javaspring-bootspring-securityspring-security-oauth2spring-boot-starter-oauth2-client

Spring Boot Oauth2 autoconfigure cycle after upgrade

I'm upgrading my application from Spring Boot 2.5.4 to 2.6.1 and having depency issues:

Description:
The dependencies of some of the beans in the application context form a cycle:

   oidcAuthService defined in file [/pr/pr-security-oidc/target/classes/com/pr/MyOauth2AuthService.class]

┌─────┐
|  oauth2SecurityConfiguration
↑     ↓
|  org.springframework.boot.autoconfigure.web.servlet.WebMvcAutoConfiguration$EnableWebMvcConfiguration
↑     ↓
|  org.springframework.security.config.annotation.web.configuration.OAuth2ClientConfiguration$OAuth2ClientWebMvcSecurityConfiguration
└─────┘

After some investigation when excluding WebMvcAutoConfiguration.class the application is able to start but it leads to different security configuration related issues. Any ideas what is happening with the new Spring version, why WebMvcAutoConfiguration and OAuth2ClientConfiguration are conflicting with each other?

P.S. I'm using the spring-boot-starter-oauth2-client with spring boot with no issues on the older version.

Thanks!

Solution

  • You can try to place

    spring.main.allow-circular-references: true

    In your application.properties. For more follow the link: https://github.com/springdoc/springdoc-openapi/issues/1347