I’m working with a Spring OAuth2 Authorization Server to secure my application’s endpoints. My goal is to restrict OAuth2 related endpoints (e.g., /oauth2/authorize, /oauth2/token) to users with the OAUTH2 authority, while allowing application endpoints accessible to users with the USER authority.

Current Configuration:

Here’s a breakdown of my relevant security filter chains:

@Bean
@Order(1)
SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
  OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
  http.getConfigurer(OAuth2AuthorizationServerConfigurer.class).oidc(withDefaults());
  http.oauth2ResourceServer((resourceServer) -> resourceServer.jwt(withDefaults()));
  http.exceptionHandling(exceptions -> exceptions.defaultAuthenticationEntryPointFor(
      new LoginUrlAuthenticationEntryPoint("/login"), createRequestMatcher())); 
  return http.build();
}

@Bean
@Order(2)
SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {
  http
    .authorizeHttpRequests(authorize -> authorize
        .requestMatchers("/login", "/actuator/**").permitAll()
        .requestMatchers("/oauth2/**").hasAuthority("OAUTH2") 
        .anyRequest().hasAuthority("USER") 
    )
    .formLogin(Customizer.withDefaults());  
  return http.build();
}

Application endpoints are working as expected – USER authority is required for general access. However, the OAuth2 endpoints (/oauth2/authorize, /oauth2/token) are accessible by users with any/empty authorities, rather than being restricted to the OAUTH2 authority.

How can I ensure that my OAuth2 secured endpoints are only accessible to users specifically possessing the OAUTH2 authority using Spring OAuth2 Authorization Server? I’d appreciate any assistance or insight.