Skip to content

Allow authenticationManagerResolver to take precedence over jwt/opaqueToken #17676

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

academey
Copy link

When OAuth2ResourceServerConfigurer.authenticationManagerResolver() is configured, it now takes precedence over any jwt() or opaqueToken() configuration without throwing an exception. This follows Spring Security's convention where specialized configurations take precedence over general ones at runtime.

Problem

The current implementation throws an exception when authenticationManagerResolver() is used together with jwt() or opaqueToken() configurations. This prevents legitimate use cases such as Spring Authorization Server needing to support both JWT and opaque tokens dynamically.

Solution

The solution removes the validation check that prevented authenticationManagerResolver from being used with jwt/opaqueToken configurations. The precedence is now handled at runtime where:

  • If authenticationManagerResolver is configured, it takes precedence
  • If not, the framework falls back to jwt() or opaqueToken() configuration

This is a non-destructive approach that maintains all configurations and applies precedence at execution time, following Spring Security's established patterns.

Changes

  • Modified validateConfiguration() to skip validation when authenticationManagerResolver is present
  • Added clarifying comments in configure() method about precedence rules
  • Updated test to verify no exception is thrown when both are configured
  • Added new test cases for both JWT and OpaqueToken scenarios

Testing

  • Modified configureWhenUsingBothAuthenticationManagerResolverAndOpaqueThenAuthenticationManagerResolverTakesPrecedence()
  • Added configureWhenUsingBothAuthenticationManagerResolverAndJwtThenAuthenticationManagerResolverTakesPrecedence()
  • All existing tests continue to pass

Closes gh-16406

…eToken

When OAuth2ResourceServerConfigurer.authenticationManagerResolver() is
configured, it now takes precedence over any jwt() or opaqueToken()
configuration without throwing an exception. This follows Spring
Security's convention where specialized configurations take precedence
over general ones at runtime.

The solution removes the validation check that prevented
authenticationManagerResolver from being used with jwt/opaqueToken
configurations, allowing for more flexible configuration scenarios such
as those needed by Spring Authorization Server when supporting both JWT
and opaque tokens.

Closes spring-projectsgh-16406

Signed-off-by: academey <[email protected]>
@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged label Aug 10, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
status: waiting-for-triage An issue we've not yet triaged
Projects
None yet
Development

Successfully merging this pull request may close these issues.

OAuth2ResourceServerConfigurer#authenticationManagerResolver should override #jwt
2 participants