Spring Oauth2 provider PreAuthorize failed to inject autowired

Question

I'm trying to enhance my OAuth2 provider security by protecting controller methods with @PreAuthorize annotations. I also added @EnableGlobalMethodSecurity so the @PreAuthorize would work with oauth.

Here's my current setup:

@Configuration
@ComponentScan
@EnableAutoConfiguration
@EnableResourceServer
@RestController
public class Application {

    public static void main(String[] args) {
        SpringApplication.run(Application.class, args);
    }

    @RequestMapping("/")
    public String home() {
        return "Hello World";
    }

    @PreAuthorize("#oauth2.clientHasRole('ROLE_CUSTOM')")
    @RequestMapping("/a")
    public String a() {
        return "foo";
    }

    @PreAuthorize("#oauth2.clientHasRole('ROLE_TRUSTED_CLIENT')")
    @RequestMapping("/b")
    public String b() {
        return "bar";
    }

    // So that @PreAuthorize notations would work
    @Configuration
    @EnableGlobalMethodSecurity(prePostEnabled = true)
    public static class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {
        @Override
        protected MethodSecurityExpressionHandler createExpressionHandler() {
            return new OAuth2MethodSecurityExpressionHandler();
        }
    }

    @Configuration
    @EnableWebSecurity
    public static class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    }

    @Configuration
    @EnableAuthorizationServer
    protected static class OAuth2Config extends AuthorizationServerConfigurerAdapter {

        @Autowired
        private AuthenticationManager authenticationManager;

        @Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
            endpoints.authenticationManager(authenticationManager).tokenStore(tokenStore());
        }

        @Bean
        public ApprovalStore approvalStore() throws Exception {
            TokenApprovalStore store = new TokenApprovalStore();
            store.setTokenStore(tokenStore());
            return store;
        }

        @Bean
        public TokenStore tokenStore() {
            return new InMemoryTokenStore();
        }

        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
            // @formatter:off
            clients.inMemory()
                .withClient("my-trusted-client")
                    .authorizedGrantTypes("password", "authorization_code", "refresh_token", "implicit")
                    .authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT")
                    .scopes("read", "write", "trust")
                    .resourceIds("oauth2-resource")
                    .accessTokenValiditySeconds(60)
            .and()
                .withClient("my-client-with-registered-redirect")
                    .authorizedGrantTypes("authorization_code")
                    .authorities("ROLE_CLIENT")
                    .scopes("read", "trust")
                    .resourceIds("oauth2-resource")
                    .redirectUris("http://anywhere?key=value")
            .and()
                .withClient("my-client-with-secret")
                    .authorizedGrantTypes("client_credentials", "password")
                    .authorities("ROLE_CLIENT","ROLE_CUSTOM")
                    .scopes("read")
                    .resourceIds("oauth2-resource")
                    .secret("secret");
        // @formatter:on
        } 
    }
}

It works when I remove the @PreAuthorize notations, but when I add them, compiler throws a ton of missing injection of autowired exceptions, and I can't really pinpoint nor find explataions to what is really causing the problem.

Here's my output

I'm sorry that I can't provide any additional output or research, kind of stuck at this point.

Answer 1

Try extracting the @RestController class from the rest of the configuration.

Aside from the fact that do-it-all configuration classes are a mess to maintain, Spring may have issues configuring method security and using it within the same class.