Open moarychan opened 1 year ago
but there's a condition @ConditionalOnMissingClass({ "org.springframework.security.oauth2.server.resource.authentication.BearerTokenAuthenticationToken" }) to block using the resource server
IMU, it's designed by purpose. When using spring-security-oauth2-resource-server (BearerTokenAuthenticationToken), AadAuthenticationFilterAutoConfiguration should not be enabled.
AadAuthenticationFilterAutoConfiguration
is a method to implement resource-server, spring-security-oauth2-resource-server is another way to implement resource-server. The 2 methods should not work at the same time.
This is first added in this commit by @moarychan .
Context
Currently, SCA provides the configuration
AadAuthenticationFilterAutoConfiguration
to support resource server scenarios, but there's a condition@ConditionalOnMissingClass({ "org.springframework.security.oauth2.server.resource.authentication.BearerTokenAuthenticationToken" })
to block using the resource server dependencies, SCA should improve this limitation.Goal
Make the configuration
AadAuthenticationFilterAutoConfiguration
enabled when the resource server dependencies exist.spring-security-oauth2-core
, see comments from PR https://github.com/Azure-Samples/azure-spring-boot-samples/pull/582