Package org.springframework.security.config.annotation.web.configurers.oauth2.server.resource

# Class OAuth2ResourceServerConfigurer<H extends HttpSecurityBuilder<H>>

java.lang.Object
org.springframework.security.config.annotation.SecurityConfigurerAdapter<org.springframework.security.web.DefaultSecurityFilterChain,B>
org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer<OAuth2ResourceServerConfigurer<H>,H>
org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer<H>

All Implemented Interfaces:
  `SecurityConfigurer<org.springframework.security.web.DefaultSecurityFilterChain,H>`

public final class OAuth2ResourceServerConfigurer<H extends HttpSecurityBuilder<H>> extends AbstractHttpConfigurer<OAuth2ResourceServerConfigurer<H>,H>
An `AbstractHttpConfigurer` for OAuth 2.0 Resource Server Support. By default, this wires a `BearerTokenAuthenticationFilter`, which can be used to parse the request for bearer tokens and make an authentication attempt.

The following configuration options are available:

- `accessDeniedHandler(AccessDeniedHandler)`
- customizes how access denied errors are handled
- `authenticationEntryPoint(AuthenticationEntryPoint)`
- customizes how authentication failures are handled
- `bearerTokenResolver(BearerTokenResolver)` - customizes how to resolve a bearer token from the request
- `jwt(Customizer)` - enables Jwt-encoded bearer token support
- `opaqueToken(Customizer)` - enables opaque bearer token support

When using `jwt(Customizer)`, either

- supply a Jwk Set Uri via `OAuth2ResourceServerConfigurer.JwtConfigurer.jwkSetUri(java.lang.String)`, or
- supply a `JwtDecoder` instance via `OAuth2ResourceServerConfigurer.JwtConfigurer.decoder`, or
- expose a `JwtDecoder` bean

Also with `jwt(Customizer)` consider

- customizing the conversion from a `Jwt` to an `Authentication` with `OAuth2ResourceServerConfigurer.JwtConfigurer.jwtAuthenticationConverter(Converter)`

When using `opaqueToken(Customizer)`, supply an introspection endpoint with its client credentials and an OpaqueTokenAuthenticationConverter

## Security Filters

The following `Filter`s are populated when `jwt(Customizer)` is configured:

- `BearerTokenAuthenticationFilter`

## Shared Objects Created

The following shared objects are populated:

- `SessionCreationPolicy` (optional)

## Shared Objects Used

The following shared objects are used:

- `AuthenticationManager`

Since:
  5.1
See Also:
  - `BearerTokenAuthenticationFilter`
  - `JwtAuthenticationProvider`
  - `NimbusJwtDecoder`
  - `AbstractHttpConfigurer`

## Nested Class Summary

Nested Classes
Modifier and Type
Class
Description
`class`
`OAuth2ResourceServerConfigurer.JwtConfigurer`
`class`
`OAuth2ResourceServerConfigurer.OpaqueTokenConfigurer`

## Constructor Summary

Constructors
Constructor
Description
`OAuth2ResourceServerConfigurer(org.springframework.context.ApplicationContext context)`

## Method Summary

Modifier and Type
Method
Description
`OAuth2ResourceServerConfigurer<H>`
`accessDeniedHandler(org.springframework.security.web.access.AccessDeniedHandler accessDeniedHandler)`
`OAuth2ResourceServerConfigurer<H>`
`authenticationEntryPoint(org.springframework.security.web.AuthenticationEntryPoint entryPoint)`
`OAuth2ResourceServerConfigurer<H>`
`authenticationManagerResolver(org.springframework.security.authentication.AuthenticationManagerResolver<jakarta.servlet.http.HttpServletRequest> authenticationManagerResolver)`
`OAuth2ResourceServerConfigurer<H>`
`bearerTokenResolver(org.springframework.security.oauth2.server.resource.web.BearerTokenResolver bearerTokenResolver)`
`void`
`configure(H http)`
Configure the `SecurityBuilder` by setting the necessary properties on the `SecurityBuilder`.
`void`
`init(H http)`
Initialize the `SecurityBuilder`.
`OAuth2ResourceServerConfigurer<H>.JwtConfigurer`
`jwt()`
Deprecated, for removal: This API element is subject to removal in a future version.
For removal in 7.0.
`OAuth2ResourceServerConfigurer<H>`
`jwt(Customizer<OAuth2ResourceServerConfigurer<H>.JwtConfigurer> jwtCustomizer)`
Enables Jwt-encoded bearer token support.
`OAuth2ResourceServerConfigurer<H>.OpaqueTokenConfigurer`
`opaqueToken()`
Deprecated, for removal: This API element is subject to removal in a future version.
For removal in 7.0.
`OAuth2ResourceServerConfigurer<H>`
`opaqueToken(Customizer<OAuth2ResourceServerConfigurer<H>.OpaqueTokenConfigurer> opaqueTokenCustomizer)`
Enables opaque bearer token support.

### Methods inherited from class org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer

`disable, getSecurityContextHolderStrategy, withObjectPostProcessor, withObjectPostProcessor`

### Methods inherited from class org.springframework.security.config.annotation.SecurityConfigurerAdapter

`addObjectPostProcessor, addObjectPostProcessor, and, getBuilder, postProcess, setBuilder`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Constructor Details

### OAuth2ResourceServerConfigurer

public OAuth2ResourceServerConfigurer(org.springframework.context.ApplicationContext context)

## Method Details

### accessDeniedHandler

public OAuth2ResourceServerConfigurer<H> accessDeniedHandler(org.springframework.security.web.access.AccessDeniedHandler accessDeniedHandler)

### authenticationEntryPoint

public OAuth2ResourceServerConfigurer<H> authenticationEntryPoint(org.springframework.security.web.AuthenticationEntryPoint entryPoint)

### authenticationManagerResolver

public OAuth2ResourceServerConfigurer<H> authenticationManagerResolver(org.springframework.security.authentication.AuthenticationManagerResolver<jakarta.servlet.http.HttpServletRequest> authenticationManagerResolver)

### bearerTokenResolver

public OAuth2ResourceServerConfigurer<H> bearerTokenResolver(org.springframework.security.oauth2.server.resource.web.BearerTokenResolver bearerTokenResolver)

### jwt

@Deprecated(since="6.1", forRemoval=true) public OAuth2ResourceServerConfigurer<H>.JwtConfigurer jwt()
Deprecated, for removal: This API element is subject to removal in a future version.
For removal in 7.0. Use `jwt(Customizer)` or `jwt(Customizer.withDefaults())` to stick with defaults. See the documentation for more details.

### jwt

public OAuth2ResourceServerConfigurer<H> jwt(Customizer<OAuth2ResourceServerConfigurer<H>.JwtConfigurer> jwtCustomizer)
Enables Jwt-encoded bearer token support.

Parameters:
  `jwtCustomizer` - the `Customizer` to provide more options for the `OAuth2ResourceServerConfigurer<H extends HttpSecurityBuilder<H>>.JwtConfigurer`
Returns:
  the `OAuth2ResourceServerConfigurer` for further customizations

### opaqueToken

@Deprecated(since="6.1", forRemoval=true) public OAuth2ResourceServerConfigurer<H>.OpaqueTokenConfigurer opaqueToken()
Deprecated, for removal: This API element is subject to removal in a future version.
For removal in 7.0. Use `opaqueToken(Customizer)` or `opaqueToken(Customizer.withDefaults())` to stick with defaults. See the documentation for more details.

### opaqueToken

public OAuth2ResourceServerConfigurer<H> opaqueToken(Customizer<OAuth2ResourceServerConfigurer<H>.OpaqueTokenConfigurer> opaqueTokenCustomizer)
Enables opaque bearer token support.

Parameters:
  `opaqueTokenCustomizer` - the `Customizer` to provide more options for the `OAuth2ResourceServerConfigurer<H extends HttpSecurityBuilder<H>>.OpaqueTokenConfigurer`
Returns:
  the `OAuth2ResourceServerConfigurer` for further customizations

### init

public void init(H http)
Description copied from interface: `SecurityConfigurer`
Initialize the `SecurityBuilder`. Here only shared state should be created and modified, but not properties on the `SecurityBuilder` used for building the object. This ensures that the `SecurityConfigurer.configure(SecurityBuilder)` method uses the correct shared objects when building. Configurers should be applied here.

Specified by:
  `init` in interface `SecurityConfigurer<org.springframework.security.web.DefaultSecurityFilterChain,H extends HttpSecurityBuilder<H>>`
Overrides:
  `init` in class `SecurityConfigurerAdapter<org.springframework.security.web.DefaultSecurityFilterChain,H extends HttpSecurityBuilder<H>>`

### configure

public void configure(H http)
Description copied from interface: `SecurityConfigurer`
Configure the `SecurityBuilder` by setting the necessary properties on the `SecurityBuilder`.

Specified by:
  `configure` in interface `SecurityConfigurer<org.springframework.security.web.DefaultSecurityFilterChain,H extends HttpSecurityBuilder<H>>`
Overrides:
  `configure` in class `SecurityConfigurerAdapter<org.springframework.security.web.DefaultSecurityFilterChain,H extends HttpSecurityBuilder<H>>`