Multiple Authentication strategy for Spring Reactive Webflux microservices

问题

This is in continuation of the question, Multiple WebsecurityConfigurerAdapter, I was able to successfully make two WebsecurityConfigurerAdapter work with two different security configurations. Now there are few microservices which have been upgraded to SpringBoot 2 with reactive webflux framework. Here too I want to do the same, where all apis are secured with jwt token and actuator apis are secured using basic auth. Here is my code

ActuatorSecurityConfig

@ConditionalOnWebApplication(type = ConditionalOnWebApplication.Type.REACTIVE)
@EnableWebFluxSecurity
public class ActuatorWebfluxSecurityConfig {

    @Value("${spring.security.user.name:admin}")
    private String userName;

    @Value("${spring.security.user.password:admin}")
    private String userPassword;

    @Value("${spring.security.user.roles:ADMIN}")
    private String userRole;

    @Bean
    PasswordEncoder encoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    @Order(-1)
    SecurityWebFilterChain springWebfluxSecurityFilterChain(ServerHttpSecurity http) {

        http.csrf().disable()
                .authenticationManager(authManager())
                .authorizeExchange().pathMatchers("/actuator/**").authenticated()
                .anyExchange().authenticated()
                .and()
                .httpBasic()
        ;
        return http.build();
    }

    public MapReactiveUserDetailsService userDetailsService() {
        UserDetails admin = User.builder()
                .username(userName)
                //.password(encoder().encode(userPassword))
                .password("{noop}" + userPassword)
                //.passwordEncoder(encoder())
                .roles(userRole)
                .build();
        return new MapReactiveUserDetailsService(admin);
    }

    private ReactiveAuthenticationManager authManager() {
        return new UserDetailsRepositoryReactiveAuthenticationManager(userDetailsService());
    }

Regular security Config

@EnableWebFluxSecurity
public class SecurityConfig {

    private static final String[] AUTH_WHITELIST = {
            "/docs/**",
            "/swagger-ui.html",
            "/swagger-resources",
            "/swagger-resources/**",
            "/v2/api-docs"
    };

    @Bean
    @Order(2)
    SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
        http.csrf().disable()
                .authorizeExchange()
                .pathMatchers(HttpMethod.OPTIONS, "/abc/**")
                .permitAll()
                .pathMatchers("/abc/**", "/xyz/**")
                .hasAuthority("ABC")
                .pathMatchers(AUTH_WHITELIST).permitAll()
                .and()
                .oauth2ResourceServer()
                .jwt().jwtAuthenticationConverter(grantedAuthoritiesExtractor())
        ;
        return http.build();
    }

    private Converter<Jwt, Mono<AbstractAuthenticationToken>> grantedAuthoritiesExtractor() {
        GrantedAuthoritiesExtractor extractor = new GrantedAuthoritiesExtractor();
        return new ReactiveJwtAuthenticationConverterAdapter(extractor);
    }
}

Both these configurations individually work. But when I try to make both of them work in together only the configuration with highest precedence work. Spring boot version is 2.1.5 and reactive spring security is 5.1.5

来源：https://stackoverflow.com/questions/59471908/multiple-authentication-strategy-for-spring-reactive-webflux-microservices