title: refresh_token grant_type error: UserDetailsService is required. But I dont want to specify one
body: <p>I'm trying to create an Oauth authentication/authorization server using spring boot and dependencies
   * spring-security-oauth2-autoconfigure
   * nimbus-jose-jwt</p>
  
  <p>and I'm following <a href="https://docs.spring.io/spring-security-oauth2-boot/docs/current-SNAPSHOT/reference/htmlsingle/#boot-features-security-oauth2-authorization-server" rel="nofollow noreferrer">docs.spring.io/spring-security-oauth2-boot/docs/current-SNAPSHOT/reference/htmlsingle/#boot-features-security-oauth2-authorization-server</a></p>
  
  <p>The issue is that I don't want to specify a UserDetailsService since the information about the user account is in another service that doesn't expose passwords. That service just has an API in which input is user/pass and output is user info (if the user exists/credentials are correct).</p>
  
  <p>So my code/configuration is a little deviated from the documentation.</p>
  
  <pre><code>@EnableAuthorizationServer
  @Configuration
  public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
  
       //injections
  
     @Override
     public void configure(AuthorizationServerEndpointsConfigurer endpoints) {
         endpoints
                 .tokenStore(jwtTokenStore)
                 .accessTokenConverter(accessTokenConverter)
                 .authenticationManager(authenticationManager);
     }
  }
  </code></pre>
  
  <p>and</p>
  
  <pre><code>@EnableWebSecurity
  @Configuration
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
     //injections
  
      @Bean
      @Override
      public AuthenticationManager authenticationManagerBean() throws Exception {
          return super.authenticationManagerBean();
      }
  
      @Override
      protected void configure(AuthenticationManagerBuilder authenticationManagerBuilder) {
          authenticationManagerBuilder.authenticationProvider(travelerAuthenticationProvider); //my custom // authentication provider that calls the other service for checking credentials
      }
  }
  </code></pre>
  
  <p>and</p>
  
  <pre><code>@Component
  public class TravelerAuthenticationProvider implements AuthenticationProvider {
  
      private static final Logger LOGGER = LoggerFactory.getLogger(TravelerAuthenticationProvider.class);
  
      private OrderTravelerProfileClient travelerProfileClient;
  
      public TravelerAuthenticationProvider(OrderTravelerProfileClient travelerProfileClient) {
          this.travelerProfileClient = travelerProfileClient;
      }
  
      @Override
      public Authentication authenticate(Authentication authentication) throws AuthenticationException {
          if (authentication.getName() == null || (authentication.getCredentials().toString().isEmpty())) {
              return null;
          }
          var username = authentication.getName();
          var password = authentication.getCredentials().toString();
          try {
              travelerProfileClient.authenticate(username, password);
          } catch (Exception e) {
              LOGGER.error("checking traveler {} credentials failed", username, e);
              throw new BadCredentialsException("wrong traveler credentials");
          }
          var authorities = Set.of(new SimpleGrantedAuthority("traveler"));
          var updatedAuthentication = new UsernamePasswordAuthenticationToken(username, password, authorities);
          return updatedAuthentication;
      }
  
      @Override
      public boolean supports(Class&lt;?&gt; authentication) {
          return authentication.equals(UsernamePasswordAuthenticationToken.class);
      }
  }
  </code></pre>
  
  <p>Everything related to client_credentials and password flow works but when I try to use refresh_token flow, it complains that <code>UserDetailsService is required</code>. How should I solve the issue without defining a UserDetailsService and just relaying on my custom authentication provider?</p>
  
  <p><strong>UPDATE</strong>:
  apparently refresh_token flow has a recheck for authentication (credentials) which needs another authentication provider for type PreAuthenticatedAuthenticationToken.class.</p>
  
  <p>So I created a new auth provider like this:</p>
  
  <pre><code>@Component
  public class TravelerRefreshTokenBasedAuthenticationProvider implements AuthenticationProvider {
  
      private static final Logger LOGGER = LoggerFactory.getLogger(TravelerRefreshTokenBasedAuthenticationProvider.class);
  
  
      @Override
      public Authentication authenticate(Authentication authentication) throws AuthenticationException {
          var currentAuthentication = (PreAuthenticatedAuthenticationToken) authentication;
              //.....
          return updatedAuthentication;
      }
  
      @Override
      public boolean supports(Class&lt;?&gt; authentication) {
          return authentication.equals(PreAuthenticatedAuthenticationToken.class);
      }
  }
  </code></pre>
  
  <p>and update my security configs to:</p>
  
  <pre><code>@EnableWebSecurity
  @Configuration
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
  //injections
  
      //this bean will be more configured by the method below and it will be used by spring boot
      //for authenticating requests. Its kind of an equivalent to userDetailsService
      @Bean
      @Override
      public AuthenticationManager authenticationManagerBean() throws Exception {
          return super.authenticationManagerBean();
      }
  
      @Override
      protected void configure(AuthenticationManagerBuilder authenticationManagerBuilder) {
          authenticationManagerBuilder.authenticationProvider(travelerUserPassBasedAuthenticationProvider);
          authenticationManagerBuilder.authenticationProvider(travelerRefreshTokenBasedAuthenticationProvider);
      }
  }
  </code></pre>
  
  <p>the issue is spring doesn't recognize my auth providers in refresh_token flow and tries to use a default one. And the default one is trying to use a UserDetailsService that doesn't exist.</p>
  
  <p>I also feel that I don't need to create another provider and I can reuse the previous one. Because the check for which spring is failing to use my custom provider is a check against user/pass; which I was doing in my previous auth provider.</p>
  
  <p>so all in all, until now, I feel I have to introduce my custom provider to spring differently for refresh_token flow comparing to password flow</p>