title: How to secure Spring Boot REST API with Azure AD B2C?
body: <p>I am using Spring Boot 2.2.0 with <code>azure-active-directory-b2c-spring-boot-starter</code> 2.2.0. I managed to secure a Thymeleaf web page with that (following their tutorial). Now, I want to have a REST API that is secured in the same way, as the actual application will be a mobile app that does REST calls to my Spring Boot backend.</p>
  
  <p>I already figured out how to get a token with the password grant flow using:</p>
  
  <pre><code>POST https://&lt;my-tenant-id&gt;.b2clogin.com/&lt;my-tenant-id.onmicrosoft.com/oauth2/v2.0/token?p=B2C_1_&lt;my-custom-policy&gt;
  </code></pre>
  
  <p>(with username and password as parameters)</p>
  
  <p>So a mobile app could use that call. But how should I configure my Spring Boot app so that using <code>Authorization: Bearer &lt;access-token&gt;</code> on API calls works? What dependencies/starters do I need and how should I configure things?</p>
  
  <p>UPDATE:</p>
  
  <p>I tried adding:</p>
  
  <pre><code>&lt;dependency&gt;
    &lt;groupId&gt;org.springframework.security.oauth&lt;/groupId&gt;
    &lt;artifactId&gt;spring-security-oauth2&lt;/artifactId&gt;
    &lt;version&gt;2.3.7.RELEASE&lt;/version&gt;
  &lt;/dependency&gt;
  </code></pre>
  
  <p>With:</p>
  
  <pre><code>@EnableResourceServer
  @EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
  public class OAuth2ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
  
      @Override
      public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
          resources.resourceId("my-azure-b2c-test");
      }
  
      @Override
      public void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests()
              .antMatchers("/api/**")
              .authenticated();
      }
  }
  </code></pre>
  
  <p>But when I do a request on my Spring Boot app, I get a 401 with "invalid_token" error.</p>