The default TokenStore can no longer be injected since it is no longer exposed as a bean.

[ccampo133]

I have a service which injects the default TokenStore (InMemoryTokenStore) to use methods like removeAccessToken and removeRefreshToken. TokenStore is no longer a bean in 2.0.5.RELEASE, which causes all the code auto-wiring TokenStore to fail. This is a breaking change. Is there any workaround besides configuring my own TokenStore bean? If not, this change should be documented as a breaking change.

[dsyer]

It's pretty easy to create a TokenStore. Can you show some code to explain why it's not?

Sorry about the breaking change.

[ccampo133]

No it's not difficult, just not documented and it was a pain to update my code and walk into a bunch of 'bean not found' type exceptions :). I didn't know whether or not I had to do any special configuration to get the TokenStore to work. I did find out that I need to add it in both the resource and auth server configurations. Here is a sample configuration that will create an injectable InMemoryTokenStore:

@Configuration
@EnableWebSecurity
public class OAuth2Configuration {

    @Bean
    public TokenStore tokenStore() {
        return new InMemoryTokenStore();
    }

    @Configuration
    @EnableAuthorizationServer
    protected static class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {

        @Autowired
        private TokenStore tokenStore;

        @Override
        public void configure(final ClientDetailsServiceConfigurer clients) throws Exception {
            // Configure clients here...
        }

        @Override
        public void configure(final AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
            // @formatter:off
            endpoints
                .tokenStore(tokenStore);
            // @formatter:on
        }
    }

    @Configuration
    @EnableResourceServer
    protected static class ResourceServerConfig extends ResourceServerConfigurerAdapter {

        @Autowired
        private TokenStore tokenStore;

        @Override
        public void configure(final HttpSecurity http) throws Exception {
            // Configure OAuth client HTTP security here...
        }

        @Override
        public void configure(final ResourceServerSecurityConfigurer resources) throws Exception {
            resources.tokenStore(tokenStore);
        }
    }
}

This is pretty much what I'm using now.