How to remove usage of http.apply(new OAuth2AuthorizationServerConfigurer())?

Question

As per the documentation for customizing the configuration. Following can be used:

@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
    OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
        new OAuth2AuthorizationServerConfigurer();
    http.apply(authorizationServerConfigurer);

    authorizationServerConfigurer
        .registeredClientRepository(registeredClientRepository) 

But http.apply() is deprecated (Spring security v6.2) and hence cannot be used. The document is also not updated. How to use http.apply() in such a scenario?

Answer 1

The example code in the Getting Started section of the Spring Authorization Server documentation invokes:

OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);

The operations performed by this method includes the effect of:

OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
    new OAuth2AuthorizationServerConfigurer();
http.apply(authorizationServerConfigurer);

Your security filter chain can invoke the getConfigurer method to get the OAuth2AuthorizationServerConfigurer instance to configure the authorization server:

http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
    .registeredClientRepository(registeredClientRepository)