Unable to have a secure and non secure endpoint in a single Oauth secured Spring controller -

i putting rest api using spring boot secured via oauth2. have security application built working fine managing jwt tokens.

i putting separate application handle general user profile resource requests such forgot password, registration , profile operations. annotated enableoauth2resource correctly adding oauth2authenticationprocessingfilter filter chain.

@springbootapplication @enableoauth2resource public class profileapplication extends springbootservletinitializer {      public static void main(string[] args) throws ioexception {         springapplication.run(profileapplication.class, args);     }      @override     protected springapplicationbuilder configure(springapplicationbuilder application) {         return application.sources(profileapplication.class);     } } 

the challenge facing cannot find way configure security post requests /profiles endpoint unsecured while requests or put pass in derived @authenticationprincipal provided bearer token.

i want have following in place within api post /profile create new user - no security /profile/{id} user id - requires admin permission or user authd post /password/reset - starts password reset - no security

i have following bean configure security

@configuration @enableglobalmethodsecurity(prepostenabled = true) @order(-10) //securityproperties.access_override_order) class securityconfig extends websecurityconfigureradapter {      @override      protected void configure(httpsecurity http) throws exception {         http.authorizerequests()                 .antmatchers("/", "/public/**").permitall()                                 .antmatchers(httpmethod.post, "/profiles/**").permitall()                 .antmatchers(httpmethod.get, "/profiles/**").fullyauthenticated()                 .antmatchers("/password/**").permitall()                 .anyrequest().fullyauthenticated()                 .and()                 .csrf().disable();     } } 

with above endpoint invocation fails 403 error without attempt lookup current user token post go through. looking in logs no longer see oauth2authenticationprocessingfilter in filter chain. attempt addd additional filters appears cause no longer registered.

this controller method looks like:

@requestmapping(method = {requestmethod.get}, value="/profiles/{login:.+}") @responsebody public responseentity<profile> get(@authenticationprincipal principal currentuser, @pathvariable string login) { 

if set order securityproperties.access_override_order request works , see lookup against oauth service based on profile in jwt bearer token post requests either profile or password controller fails 401. seems code never reaches filter , instead being intercepted oauth2authenticationprocessingfilter , request failing auth off bat.

is there way partially secure spring boot application when using @enableoauth2resource? have setup different configuration bean provide necessary overrides , if so, based on interface?

i think should move oauth2 resources request matchers in securityconfig , allow them handled resource server filter - class extending resourceserverconfigureradapter.

my answer inspired dave syer's answer given here. can find security config here.

or else try giving higher order bean.