API Java - Spring Boot allows access to controllers via postman, but via swagger not even if both are authenticated with the correct token and validated in Azure Dicretory.When I use annotations of the type @Component, @Service or @Configuration, SecurityFilterChain allows requests from controllers through postman, but blocks it in swagger, when removing any of these annotations the problem is reversed.
package br.com.xxxx.authentication.service;import br.com.xxxx.authentication.service.abstraction.interfaces.IMySecurityService;import org.springframework.context.annotation.Bean;import org.springframework.context.annotation.Configuration;import org.springframework.core.Ordered;import org.springframework.core.annotation.Order;import org.springframework.security.config.Customizer;import org.springframework.security.config.annotation.web.builders.HttpSecurity;import org.springframework.security.oauth2.client.oidc.web.logout.OidcClientInitiatedLogoutSuccessHandler;import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;import org.springframework.security.web.SecurityFilterChain;@Configurationpublic class MySecurityService implements IMySecurityService { @Order(Ordered.HIGHEST_PRECEDENCE) @Bean public SecurityFilterChain clientSecurityFilterChain(HttpSecurity http, ClientRegistrationRepository clientRegistrationRepository) throws Exception { http.oauth2Login(); final var logoutSuccessHandler = new OidcClientInitiatedLogoutSuccessHandler(clientRegistrationRepository); logoutSuccessHandler.setPostLogoutRedirectUri("{baseUrl}"); http.logout(logout -> logout.logoutSuccessHandler(logoutSuccessHandler)); http.cors().disable(); http.csrf().disable(); http.oauth2ResourceServer((oauth2) -> oauth2.jwt(Customizer.withDefaults())); http.authorizeHttpRequests().requestMatchers("/swagger*/**", "/v3/api-docs*/**", "/login/**", "/oauth2/**", "/user/login/**").permitAll().anyRequest().authenticated(); return http.build(); }}
package br.com.xxxx.authentication.service.abstraction.interfaces;import org.springframework.security.config.annotation.web.builders.HttpSecurity;import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;import org.springframework.security.web.SecurityFilterChain;public interface IMySecurityService { SecurityFilterChain clientSecurityFilterChain(HttpSecurity http, ClientRegistrationRepository clientRegistrationRepository) throws Exception;}
When removing any of these annotations the problem is reversed, starting to accept requests from the controller through swagger only.
The error that has been occurring is HTTP 401
Debuging log and print-screen Postman
[Postman call - not using anotation @Configurarion][1]
[1]: https://i.stack.imgur.com/nFNx8.png
[Postman call - using anotation @Configurarion][2]
[2]: https://i.stack.imgur.com/SwtaE.png
[Application Log][3]
[3]: https://i.stack.imgur.com/hnnG2.png
Debuging log and print-screen Swagger
[Returning swagger calling controller - using anotation @Configurarion][4]
[4]: https://i.stack.imgur.com/ZIGq0.png
[Swagger calling controller - not using anotation @Configurarion][5]
[5]: https://i.stack.imgur.com/oHktn.png