title: How to ensure make my custom OidcUserService called over the default?
body: <p><strong>tl;dr:</strong> why isn't my <code>OidcUserService</code> despite being registered?</p>
  
  <hr>
  
  <p>I am trying to use my own <a href="https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/oauth2/client/userinfo/OAuth2UserService.html" rel="noreferrer"><code>OAuth2UserService</code></a> by registering it as documented in the <a href="https://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#oauth2login-advanced-map-authorities-oauth2userservice" rel="noreferrer">Spring Security documentation</a>. </p>
  
  <p>However, when I put a breakpoint on the <code>OidcUserService.loadUser(OidcUserRequest)</code>](<a href="https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/oauth2/client/oidc/userinfo/OidcUserService.html#loadUser-org.springframework.security.oauth2.client.oidc.userinfo.OidcUserRequest-" rel="noreferrer">https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/oauth2/client/oidc/userinfo/OidcUserService.html#loadUser-org.springframework.security.oauth2.client.oidc.userinfo.OidcUserRequest-</a>) method, it keeps hitting the <code>com.okta.spring.boot.oauth.OktaOidcUserService</code> instead! I <em>am</em> using  <code>com.okta.spring:okta-spring-boot-parent:1.2.2-SNAPSHOT</code> which may be the problem?</p>
  
  <p>I register my <code>OidcUserService</code> <a href="https://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#oauth2login-advanced-map-authorities-oauth2userservice" rel="noreferrer">like documented</a>:</p>
  
  <pre><code>@SpringBootApplication
  @EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
  public class RedirectCodeFlowApplication {
  
      public static void main(String[] args) {
          SpringApplication.run(RedirectCodeFlowApplication.class, args);
      }
  
      @Configuration
      static class WebConfig extends WebSecurityConfigurerAdapter {
          @Override
          protected void configure(HttpSecurity http) throws Exception {
              final OidcUserService delegate = new OidcUserService();
  
              http.authorizeRequests().anyRequest().authenticated()
                  .and()
                  .oauth2Login()
                  .userInfoEndpoint()
                  .oidcUserService( (userRequest) -&gt; {
                          System.out.println( "!!xXx!! never gets here" );
  
                          OidcUser oidcUser = delegate.loadUser(userRequest);
  
                          OAuth2AccessToken accessToken = userRequest.getAccessToken();
                          Set&lt;GrantedAuthority&gt; mappedAuthorities = new HashSet&lt;&gt;();
  
                          oidcUser = new DefaultOidcUser(mappedAuthorities, oidcUser.getIdToken(), oidcUser.getUserInfo());
  
                          return oidcUser;
                      })
              ;
          }
  </code></pre>
  
  <p>and the method I'm calling is simple:</p>
  
  <pre><code>@RestController
  public class WelcomeController {
  
      @GetMapping("/")
      public Welcome getMessageOfTheDay(Principal principal) {
          return "The message of the day is boring.";
      }
  }
  </code></pre>
  
  <p>This is all adapted from: <a href="https://github.com/okta/okta-spring-boot/blob/master/examples/redirect-code-flow/src/main/java/com/okta/spring/example/RedirectCodeFlowApplication.java" rel="noreferrer">https://github.com/okta/okta-spring-boot/blob/master/examples/redirect-code-flow/src/main/java/com/okta/spring/example/RedirectCodeFlowApplication.java</a></p>