title: Using Spring Security 5 OAuth2 Client Support disables Spring Boot Actuator Basic Authentication
body: <p>I am using Spring Boot 2.4.0 and Spring Cloud 2020.0.0-M6</p>
  <p>I just migrated the OAuth clients in my codebase from using Spring Security OAuth to using Spring Security 5's OAuth support (following <a href="https://github.com/spring-projects/spring-security/wiki/OAuth-2.0-Migration-Guide" rel="nofollow noreferrer">https://github.com/spring-projects/spring-security/wiki/OAuth-2.0-Migration-Guide</a>)</p>
  <p>I got all of my clients to successfully retrieve tokens and send them along to downstream services appropriately.  However once I got this to work, I noticed that I could no longer access any of my Spring Boot Actuator endpoints which had been protected by Basic Authentication.</p>
  <p>After debugging, I discovered that the reason is because in</p>
  <pre><code>org.springframework.boot.autoconfigure.security.servlet.UserDetailsServiceAutoConfiguration
  </code></pre>
  <p>the instantiation of the InMemoryUserDetailsManager is gated by the existence of the ClientRegistrationRespository</p>
  <pre><code>@Bean
  @ConditionalOnMissingBean(type = &quot;org.springframework.security.oauth2.client.registration.ClientRegistrationRepository&quot;)
  @Lazy
  public InMemoryUserDetailsManager inMemoryUserDetailsManager(SecurityProperties properties,
  </code></pre>
  <p>I was able to work around this problem by explicitly building the inMemoryUserDetailsManager bean myself (by copying the code from UserDetailsServiceAutoConfiguration and not gating it) but that seems inappropriate.</p>
  <p>I do not know if this is a bug with the configuration or not.  Should something else be checked to decide if we should instantiate the InMemoryUserDetailsManager?  It seems completely reasonable to use OAuth2 for calling downstream services while having actuator endpoints protected by Basic Authentication.  I could be missing something, or my understanding of the downstream oauth configuration could be wrong.</p>
  <p>The only oauth configuration I have is this:</p>
  <pre><code>spring.security.oauth2.client.provider.my-oauth-provider.token-uri=${ouath-provider-url-property}/token
  
  spring.security.oauth2.client.registration.my-client.client-id=${client-id-property}
  spring.security.oauth2.client.registration.my-client.client-secret=${client-secret-property}
  spring.security.oauth2.client.registration.my-client.provider=my-oauth-provider
  spring.security.oauth2.client.registration.my-client.authorization-grant-type=client_credentials
  spring.security.oauth2.client.registration.my-client.scope=RETURN_ALL_CLIENT_SCOPES
  spring.security.oauth2.client.registration.my-client.client-authentication-method=POST
  </code></pre>
  <p>The actuator security configuration I have is this:</p>
  <pre><code>@Configuration
  @EnableWebSecurity
  public class ActuatorSecurity extends WebSecurityConfigurerAdapter {
  
    @Override
    protected void configure(HttpSecurity http) throws Exception {
      http.csrf()
          .disable()
          .authorizeRequests()
          .requestMatchers(
              EndpointRequest.to(
                  &quot;health&quot;,
                  &quot;env&quot;,
                  &quot;jolokia&quot;,
                  &quot;circuitbreakers&quot;,
                  &quot;metrics&quot;,
                  &quot;beans&quot;,
                  &quot;configprops&quot;,
                  &quot;mappings&quot;,
                  &quot;httptrace&quot;,
                  &quot;caches&quot;,
                  &quot;cache-keys&quot;,
                  &quot;loggers&quot;))
          .authenticated()
          .and()
          .httpBasic();
    }
  }
  
  spring.security.user.name=username
  spring.security.user.password=password
  </code></pre>
  <p>Any help is appreciated, as I would like to be able to configure some flag that allows me to instantiate the basic authentication without having to hand-code it myself.</p>