title: Spring Security OAuth2, which decides security?
body: <p>I've been trying to implement a OAuth2 authentication server using the guides by Dave Syer with some inspiration from JHipster. But I can't figure out how it all works together.</p>
  
  <p>It looks like the security setup using the WebSecurityConfigurerAdapter is overwritten when I use ResourceServerConfigurerAdapter.</p>
  
  <pre><code>@Configuration
  @EnableResourceServer
  public class OAuth2ResourceConfig extends ResourceServerConfigurerAdapter {
  
      private TokenExtractor tokenExtractor = new BearerTokenExtractor();
  
      @Override
      public void configure(HttpSecurity http) throws Exception {
          http
                  .addFilterAfter(contextClearer(), AbstractPreAuthenticatedProcessingFilter.class)
                  .authorizeRequests()
                  .anyRequest().authenticated().and().httpBasic();
      }
  
      private OncePerRequestFilter contextClearer() {
          return new OncePerRequestFilter() {
              @Override
              protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
                  if (tokenExtractor.extract(request) == null) {
                      SecurityContextHolder.clearContext();
                  }
                  filterChain.doFilter(request, response);
              }
          };
      }
  
  @Component
  public class CustomWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
  
      private final AuthenticationManager authenticationManager;
  
      @Autowired
      public CustomWebSecurityConfigurerAdapter(AuthenticationManager authenticationManager) {
          this.authenticationManager = authenticationManager;
      }
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth
                  .parentAuthenticationManager(authenticationManager);
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
                  .formLogin()
                      .loginPage("/login").permitAll()
                  .and()
                      .authorizeRequests().antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
                  .and()
                      .requestMatchers().antMatchers("/login", "/oauth/authorize", "/oauth/confirm_access")
                  .and()
                      .authorizeRequests().anyRequest().authenticated();
      }
  }
  </code></pre>
  
  <p>This is code taken from a few different examples, so they might not mix that well. But I can't find a good documentation/example list for OAuth2 (unlike Spring Boot which has a awesome documentation), so I'm having problems understanding how thye all fit together.
  If I don't add the loginForm to the ResourceServerConfigurerAdapter, it will just give me unauthorized. But I defined it in the WebSecurityConfigurererAdapter as permitAll().</p>
  
  <p>This is the AuthorizationServerConfigurerAdapter:</p>
  
  <pre><code>@Configuration
  @EnableAuthorizationServer
  public class OAuth2AuthorizationConfig extends AuthorizationServerConfigurerAdapter {
  
      @Autowired
      private AuthenticationManager authenticationManager;
  
      @Autowired
      private JwtAccessTokenConverter jwtAccessTokenConverter;
  
      @Override
      public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
          clients.inMemory()
                  .withClient("acme")
                  .secret("acmesecret")
                  .authorizedGrantTypes("authorization_code", "refresh_token",
                          "password").scopes("openid");
      }
  
      @Override
      public void configure(AuthorizationServerEndpointsConfigurer endpoints)  throws Exception {
          endpoints.authenticationManager(authenticationManager).accessTokenConverter(jwtAccessTokenConverter);
      }
  
      @Override
      public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
          oauthServer.tokenKeyAccess("permitAll()").checkTokenAccess("isAuthenticated()");
      }
  }
  </code></pre>
  
  <p>Anything I'm doing wrong? Do I have to setup all the security within the ResourceServerConfigurerAdapter? Do I even need the WebSecurityConfigurerAdapter anymore?</p>
  
  <p>If anyone know any guides, tutorials, blogs or anything alike that might help me wrap my head around how this works, that would be greatly appreciated.</p>
  
  <p>Kind regards, Kenneth.</p>