スプリングセキュリティOauth2すべてのURLが許可されています

Question

私のapiの公開のいくつかのURLを作りたいと思います。しかし、ひとつのURLを設定すると、私のすべてのapiは許可なく公開されます。

@Override 
public void configure(HttpSecurity http) throws Exception { 

     http 
    .authorizeRequests() 
       .antMatchers("/api/books","/api/plainOffers","/api/offers","/api/public/*").permitAll(); 
} 

ResourceServer構成：ResourceServerConfigurationクラスの私のconfigureメソッドの下

@Configuration 
@EnableResourceServer 
public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter { 


@Override 
public void configure(HttpSecurity http) throws Exception { 


     http.authorizeRequests().antMatchers("/api/books").permitAll(); 
     http.authorizeRequests().antMatchers("/api/plainOffers").permitAll(); 
     http.authorizeRequests().antMatchers("/api/offers").permitAll(); 
     http.authorizeRequests().antMatchers("/api/public/*").permitAll();  
     //http.authorizeRequests().anyRequest().authenticated().and().httpBasic(); 
} 
}                         

認証サーバ：私はあなたが必要なrestricionsを追加する必要がありますね

@CrossOrigin 
@Configuration 
@EnableAuthorizationServer 
public class AuthorizationServerConfig 
    extends AuthorizationServerConfigurerAdapter{ 

@Autowired 
@Qualifier("userDetailsService") 
private UserDetailsService userDetailsService; 


@Autowired 
private AuthenticationManager authenticationManager; 

@Value("${api.oauth.tokenTimeout:3600}") 
private int expiration; 

@Override 
public void configure(AuthorizationServerEndpointsConfigurer configurer) throws Exception { 
    configurer.authenticationManager(authenticationManager); 
    configurer.userDetailsService(userDetailsService); 
} 

@Override 
public void configure(ClientDetailsServiceConfigurer clients) throws Exception { 
    clients.inMemory() 
    .withClient("api") 
    .secret("secret") 
    .accessTokenValiditySeconds(expiration) 
    .scopes("read", "write") 
    .authorizedGrantTypes("password", "refresh_token") 
    .resourceIds("oauth2-resource"); 
} 
} 

Answer 1

他のURL：

http.authorizeRequests().antMatchers("/api/books","/api/plainOffers","/api/offers","/api/public/*").permitAll(); 
http.authorizeRequests().anyRequest().authenticated().and().httpBasic();