Closed
Description
It is possible to configure Resource Server like so:
http
.oauth2ResourceServer()
.authenticationManagerResolver()
.jwt()
.jwtDecoder();
However, this configuration doesn't make sense because AuthenticationManagerResolver
supercedes any individually configured authentication mechanism.
We should error in this case since it's an invalid configuration. Specifically, if an AuthenticationManagerResolver
is specified, then we should error if either jwt
or opaqueToken
is specified.