title: Spring Oauth2 configure authorization endpoints
body: <p>I have Spring web app with REST WS built using spring-security-oauth2:2.3.3 and spring-boot-starter-security:2.0.2. But I am not able to set which endpoints are protected.</p>
  
  <p><strong>ResourceServerConfig</strong></p>
  
  <pre><code>@EnableResourceServer
  @Configuration
  public class ResourceServerConfig extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests()
                  .antMatchers("/", "/customers", "/v2/**").permitAll()
                  .antMatchers("/api/**").authenticated();
      }
  
      @Bean
      public AuthenticationManager authenticationManager(AuthenticationProvider authenticationProvider) {
          return new CustomAuthenticationManager(authenticationProvider);
      }
  
      @Bean
      public AuthenticationProvider authenticationProvider(UserRepository userRepository, PasswordEncoder passwordEncoder) {
          return new DBAuthenticationProvider(userRepository, passwordEncoder);
      }
  
  }
  </code></pre>
  
  <p><strong>AuthorizationServerConfig</strong></p>
  
  <pre><code>@Configuration
  @EnableAuthorizationServer
  public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
  
      @Autowired
      private AuthenticationManager authenticationManager;
  
      @Override
      public void configure(AuthorizationServerSecurityConfigurer security) {
          security.checkTokenAccess("isAuthenticated()");
      }
  
      @Override
      public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
          clients
                  .inMemory()
                  .withClient("ClientId")
                  .secret("secret")
                  .authorizedGrantTypes("password")
                  .scopes("read", "write");
      }
  
      @Override
      public void configure(AuthorizationServerEndpointsConfigurer endpoints) {
          endpoints.authenticationManager(authenticationManager);
      }
  }
  </code></pre>
  
  <p>When I obtain access token first, everything works perfectly, but I expect endpoints "/", "/customers", "/v2/**" to be permited for all without any authorization. But when I call 'curl http://{{host}}/' or http://{{host}}/customers I still get 401: </p>
  
  <pre><code>{"error":"unauthorized","error_description":"Full authentication is required to access this resource"}
  </code></pre>
  
  <p>adding "--header "Authorization: Basic {{base64 client id:password}}" doesnt help either. How is that possible?</p>
  
  <p><strong>EDIT</strong>
  according to <a href="https://stackoverflow.com/questions/36296869/spring-security-permitall-still-considering-token-passed-in-authorization-header">spring security permitAll still considering token passed in Authorization header and returns 401 if token is invalid</a> solved by adding @Order(1) to ResourceServerConfig to override default OAuth2. But that should kick in only when "Authorization" header is added, which is not my case. So how is this possible?</p>