OAuth2ResourceServerConfigurer#authenticationManagerResolver should override #jwt

[jgrandja]

Given the following configuration:

@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http)
		throws Exception {

	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
			OAuth2AuthorizationServerConfigurer.authorizationServer();

	http
		.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
		.with(authorizationServerConfigurer, (authorizationServer) ->
			authorizationServer
				.oidc(Customizer.withDefaults())	// Enable OpenID Connect 1.0
		)
		.authorizeHttpRequests((authorize) ->
			authorize
				.anyRequest().authenticated()
		)
		.exceptionHandling((exceptions) -> exceptions
			.defaultAuthenticationEntryPointFor(
				new LoginUrlAuthenticationEntryPoint("/login"),
				new MediaTypeRequestMatcher(MediaType.TEXT_HTML)
			)
		)
		.oauth2ResourceServer(resourceServer ->
			resourceServer
				.authenticationManagerResolver((context) -> customAuthenticationManager)
		);

	return http.build();
}

The application context will fail to build with the error message:

Caused by: java.lang.IllegalStateException: If an authenticationManagerResolver() is configured, then it takes precedence over any jwt() or opaqueToken() configuration.

The reason is because OAuth2AuthorizationServerConfigurer will default to resourceServer.jwt() if the OIDC UserInfo endpoint or OIDC Client Registration endpoint is enabled. However, if an application configures a client to use opaque tokens for an OpenID Connect flow, then configuring the authenticationManagerResolver() should be possible if support for both JWT and Opaque access tokens is required. As of now, it's not possible since resourceServer.jwt() was previously configured as the default by OAuth2AuthorizationServerConfigurer.

A similar error condition occurs with the following configuration:

@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http)
		throws Exception {

	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
			OAuth2AuthorizationServerConfigurer.authorizationServer();

	http
		.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
		.with(authorizationServerConfigurer, (authorizationServer) ->
			authorizationServer
				.oidc(Customizer.withDefaults())	// Enable OpenID Connect 1.0
		)
		.authorizeHttpRequests((authorize) ->
			authorize
				.anyRequest().authenticated()
		)
		.exceptionHandling((exceptions) -> exceptions
			.defaultAuthenticationEntryPointFor(
				new LoginUrlAuthenticationEntryPoint("/login"),
				new MediaTypeRequestMatcher(MediaType.TEXT_HTML)
			)
		)
		.oauth2ResourceServer(resourceServer ->
			resourceServer
				.opaqueToken(Customizer.withDefaults())
		);

	return http.build();
}

The error message is:

Caused by: java.lang.IllegalStateException: Spring Security only supports JWTs or Opaque Tokens, not both at the same time.

The application is not able to override the default resourceServer.jwt() configured by OAuth2AuthorizationServerConfigurer to configure support for resourceServer.opaqueToken() instead.

[jzheaux]

Thanks, @jgrandja, I'll take a look. It's quite common in Spring Security for the last-configured component to take precedence, so I imagine this is a reasonable improvement.

The only thing I hesitate on is that disallowing this seems to have been intentional in the code.

Either way, I've marked this as ideal-for-contribution and would be happy to work with someone on a PR.

[roar-skinderviken]

One possible solution might be to just remove the code block starting on line 356
and let users of the code be responsible for configuring this.

As I see this, there are 3 possible configurations

• oauth2.authenticationManagerResolver
• oauth2.jwt
• oauth2.opaqueToken

and just one of them can be applied.

This will be a breaking change, therefore some code for fail-fast if oauth is not configured properly, will be required.

[jgrandja]

@roar-skinderviken

One possible solution might be to just remove the code block starting on line 356
and let users of the code be responsible for configuring this.

That block of code was added in spring-authorization-server#707 to simplify configuring Authorization Server. So I don't think we want to remove that block and force the user to explicitly configure resourceServer(). Defaulting to resourceServer().jwt() is a sensible default.