Spring Boot Oauth2 autoconfigure cycle after upgrade

Question

I'm upgrading my application from Spring Boot 2.5.4 to 2.6.1 and having depency issues:

Description:
The dependencies of some of the beans in the application context form a cycle:

   oidcAuthService defined in file [/pr/pr-security-oidc/target/classes/com/pr/MyOauth2AuthService.class]

┌─────┐
|  oauth2SecurityConfiguration
↑     ↓
|  org.springframework.boot.autoconfigure.web.servlet.WebMvcAutoConfiguration$EnableWebMvcConfiguration
↑     ↓
|  org.springframework.security.config.annotation.web.configuration.OAuth2ClientConfiguration$OAuth2ClientWebMvcSecurityConfiguration
└─────┘

After some investigation when excluding WebMvcAutoConfiguration.class the application is able to start but it leads to different security configuration related issues. Any ideas what is happening with the new Spring version, why WebMvcAutoConfiguration and OAuth2ClientConfiguration are conflicting with each other?

P.S. I'm using the spring-boot-starter-oauth2-client with spring boot with no issues on the older version.

Thanks!

this is occurring since spring 2.6 is the first version to check and error out on circular dependencies — eis, Jan 18 '22 at 14:21

score 3 · Accepted Answer · answered Dec 16 '21 at 14:15

3

You can try to place

spring.main.allow-circular-references: true

In your application.properties. For more follow the link: https://github.com/springdoc/springdoc-openapi/issues/1347

answered Dec 16 '21 at 14:15

Yaroslav Prokopenko

66
6

1

one should note this is a just a workaround. is this a known issue with spring security oauth2? – eis Jan 18 '22 at 14:21
did you manage to resolve this? – Martin Mucha Apr 29 '22 at 11:00

score 0 · Answer 2 · answered Apr 29 '22 at 11:53

I think the correct way is to remove:

... extends WebSecurityConfigurerAdapter

and replace it with bean:

@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http. ... <do whatever you did in configure method> ... .build();
}

Spring Boot Oauth2 autoconfigure cycle after upgrade

2 Answers2