  <pre><code>@Configuration
  @Order(1)
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
  </code></pre>
  <p>but with that the login didn't work, it only accepted <code>john / doe</code>.</p>
  <p>The next stept was to remove</p>
  <pre><code>@Bean
  @Override
  public UserDetailsService userDetailsService() {
  </code></pre>
  <p>also from that class and define my two users in</p>
  <pre><code>@Override
  protected void configure(AuthenticationManagerBuilder auth) throws Exception {
  </code></pre>
  <p>where <code>john / doe</code> was defined.</p>
  <p>The login with one of my users works now, but the wrong behavior still remains.
  What else has to be altered, and where?</p>
  <p>The access to the endpoints in my webservice project depends on the roles the user has.</p>
  <p>My <code>pom.xml</code></p>
  <pre><code>&lt;dependency&gt;
      &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
      &lt;artifactId&gt;spring-boot-starter-security&lt;/artifactId&gt;
  &lt;/dependency&gt;
  &lt;dependency&gt;
      &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
      &lt;artifactId&gt;spring-boot-starter-web&lt;/artifactId&gt;
  &lt;/dependency&gt;
  &lt;dependency&gt;
      &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
      &lt;artifactId&gt;spring-boot-starter-oauth2-client&lt;/artifactId&gt;
  &lt;/dependency&gt; 
  </code></pre>