Spring security oauth2 login and resource server in same application

Question

I have an application where users/applications can authenticate either with an OpenID provider or with a JWT token. Here is my spring security configuration class.

    @EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                .anyRequest()
                .authenticated()
                .and()
                .oauth2Login()
                .userInfoEndpoint()
                .oidcUserService(oidcUserService()).and()
                .and()
                .oauth2ResourceServer()
                .jwt();
    }

private OAuth2UserService<OidcUserRequest, OidcUser> oidcUserService() {
    return oidcUserRequest -> {
        OidcUserService oidcUserService = new OidcUserService();
        OidcUser oidcUser = oidcUserService.loadUser(oidcUserRequest);
        return oidcUser;
    };
}

}

It's working as expected but I would like to disable session creation for the JWT authorization part. Do I need to split this into multiple configurations? I understand that if we have multiple configuration classes we need to differentiate based on URL pattern which I can't do in my case as a user authenticated via OpenId or via JWT still should be able to access the same URLs.

Here is the complete sample code in Github.

Answer 1

I solved by splitting the configuration into two classes. One for OAuth login and the other for the resource server. Configured http.requestMatcher(new RequestHeaderRequestMatcher("Authorization")) on the resource server Configuration class and made it's Order as 1 and Open Id configuration order as 2. In Resource server configuration I have disabled session creation.

In this way, if any external clients are calling with a JWT token with header 'Authorization' then it will be handled by Resource server configuration or else it will be handled by the second/OAuth configuration.