Resource server with Spring Security 5 issue with SecurityContextPersistenceFilter in SpringSecurityChain - spring

Question

I faced a problem with Resource Server in Spring Security 5. I'm using spring security 5.3.7 and spring boot in version 2.7.4 with dependecy:
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-oauth2-resource-server</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-oauth2-jose</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-core</artifactId>
</dependency>
My problem is with getting 401 Unauthorized response when I using Postman to get to secured resource. I set up my configuration server according to Spring docs https://docs.spring.io/spring-security/reference/servlet/oauth2/resource-server/jwt.html#oauth2resourceserver-jwt-minimaldependencies.
Below it's my configuration:
Controller class:
#PreAuthorize("hasAuthority('EXAMPLE')")
#RestController
public class MyController {
#GetMapping("/example")
public List<Something> myMethod(Principal auth) {
return ...
}
Configuration of my resource server with JWT + Key usecase:
#Configuration
#EnableWebSecurity(debug = true)
#EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityResourceServerConfig {
#Value("${spring.security.oauth2.resourceserver.jwt.key-value}")
private String signingKey;
#Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated())
.oauth2ResourceServer((oauth2) -> oauth2.jwt((jwt) -> jwt.decoder(jwtDecoder())))
.cors();
return http.build();
}
#Bean
public JwtDecoder jwtDecoder() {
byte[] secretByte = signingKey.getBytes();
SecretKey secretKey = new SecretKeySpec(secretByte, 0, secretByte.length, "RSA");
return NimbusJwtDecoder.withSecretKey(secretKey).build();
}
#Bean
public JwtAuthenticationConverter jwtAuthenticationConverter() {
JwtGrantedAuthoritiesConverter grantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
grantedAuthoritiesConverter.setAuthorityPrefix("");
JwtAuthenticationConverter jwtAuthenticationConverter = new JwtAuthenticationConverter();
jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(grantedAuthoritiesConverter);
return jwtAuthenticationConverter;
}
For logging my SecurityFilterChain i added #EnableWebSecurity(debug = true) and to application.yml
logging:
level:
org:
springframework:
security: DEBUG
When I make request to endpoint #GetMapping("/example"). I get 401 Unauthorized code. When I check logs of my service I see:
Security filter chain: [
DisableEncodeUrlFilter
WebAsyncManagerIntegrationFilter
SecurityContextPersistenceFilter
HeaderWriterFilter
CorsFilter
CsrfFilter
LogoutFilter
BearerTokenAuthenticationFilter
RequestCacheAwareFilter
SecurityContextHolderAwareRequestFilter
AnonymousAuthenticationFilter
SessionManagementFilter
ExceptionTranslationFilter
AuthorizationFilter
]
************************************************************
2022-10-01 16:16:54.912 DEBUG 1 --- , [http-nio-8080-exec-8] o.s.security.web.FilterChainProxy.doFilterInternal - Securing GET /roles
2022-10-01 16:16:54.913 DEBUG 1 --- , [http-nio-8080-exec-8] o.s.s.w.c.SecurityContextPersistenceFilter.doFilter - Set SecurityContextHolder to empty SecurityContext
2022-10-01 16:16:54.922 DEBUG 1 --- , [http-nio-8080-exec-8] o.s.s.w.c.HttpSessionSecurityContextRepository.saveContext - Did not store empty SecurityContext
2022-10-01 16:16:54.922 DEBUG 1 --- , [http-nio-8080-exec-8] o.s.s.w.c.SecurityContextPersistenceFilter.doFilter - Cleared SecurityContextHolder to complete request
So, my question is why am I getting 401 Unathorized code without configure any SecurityContextPersistenceFilter and any persisten configuration explicitly and BearerTokenAuthenticationFilter is not executed to Authenticate mu request?