java - Why does this spring oauth configuration never return 401 unauthorized? -

i followed tutorial here attempt started spring oauth. however, no pages return 401 unauthorized, though have not authenticated server (the configuration examples in tutorial supposedly disable anonymous access. comment on tutorial related issue has single response saying authorization has not been enabled, have @enableauthorizationserver on 1 of configuration classes.

all config classes

application:

@springbootapplication @enabletransactionmanagement @enableautoconfiguration(exclude = {repositoryrestmvcautoconfiguration.class}) public class application extends springbootservletinitializer {     @override     protected springapplicationbuilder configure(springapplicationbuilder application) {         return application.sources(application.class);     }      public static void main(string[] args) {         springapplication.run(application.class, args);     } } 

authorization server:

@configuration @enableauthorizationserver public class authorizationserverconfig extends authorizationserverconfigureradapter {     private static string realm = "example_realm";      @autowired     private tokenstore tokenstore;      @autowired     private userapprovalhandler handler;      @autowired     @qualifier("authenticationmanagerbean")     private authenticationmanager authmanager;      @override     public void configure(clientdetailsserviceconfigurer clients) throws exception {          clients.inmemory()                .withclient("trusted-client")                .authorizedgranttypes("password", "authorization_code", "refresh_token", "implicit")                .authorities("role_client", "role_trusted_client")                .scopes("read", "write", "trust")                .secret("secret")                .accesstokenvalidityseconds(300)//invalid after 5 minutes.                .refreshtokenvalidityseconds(600);//refresh after 10 minutes.     }      @override     public void configure(authorizationserverendpointsconfigurer endpoints) throws exception {         endpoints.tokenstore(tokenstore).userapprovalhandler(handler)                  .authenticationmanager(authmanager);     }      @override     public void configure(authorizationserversecurityconfigurer oauthserver) throws exception {         oauthserver.realm(realm + "/client");     } } 

resource server (note changed antmatchers anyrequest testing purposes):

@configuration @enableresourceserver public class resourceserverconfig extends resourceserverconfigureradapter {     private static final string resource_id = "spring_rest_api";      @override     public void configure(resourceserversecurityconfigurer resources) {         resources.resourceid(resource_id).stateless(false);     }      @override     public void configure(httpsecurity http) throws exception {         http.anonymous().disable()             .requestmatchers().anyrequest()             .and().authorizerequests()             .anyrequest().access("hasrole('admin')")             .and().exceptionhandling().accessdeniedhandler(new oauth2accessdeniedhandler());     } } 

"security":

@configuration @enablewebsecurity public class securityconfig extends websecurityconfigureradapter {     @autowired     private clientdetailsservice clientservice;      @autowired     public void globaluserdetails(authenticationmanagerbuilder auth) throws exception {         auth.inmemoryauthentication()             .withuser("javabycode").password("123456").roles("user")             .and()             .withuser("admin").password("admin123").roles("admin");     }      @override     protected void configure(httpsecurity http) throws exception {         http.csrf().disable()             .anonymous().disable()             .authorizerequests()             .antmatchers("/oauth/token").permitall();     }      @override     @bean     public authenticationmanager authenticationmanagerbean() throws exception {         return super.authenticationmanagerbean();     }       @bean     public tokenstore tokenstore() {         return new inmemorytokenstore();     }      @bean     @autowired     public tokenstoreuserapprovalhandler userapprovalhandler(tokenstore tokenstore){         tokenstoreuserapprovalhandler handler = new tokenstoreuserapprovalhandler();         handler.settokenstore(tokenstore);         handler.setrequestfactory(new defaultoauth2requestfactory(clientservice));         handler.setclientdetailsservice(clientservice);         return handler;     }      @bean     @autowired     public approvalstore approvalstore(tokenstore tokenstore) throws exception {         tokenapprovalstore store = new tokenapprovalstore();         store.settokenstore(tokenstore);         return store;     } } 

probably unrelated, there also:

@configuration @enablewebmvc @enablewebsecurity public class webconfig extends webmvcconfigureradapter {     @override     public void addcorsmappings(corsregistry registry) {         registry.addmapping("/**");     } } 

after reading through full source code of tutorial, added

@configuration @enableglobalmethodsecurity(prepostenabled = true, proxytargetclass = true) public class methodsecurityconfig extends globalmethodsecurityconfiguration {     @override     protected methodsecurityexpressionhandler createexpressionhandler() {         return new oauth2methodsecurityexpressionhandler();     } } 

finally, build.gradle project since have had issues specific versions of dependencies when working spring:

buildscript {     repositories {         mavencentral()     }     dependencies {         classpath("org.springframework.boot:spring-boot-gradle-plugin:1.5.1.release")         classpath('com.h2database:h2:1.4.193')         classpath('org.hibernate:hibernate-core:5.0.12.final')         classpath('org.springframework.boot:spring-boot-starter-security:1.5.2.release')     } }  apply plugin: 'idea' apply plugin: 'java' apply plugin: 'org.springframework.boot' apply plugin: 'war' sourcecompatibility = 1.8 targetcompatibility = 1.8  string appversion = "1.0.0"  war{     basename="cubscout-rest"     version=appversion     dofirst {         manifest {             attributes("implementation-title": 'cubscout-rest', "implementation-version": appversion, "implementation-timestamp": new date())         }     } }  repositories {     jcenter() }  dependencies {     compile project(':core')      compile 'org.springframework.boot:spring-boot-gradle-plugin:1.3.5.release'     compile 'org.springframework.boot:spring-boot-starter-web:1.5.1.release'     compile 'org.springframework.boot:spring-boot-starter-data-jpa:1.5.1.release'     //compile 'org.springframework.integration:spring-integration-core:4.3.7.release'     //compile 'org.springframework.batch:spring-batch-core:3.0.7.release'     compile 'org.springframework.data:spring-data-jpa:1.11.0.release'     compile 'org.springframework.data:spring-data-rest-webmvc:2.6.0.release'     compile 'org.springframework.security:spring-security-web:4.2.1.release'     //compile 'org.springframework.boot:spring-boot-starter-security:1.5.2.release'     compile 'org.springframework.security.oauth:spring-security-oauth2:2.1.0.release'     compile 'org.hibernate:hibernate-core:5.0.12.final'     compile 'com.h2database:h2:1.4.193'     compile 'org.springframework.boot:spring-boot-starter-tomcat:1.5.1.release'     testcompile 'junit:junit:4.12'     testcompile 'org.mockito:mockito-all:1.10.19'     providedruntime 'org.springframework.boot:spring-boot-starter-tomcat:1.5.1.release' } 

one of spring boot's autoconfigurations interfering. changing

@springbootapplication @enabletransactionmanagement @enableautoconfiguration(exclude = {repositoryrestmvcautoconfiguration.class}) public class application extends springbootservletinitializer { 

with

@springbootapplication @enabletransactionmanagement @enableautoconfiguration(exclude = {repositoryrestmvcautoconfiguration.class, oauth2autoconfiguration.class}) public class application extends springbootservletinitializer { 

allows configurations function properly.