I have below config to validate the access_token from the request Using the resource server api. I have the requirement to validate another access_token which has been set in custom header (Authorization_custom = Bearer blabla....). How do i do that using below configuration to validate both the tokens one by one?

as first priority is to validate the default header "Authorization: Bearer ...." & second validate the custom header "Authorization_custom: Bearer ...." using same resourceServer. Is that possible?

@Configuration
@EnableResourceServer
public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {

    @Autowired
    public Environment env;

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) {
        resources.resourceId("sample");
        RemoteTokenServices tokenServices = new RemoteTokenServices();
        tokenServices.setCheckTokenEndpointUrl(sampleResource().getTokenInfoUri());
        tokenServices.setClientId(sampleClient().getClientId());
        tokenServices.setClientSecret(sampleClient().getClientSecret());
        resources.tokenServices(tokenServices);
        resources.authenticationEntryPoint(authenticationEntryPoint());
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers(env.getProperty("some.web.base-path") + "/some",
                .permitAll().antMatchers("/**")
                .authenticated();
    }

    /** Access the configuration for the token service. */
    @Bean
    @ConfigurationProperties("some.oauth2.client")
    public AuthorizationCodeResourceDetails sampleClient() {
        return new AuthorizationCodeResourceDetails();
    }

    /** Access the configuration for the token validation. */
    @Bean
    @ConfigurationProperties("some.oauth2.resource")
    public ResourceServerProperties sampleResource() {
        return new ResourceServerProperties();
    }

}

app.yml:

some:
    oauth2
      client:
        clientId: some_resource
        clientSecret: some_pass
        accessTokenUri: some_uri
        userAuthorizationUri: some_uri
        tokenName: Bearer
        authenticationScheme: header
        clientAuthenticationScheme: header
        scope:
          - email
      resource:
        userInfoUri: some_uri
        tokenInfoUri: some_uri

Comment From: jzheaux

@satscreate, thanks for getting in touch, but it feels like this is a question that would be better suited to Stack Overflow. As mentioned in the guidelines for contributing, we prefer to use GitHub issues only for bugs and enhancements. Feel free to update this issue with a link to the re-posted Stackoverflow question (so that other people can find it) or add more detail if you feel this is a genuine bug.