Allow authenticationManagerResolver to take precedence over jwt/opaqueToken #17676
+49
−11
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When
OAuth2ResourceServerConfigurer.authenticationManagerResolver()
is configured, it now takes precedence over anyjwt()
oropaqueToken()
configuration without throwing an exception. This follows Spring Security's convention where specialized configurations take precedence over general ones at runtime.Problem
The current implementation throws an exception when
authenticationManagerResolver()
is used together withjwt()
oropaqueToken()
configurations. This prevents legitimate use cases such as Spring Authorization Server needing to support both JWT and opaque tokens dynamically.Solution
The solution removes the validation check that prevented
authenticationManagerResolver
from being used with jwt/opaqueToken configurations. The precedence is now handled at runtime where:authenticationManagerResolver
is configured, it takes precedencejwt()
oropaqueToken()
configurationThis is a non-destructive approach that maintains all configurations and applies precedence at execution time, following Spring Security's established patterns.
Changes
validateConfiguration()
to skip validation whenauthenticationManagerResolver
is presentconfigure()
method about precedence rulesTesting
configureWhenUsingBothAuthenticationManagerResolverAndOpaqueThenAuthenticationManagerResolverTakesPrecedence()
configureWhenUsingBothAuthenticationManagerResolverAndJwtThenAuthenticationManagerResolverTakesPrecedence()
Closes gh-16406