oauth2-resource-server

# OAuth2 Resource Server Spring Boot 4.x ships **Spring Security 7** — lambda DSL only; `and()`, `authorizeRequests()`, `antMatchers()`, and `AntPathRequestMatcher`/`MvcRequestMatcher` are gone (`requestMatchers("/path/**")` is backed by `PathPatternRequestMatcher`). ## Dependency ```xml <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security-oauth2-resource-server</artifactId> </dependency> ``` ## Security Configuration ```java @Configuration @EnableWebSecurity @EnableMethodSecurity public class ResourceServerConfig { @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { return http .csrf(AbstractHttpConfigurer::disable) .sessionManagement(s -> s.sessionCreationPolicy(STATELESS)) .authorizeHttpRequests(auth -> auth .requestMatchers("/actuator/health").permitAll() .requestMatchers("/api/v1/admin/**").hasAuthority("SCOPE_admin") .anyRequest().authenticated() ) .oauth2ResourceServer(oauth2 -> oauth2 .jwt(jwt -> jwt.jwtAuthenticationConverter(jwtAuthConverter())) ) .build(); } @Bean public JwtAuthenticationConverter jwtAuthConverter() { var converter = new JwtGrantedAuthoritiesConverter(); converter.setAuthoritiesClaimName("roles"); // Keycloak uses "roles" converter.setAuthorityPrefix("ROLE_"); ...