title: Spring security reactive mixing HttpBasic + Oauth2
body: <p>I am trying to have a Security Webflux configuration where I am able to login using httpBasic for some resources and the rest of the resources with oAuth</p>
  <p>Far now I haven't been able to understand how to do it; it seems, that in non reactive way, can be achieved using some kind of realm name or whatever but in reactive that doesn't exist, I think it is because is related to the workflow of the thread or something related to that in the web filter chain</p>
  <p>However I have the following far now in kotlin,</p>
  <pre><code>return http.httpBasic().authenticationManager {...}
      .and()
         .oauth2ResourceServer()
            .jwt()
            .and()
      .and()
      .authorizeExchange()
      .pathMatchers(* noAuthPaths).permitAll()
      .pathMatchers(* basicAuthPaths).authenticated()
      .anyExchange().access{...}
      .and().csrf().disable()
      .build()
  </code></pre>
  <p>Check that <strong>noAuthPaths</strong> and <strong>basicAuthPaths</strong> are just arrays of string patterns, and the last array(<strong>basicAuthPaths</strong>) is the one that I want to use using HttpBasic.</p>
  <p>If I call the resource in the browser, and it is listed in the <strong>basicAuthPaths</strong>, I want that the login pops asking for the Basic Auth credential. And if not I would expect the Bearer token.</p>
  <p>With the current configuration if I call the resources using Basic Auth in postman I can access all resources the listed in the array and those that comes from anyExchange method. Also if I enter the resource in the browser the login form doesn't pop.</p>
  <p>Does anybody know how to support both strategies for different resources? Thanks.</p>
  <h1>Update 1 (Suggestion failing)</h1>
  <p>I tried what is suggested in this <a href="https://stackoverflow.com/a/68628700/1428872">answer</a>  with no success.</p>
  <p>I have created a simple <a href="https://github.com/dbranco/howto-security" rel="nofollow noreferrer">example</a> using Okta as OAuth IDP.</p>
  <p>In the case of using different Beans with Order annotation I am not able to make it run, always getting a 403 status, and if access to the one is suppose to be basic auth it also asks for the Okta authentication.</p>
  <p>With only one Bean configuration at least I manage to see the answer from the secureoauth endpoint, and the securebasic endpoint reject due to the access strategy.</p>
  <p>In both cases OAuth authentication is always call.</p>
  <h1>Update 2 (Suggetion With Success)</h1>
  <p>Thanks to @greiker suggestion, he added a PR in my example where you can find it <a href="https://github.com/dbranco/howto-security/pull/1#pullrequestreview-722316552" rel="nofollow noreferrer">here</a></p>
  <p>In the pull request you can find some of my review comments that will implement for the Okta use case and push to let people check whenever they need, however the changes suggested won't be deleted since they cover a broader case.</p>