Wsrtjtyk

I have a oauth2 spring boot application running and it works great. Now I have a second application ("microservice") which is running on a completely different machine and port.

I have tried nearly everything and nothing seems to work. I can not get the security to work so I am trying to understand what on earth is going on.

The 2nd application will only receive bearer tokens ("JWT tokens") and I want the application to contact the oauth server and "download" the user info that is associated with the Bearer token so that I can do authentication checks like hasRole() and isAuthenticated().

Is my 2nd application a oauth2 client or must it be a resource server? Must I use @EnableOAuth2Sso or @EnableResourceService?

This is my code right now:

@Configuration

@EnableOAuth2Sso

@EnableWebSecurity

@EnableGlobalMethodSecurity(prePostEnabled = true)

public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override

    public void configure(HttpSecurity http) throws Exception { 

http.authorizeRequests().antMatchers("/api/user/allowAllUrl").permitAll().anyRequest().authenticated();

    }



}

Are the annotations correct and WebSecurityConfigurerAdapter class?

Thanks