As I can see from the code:
@Bean
@ConditionalOnMissingBean(
type = "org.springframework.security.oauth2.client.registration.ClientRegistrationRepository")
@Lazy
public InMemoryUserDetailsManager inMemoryUserDetailsManager(SecurityProperties properties,
ObjectProvider<PasswordEncoder> passwordEncoder)
InMemoryUserDetailsManager is populated only if ClientRegistrationRepository bean is not present. So my application broke down when I registered OAuth 2.0 client. Now I can manually setup my InMemoryUserDetailsManager, but I want to understand the reason to disable InMemoryUserDetailsManager when ClientRegistrationRepository is present? They seems to be working fine together.
I found this comment: https://github.com/spring-projects/spring-security/issues/4795#issuecomment-356411124 But what if I will need to support both: OAuth 2.0 and Basic authorization? Can it be a problem if I will use these beans together?
Comment From: wilkinsona
@20fps Please see this comment from @rwinch that explains the current default behaviour.
If you have any further questions, please follow up on Stack Overflow or Gitter. As mentioned in the guidelines for contributing, we prefer to use GitHub issues only for bugs and enhancements.