title: Using WebSecurityConfigurerAdapter with Spring OAuth2 and user-info-uri
body: <p>I have created an Authorization service as follows</p>
  
  <pre><code>@SpringBootApplication
  @EnableAuthorizationServer
  public class AuthorizationApplication {
     ...
  }
  </code></pre>
  
  <p>With this <code>application.properties</code>.</p>
  
  <pre><code>server.port=9000
  security.oauth2.client.client-id=monederobingo
  security.oauth2.client.client-secret=monederobingosecret
  security.oauth2.client.authorized-grant-types=authorization_code,refresh_token,password,client_credentials
  security.oauth2.client.scope=company,client
  </code></pre>
  
  <p>Then, in a separate spring boot project I have created a Resource Server.</p>
  
  <pre><code>@SpringBootApplication
  @EnableResourceServer
  public class App {
     ...
  }
  </code></pre>
  
  <p>With this <code>application.properties</code>.</p>
  
  <pre><code>server.port=9090
  spring.application.name=app
  security.oauth2.resource.user-info-uri=http://localhost:9000/user
  </code></pre>
  
  <p>Now, everything works fine if I send a request like this <code>localhost:9090/api</code> with the appropriate token that was retrieved by Authorization Service.</p>
  
  <p>However, I don't want to send this token when sending requests to <code>localhost:9090/login</code>.</p>
  
  <p>For this I have created this class in my Resource server spring boot app.</p>
  
  <pre><code>@Configuration
  public class SpringConfig extends WebSecurityConfigurerAdapter {
      @Override protected void configure(HttpSecurity http) throws Exception {
          http.csrf().disable()
                  .authorizeRequests()
                  .antMatchers("/login")
                  .permitAll()
                  .antMatchers("/api/**")
                  .authenticated();
      }
  
  }
  </code></pre>
  
  <p>And now I don't need to send any token to send a request to <code>/login</code>.</p>
  
  <p>However, I'm now geting the following message when sending request to <code>/api</code> with a valid token.</p>
  
  <pre><code>{
    "timestamp": 1496027102659,
    "status": 403,
    "error": "Forbidden",
    "message": "Access Denied",
    "path": "/api/v1/points_configuration/314"
  }
  </code></pre>
  
  <p>How can configure security for only a few URL patterns in Spring Security OAuth2?</p>