Skip to content

Conversation

@therepanic
Copy link
Contributor

In this commit, we remove the InMemoryClientRegistrationRepository class from the OAuth2ResourceServerAutoConfiguration clause, after which we become independent of the OAuth2 client side.

Closes: gh-329

In this commit, we remove the InMemoryClientRegistrationRepository class
from the OAuth2ResourceServerAutoConfiguration clause, after which we
become independent of the OAuth2 client side.

Closes: spring-projectsgh-329

Signed-off-by: Andrey Litvitski <[email protected]>
@ConditionalOnSpringGrpc
@ConditionalOnClass({ InMemoryClientRegistrationRepository.class, BearerTokenAuthenticationToken.class,
ObjectPostProcessor.class })
@ConditionalOnClass({ BearerTokenAuthenticationToken.class, ObjectPostProcessor.class })
Copy link
Contributor Author

@therepanic therepanic Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As stated here, this class was copied:

// All copied from Spring Boot
// (https://github.com/spring-projects/spring-boot/issues/43978), except the
// 2 @Beans of type AuthenticationProcessInterceptor

However, to be honest, I didn't quite figure out where exactly it came from. Therefore, I don't quite understand why the @ConditionalOnClass class InMemoryClientRegistrationRepository was inserted. In fact, the server part should be completely isolated from the client part. In addition, the deletion was completely successful and all tests passed.

I also wrote a small local test (I didn't attach it because I thought it wouldn't be entirely relevant) that somehow checks whether we are isolated from the client part when starting the server resource. I did something like this:

private final ApplicationContextRunner contextRunner = new ApplicationContextRunner()
    .withClassLoader(new FilteredClassLoader(“org.springframework.security.oauth2.client”))
    .withConfiguration(
        AutoConfigurations.of(GrpcSecurityAutoConfiguration.class, OAuth2ResourceServerAutoConfiguration.class))
    .withUserConfiguration(TestConfig.class);

And everything went well, in principle. Without this change, the test given in main fails. In general, I don't quite understand why this dependency was inserted, and it seems to me that it's some kind of bug.

@dsyer dsyer merged commit eb2adf7 into spring-projects:main Dec 18, 2025
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

OAuth2 resource server should not need to be a client

2 participants