I have the following two Beans

    @Bean
    @Order(1)
    public SecurityFilterChain actuatorsFilterChain(HttpSecurity http)
            throws Exception {
        http
                .cors(Customizer.withDefaults())
                .csrf(AbstractHttpConfigurer::disable)

                .authorizeHttpRequests(auth -> auth
                        .requestMatchers("/actuators/info").permitAll() 
                        .requestMatchers("/actuators/**").hasRole("UTILS") 
                )

                .httpBasic(Customizer.withDefaults());

        return http.build();
    }

    @Bean
    @Order(3)
    public SecurityFilterChain oktaFilterChain(HttpSecurity http)
            throws Exception {
        http
                .cors(Customizer.withDefaults())
                .csrf(AbstractHttpConfigurer::disable)

                .authorizeHttpRequests(auth -> auth
                        .requestMatchers("/api/**").authenticated()
                )

                .oauth2ResourceServer((oauth2) -> oauth2.jwt(Customizer.withDefaults()));

        return http.build();
    }

There are two authentication modes here (which was fine in a previous version of Spring I’m upgrading). Now however, if I try to access anything “/api/**” I get a 401.

Here is an example call:

GET https://localhost/api/test/submission
Authorization: Bearer <bearertoken>

if I disable the first Bean the /api calls work. It’s as if, it doesn’t match on the first bean at all then it just immediately denies it.