title: ResourceServer minimal configuration at Spring oauth
body: <p>I'm developing an app that uses Spring Security OAuth, but <strong>only ResourceServer</strong> component. AuthorizationServer is another product, not related to Spring OAuth.
  As the <a href="http://projects.spring.io/spring-security-oauth/docs/oauth2.html#toc_10" rel="nofollow">Spring documents says</a>, to configure ResourceServer I need to use EnableResourceServer annotation and supply configuration using ResourceServerConfigurer. So for custom oauth sever all I need is to provide custom ResourceServerTokenServices, which can load auth information by access token.</p>
  
  <p>Spring java docs says that configuration can be made using ResourceServerConfigurerAdapter class (<a href="http://docs.spring.io/spring-security/oauth/spring-security-oauth2/xref/org/springframework/security/oauth2/config/annotation/web/configuration/EnableResourceServer.html" rel="nofollow">this info can be found in java docs</a>): supply http config + ResourceServerTokenServices impl.</p>
  
  <p>I tried to use this config:</p>
  
  <pre><code>@Configuration
  @EnableResourceServer
  @Order(4)
  protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {               
  
      @Autowired
      private ResourceServerTokenServices tokenServices;
  
      @Override
      public void configure(HttpSecurity http) throws Exception {
         http
                  .requestMatchers().requestMatchers(toRestEndpoints())
              .and()
                  .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.NEVER)
              .and()
                  .authorizeRequests()
                  .antMatchers(HealthCheckController.HEALTHCHECK_URL).permitAll()
                  .anyRequest().authenticated();
      }
  
      @Override
      public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
           resources.tokenServices(tokenServices);
      }
  }
  </code></pre>
  
  <p>but this configuration don't work. When I run my app, I get an exception that </p>
  
  <pre><code>AuthenticationManager is not found:
  Caused by: 
  java.lang.IllegalArgumentException: An AuthenticationManager is required
      at org.springframework.util.Assert.notNull(Assert.java:112)
      at org.springframework.security.access.intercept.AbstractSecurityInterceptor.afterPropertiesSet(AbstractSecurityInterceptor.java:121)
      at org.springframework.security.config.annotation.web.configurers.AbstractInterceptUrlConfigurer.createFilterSecurityInterceptor(AbstractInterceptUrlConfigurer.java:187)
      at org.springframework.security.config.annotation.web.configurers.AbstractInterceptUrlConfigurer.configure(AbstractInterceptUrlConfigurer.java:76)
      at org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer.configure(ExpressionUrlAuthorizationConfigurer.java:70)
      at org.springframework.security.config.annotation.web.configurers.AbstractInterceptUrlConfigurer.configure(AbstractInterceptUrlConfigurer.java:64)
      at org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder.configure(AbstractConfiguredSecurityBuilder.java:378)
      at org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder.doBuild(AbstractConfiguredSecurityBuilder.java:327)
      at org.springframework.security.config.annotation.AbstractSecurityBuilder.build(AbstractSecurityBuilder.java:39)
      at org.springframework.security.config.annotation.web.builders.WebSecurity.performBuild(WebSecurity.java:293)
      at org.springframework.security.config.annotation.web.builders.WebSecurity.performBuild(WebSecurity.java:74)
      at org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder.doBuild(AbstractConfiguredSecurityBuilder.java:331)
      at org.springframework.security.config.annotation.AbstractSecurityBuilder.build(AbstractSecurityBuilder.java:39)
      at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration.springSecurityFilterChain(WebSecurityConfiguration.java:92)
      at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration$$EnhancerBySpringCGLIB$$45460096.CGLIB$springSecurityFilterChain$3(&lt;generated&gt;)
      at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration$$EnhancerBySpringCGLIB$$45460096$$FastClassBySpringCGLIB$$37daac8b.invoke(&lt;generated&gt;)
      at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:228)
      at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:312)
      at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration$$EnhancerBySpringCGLIB$$45460096.springSecurityFilterChain(&lt;generated&gt;)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
      at java.lang.reflect.Method.invoke(Method.java:606)
      at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:166)
      at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:586)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1094)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:989)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:504)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:475)
      at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:304)
      at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:228)
      at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:300)
      at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:195)
      at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:294)
      at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:195)
      at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:703)
      at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:760)
      at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:482)
      at org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:403)
      at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:306)
      at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:106)
      at org.eclipse.jetty.server.handler.ContextHandler.callContextInitialized(ContextHandler.java:800)
      at org.eclipse.jetty.servlet.ServletContextHandler.callContextInitialized(ServletContextHandler.java:446)
      at org.eclipse.jetty.server.handler.ContextHandler.startContext(ContextHandler.java:792)
      at org.eclipse.jetty.servlet.ServletContextHandler.startContext(ServletContextHandler.java:296)
      at org.eclipse.jetty.webapp.WebAppContext.startWebapp(WebAppContext.java:1341)
      at org.eclipse.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1334)
      at org.eclipse.jetty.server.handler.ContextHandler.doStart(ContextHandler.java:744)
      at org.eclipse.jetty.webapp.WebAppContext.doStart(WebAppContext.java:497)
      at org.eclipse.jetty.maven.plugin.JettyWebAppContext.doStart(JettyWebAppContext.java:281)
      at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
      at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:132)
      at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:114)
      at org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:60)
      at org.eclipse.jetty.server.handler.ContextHandlerCollection.doStart(ContextHandlerCollection.java:154)
      at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
      at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:132)
      at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:114)
      at org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:60)
      at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
      at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:132)
      at org.eclipse.jetty.server.Server.start(Server.java:357)
      at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:114)
      at org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:60)
      at org.eclipse.jetty.server.Server.doStart(Server.java:324)
      at org.eclipse.jetty.maven.plugin.JettyServer.doStart(JettyServer.java:68)
      at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
      at org.eclipse.jetty.maven.plugin.AbstractJettyMojo.startJetty(AbstractJettyMojo.java:564)
      at org.eclipse.jetty.maven.plugin.AbstractJettyMojo.execute(AbstractJettyMojo.java:360)
      at org.eclipse.jetty.maven.plugin.JettyRunMojo.execute(JettyRunMojo.java:168)
      at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo(DefaultBuildPluginManager.java:106)
      at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:208)
      at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:153)
      at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:145)
      at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:84)
      at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:59)
      at org.apache.maven.lifecycle.internal.LifecycleStarter.singleThreadedBuild(LifecycleStarter.java:183)
      at org.apache.maven.lifecycle.internal.LifecycleStarter.execute(LifecycleStarter.java:161)
      at org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:317)
      at org.apache.maven.DefaultMaven.execute(DefaultMaven.java:152)
      at org.apache.maven.cli.MavenCli.execute(MavenCli.java:555)
      at org.apache.maven.cli.MavenCli.doMain(MavenCli.java:214)
      at org.apache.maven.cli.MavenCli.main(MavenCli.java:158)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
      at java.lang.reflect.Method.invoke(Method.java:606)
      at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced(Launcher.java:289)
      at org.codehaus.plexus.classworlds.launcher.Launcher.launch(Launcher.java:229)
      at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode(Launcher.java:415)
      at org.codehaus.plexus.classworlds.launcher.Launcher.main(Launcher.java:356)
      at org.codehaus.classworlds.Launcher.main(Launcher.java:46)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
      at java.lang.reflect.Method.invoke(Method.java:606)
      at com.intellij.rt.execution.application.AppMain.main(AppMain.java:134)
  </code></pre>
  
  <p>If I define AuthenticationManager explicitly in context </p>
  
  <pre><code>@Bean
  public AuthenticationManager authenticationManager() throws Exception {
      OAuth2AuthenticationManager oAuth2AuthenticationManager = new OAuth2AuthenticationManager();
      oAuth2AuthenticationManager.setTokenServices(wso2TokenServices());
      return oAuth2AuthenticationManager;
  }
  </code></pre>
  
  <p>and set it in adaper, then all is fine.</p>
  
  <p>But it seems strange to me, becase ResourceServerSecurityConfigurer already has code to create authenticationManager if user did not supplied one.</p>
  
  <p><strong>So the question is</strong>: what is wrong with my inial config? What is the purpose in OAuthAuthenticationManager creation code in Configurer if context can't start properly?</p>