Skip to content

[Spring] Include anyRequest().authenticated() in DefaultAadResourceServerConfiguration.defaultAadResourceServerFilterChain #51191

New issue
New issue
Open
Open
[Spring] Include anyRequest().authenticated() in DefaultAadResourceServerConfiguration.defaultAadResourceServerFilterChain#51191
Assignees
moarychan
Labels
ClientThis issue points to a problem in the data-plane of the library.azure-springAll azure-spring related issues

Description

@g2vinay
Vinay Gera (g2vinay)
opened on Nov 10, 2026

Library name and version

com.azure.spring:spring-cloud-azure-autoconfigure 7.4.0

Describe the bug

In AadResourceServerConfiguration.DefaultAadResourceServerConfiguration, defaultAadResourceServerFilterChain(HttpSecurity http) currently configures aadResourceServer() without configuring a default authorizeHttpRequests rule:

https://github.com/Azure/azure-sdk-for-java/blob/main/sdk/spring/spring-cloud-azure-autoconfigure/src/main/java/com/azure/spring/cloud/autoconfigure/implementation/aad/configuration/AadResourceServerConfiguration.java#L142-L154

    @Bean
    @ConditionalOnBean(AadResourceServerProperties.class)
    SecurityFilterChain defaultAadResourceServerFilterChain(HttpSecurity http) throws Exception {
        http.with(aadResourceServer(), Customizer.withDefaults());
        return http.build();
    }

By contrast, both DefaultAadWebSecurityConfiguration.defaultAadWebApplicationFilterChain in AadWebApplicationConfiguration.java and Spring Boot's default OAuth2ResourceServerJwtConfiguration.jwtSecurityFilterChain configure .authorizeHttpRequests(authorize -> authorize.anyRequest().authenticated()).

Expected behavior

DefaultAadResourceServerConfiguration.defaultAadResourceServerFilterChain should include .authorizeHttpRequests(authorize -> authorize.anyRequest().authenticated()) before calling http.build() so the default resource-server filter chain is consistent with DefaultAadWebSecurityConfiguration and Spring Boot's default OAuth2ResourceServerJwtConfiguration:

    @Bean
    @ConditionalOnBean(AadResourceServerProperties.class)
    SecurityFilterChain defaultAadResourceServerFilterChain(HttpSecurity http) throws Exception {
        http.with(aadResourceServer(), Customizer.withDefaults())
            .authorizeHttpRequests(authorize -> authorize.anyRequest().authenticated());
        return http.build();
    }

Activity

  1. github-actions commented on Nov 10, 2026

    @github-actions
    github-actionsBot
    on Nov 10, 2026 – with GitHub Actions
    Contributor

    Thank you for your feedback. Tagging and routing to the team member(s) best able to assist.

    //cc: Moary Chen (@moarychan) Dingmeng Xue (@dingmeng-xue) Jeff (@domainname)

  2. github-actions
    assigned
    Moary Chen (moarychan)
    on Nov 10, 2026
  3. github-actions
    added
    ClientThis issue points to a problem in the data-plane of the library.
    azure-springAll azure-spring related issues
    on Nov 10, 2026

  4. github-actions commented on Nov 10, 2026

    @github-actions
    github-actionsBot
    on Nov 10, 2026 – with GitHub Actions
    Contributor

    🎯 Agentic Issue Triage

    Summary: The default AAD resource server filter chain in Spring autoconfigure does not set authorizeHttpRequests(... anyRequest().authenticated()), unlike the AAD web app chain and Spring Boot's default JWT resource server chain.

    📋 Issue Details

    Package: com.azure.spring:spring-cloud-azure-autoconfigure 7.4.0
    Affected API: AadResourceServerConfiguration.DefaultAadResourceServerConfiguration#defaultAadResourceServerFilterChain
    Scenarios:

    • Default resource server chain applies no authorization rule to requests

    Root ask: Add .authorizeHttpRequests(authorize -> authorize.anyRequest().authenticated()) to the default chain.

    🔎 Debugging / Reproduction Notes

    Straightforward change; consider the behavior impact for existing users relying on the current default.

    Suggested investigation steps:

    1. Compare with DefaultAadWebSecurityConfiguration.defaultAadWebApplicationFilterChain.
    2. Apply the change and update/add tests in the autoconfigure AAD resource server tests.
    3. Add a CHANGELOG entry.
    🏷️ Label Confidence
    • Category: Client — SDK code behavior.
    • Service: azure-spring — module under sdk/spring.
    • Confidence: High. Author is a team member (write permission), so no customer labels. Deprecation check could not be performed (CSV fetch unavailable); the package is actively developed.
    👥 Owner Routing
    • Matched CODEOWNERS entry: # ServiceLabel: %azure-spring (line 163)
    • AzureSdkOwners: @moarychan @dingmeng-xue @domainname
    • ServiceOwners: none listed
    • Routing action: assigned one AzureSdkOwner and notified all owners
    • Scan notes: %Mgmt and other later entries did not match the Client/azure-spring labels.

    Generated by Agentic Triage for #51191 · auto · 25.5 AIC · ⊞ 16.5K · ◷

  5. github-project-automation
    added this to Spring Cloud Azureon Nov 10, 2026
  6. github-project-automation
    moved this to Todo in Spring Cloud Azureon Nov 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

ClientThis issue points to a problem in the data-plane of the library.azure-springAll azure-spring related issues

Type

No type

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions