Getting this error while trying to perform Oauth2.0 authentication using Azure Active Directory in Java Spring Boot

Question

I have been getting this error when I try to run my Spring Boot Application that is performing a Oauth 2.0 authentication to authenticate users onto the Application . Here are the Spring boot version and Java version that I am using

1. Spring-boot Starter Parent version : 2.6.6
2. Java Version : 11.0.16

Error creating bean with name 'springSecurityFilterChain' defined in class path resource [org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [javax.servlet.Filter]: Factory method 'springSecurityFilterChain' threw exception; nested exception is java.lang.NullPointerException at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:658) ~[spring-beans-5.3.18.jar:5.3.18] at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:486) ~[spring-beans-5.3.18.jar:5.3.18] at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1352) ~[spring-beans-5.3.18.jar:5.3.18] at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1195) ~[spring-beans-5.3.18.jar:5.3.18] at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:582) ~[spring-beans-5.3.18.jar:5.3.18] at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:542) ~[spring-beans-5.3.18.jar:5.3.18] at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean0ドル(AbstractBeanFactory.java:335) ~[spring-beans-5.3.18.jar:5.3.18] at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:234) ~[spring-beans-5.3.18.jar:5.3.18] at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:333) ~[spring-beans-5.3.18.jar:5.3.18] at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:208) ~[spring-beans-5.3.18.jar:5.3.18] at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:322) ~[spring-beans-5.3.18.jar:5.3.18] at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:208) ~[spring-beans-5.3.18.jar:5.3.18] at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:953) ~[spring-beans-5.3.18.jar:5.3.18] at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:918) ~[spring-context-5.3.18.jar:5.3.18] at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:583) ~[spring-context-5.3.18.jar:5.3.18] at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.refresh(ServletWebServerApplicationContext.java:145) ~[spring-boot-2.6.6.jar:2.6.6] at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:740) ~[spring-boot-2.6.6.jar:2.6.6] at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:415) ~[spring-boot-2.6.6.jar:2.6.6] at org.springframework.boot.SpringApplication.run(SpringApplication.java:303) ~[spring-boot-2.6.6.jar:2.6.6] at org.springframework.boot.SpringApplication.run(SpringApplication.java:1312) ~[spring-boot-2.6.6.jar:2.6.6] at org.springframework.boot.SpringApplication.run(SpringApplication.java:1301) ~[spring-boot-2.6.6.jar:2.6.6] at com.amadeus.controltower.mainapp.ControlTower.main(ControlTower.java:24) ~[classes/:na] at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:na] at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:na] at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:na] at java.base/java.lang.reflect.Method.invoke(Method.java:566) ~[na:na] at org.springframework.boot.devtools.restart.RestartLauncher.run(RestartLauncher.java:49) ~[spring-boot-devtools-2.6.6.jar:2.6.6]

These are the pom configurations and Securityconfigurations for Spring boot oauth

<project xmlns="http://maven.apache.org/POM/4.0.0"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 <modelVersion>4.0.0</modelVersion>
 <parent>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-parent</artifactId>
 <version>2.6.6</version>
 <relativePath />
 </parent>
 <groupId>com.amadeus.dla.ccp.ctower</groupId>
 <artifactId>controltower</artifactId>
 <version>1.0.8</version>
 <packaging>jar</packaging>
 <properties>
 <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
 <java.version>11</java.version>
 <maven.compiler.release>${java.version}</maven.compiler.release>
 </properties>
 <repositories>
 <repository>
 <id>splunk-artifactory</id>
 <name>Splunk Releases</name>
 <url>https://splunk.jfrog.io/artifactory/libs-releases</url>
 </repository>
 </repositories>
 <dependencies>
 <dependency>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-mail</artifactId>
 </dependency>
 <dependency>
 <groupId>javax.mail</groupId>
 <artifactId>mail</artifactId>
 <version>1.5.0-b01</version>
 </dependency>
 <dependency>
 <groupId>org.jboss.spec.javax.ejb</groupId>
 <artifactId>jboss-ejb-api_3.2_spec</artifactId>
 <scope>provided</scope>
 <version>1.0.1.Final</version>
 </dependency>
 <dependency>
 <groupId>org.jboss.resteasy</groupId>
 <artifactId>jaxrs-api</artifactId>
 <version>3.0.8.Final</version>
 </dependency>
 <dependency>
 <groupId>javax.enterprise</groupId>
 <artifactId>cdi-api</artifactId>
 <version>2.0</version>
 </dependency>
 <dependency>
 <groupId>org.jboss.spec.javax.faces</groupId>
 <artifactId>jboss-jsf-api_2.2_spec</artifactId>
 <version>2.2.8</version>
 </dependency>
 <!-- Import the JPA API, we use provided scope as the API is included in 
 JBoss WildFly -->
 <dependency>
 <groupId>org.hibernate.javax.persistence</groupId>
 <artifactId>hibernate-jpa-2.1-api</artifactId>
 <version>1.0.2.Final</version>
 <exclusions>
 <exclusion>
 <groupId>org.slf4j</groupId>
 <artifactId>slf4j-api</artifactId>
 </exclusion>
 <exclusion>
 <groupId>dom4j</groupId>
 <artifactId>dom4j</artifactId>
 </exclusion>
 </exclusions>
 </dependency>
 <dependency>
 <groupId>org.jboss.resteasy</groupId>
 <artifactId>resteasy-jaxrs</artifactId>
 <version>3.5.1.Final</version>
 </dependency>
 <dependency>
 <groupId>org.jboss.resteasy</groupId>
 <artifactId>resteasy-validator-provider-11</artifactId>
 <version>3.0.24.Final</version>
 </dependency>
 <dependency>
 <groupId>org.jboss.resteasy</groupId>
 <artifactId>resteasy-client</artifactId>
 <version>3.5.0.Final</version>
 </dependency>
 <dependency>
 <groupId>org.jboss.resteasy</groupId>
 <artifactId>resteasy-jackson2-provider</artifactId>
 <version>3.5.1.Final</version>
 </dependency>
 <dependency>
 <groupId>org.sonarsource.sonarqube</groupId>
 <artifactId>sonar-ws</artifactId>
 <version>5.6.3</version>
 <type>jar</type>
 </dependency>
 <dependency>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-actuator</artifactId>
 </dependency>
 <dependency>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-web</artifactId>
 <exclusions>
 <exclusion>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-logging</artifactId>
 </exclusion>
 </exclusions>
 </dependency>
 <dependency>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-devtools</artifactId>
 <scope>runtime</scope>
 </dependency>
 <dependency>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-test</artifactId>
 <scope>test</scope>
 </dependency>
 <dependency>
 <groupId>org.scribe</groupId>
 <artifactId>scribe</artifactId>
 <version>1.3.7</version>
 </dependency>
 <dependency>
 <groupId>commons-io</groupId>
 <artifactId>commons-io</artifactId>
 <version>2.11.0</version>
 </dependency>
 <dependency>
 <groupId>org.apache.commons</groupId>
 <artifactId>commons-lang3</artifactId>
 </dependency>
 <dependency>
 <groupId>com.google.code.gson</groupId>
 <artifactId>gson</artifactId>
 </dependency>
 <dependency>
 <groupId>commons-configuration</groupId>
 <artifactId>commons-configuration</artifactId>
 <version>1.10</version>
 </dependency>
 <dependency>
 <groupId>commons-collections</groupId>
 <artifactId>commons-collections</artifactId>
 <version>3.2.2</version>
 </dependency>
 <dependency>
 <groupId>commons-beanutils</groupId>
 <artifactId>commons-beanutils</artifactId>
 <version>1.9.4</version>
 </dependency>
 <dependency>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-data-jpa</artifactId>
 </dependency>
 <dependency>
 <groupId>org.mariadb.jdbc</groupId>
 <artifactId>mariadb-java-client</artifactId>
 </dependency>
 <dependency>
 <groupId>com.googlecode.json-simple</groupId>
 <artifactId>json-simple</artifactId>
 <version>1.1</version>
 </dependency>
 <dependency>
 <groupId>ch.qos.logback</groupId>
 <artifactId>logback-classic</artifactId>
 </dependency>
 <dependency>
 <groupId>ch.qos.logback</groupId>
 <artifactId>logback-core</artifactId>
 </dependency>
 <!-- https://mvnrepository.com/artifact/com.splunk.logging/splunk-library-javalogging -->
 <dependency>
 <groupId>com.splunk.logging</groupId>
 <artifactId>splunk-library-javalogging</artifactId>
 <version>1.6.2</version>
 <scope>runtime</scope>
 </dependency>
 <dependency>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-security</artifactId>
 </dependency>
 <!-- SWagger dependency -->
 <dependency>
 <groupId>io.springfox</groupId>
 <artifactId>springfox-swagger2</artifactId>
 <version>2.8.0</version>
 </dependency>
 <dependency>
 <groupId>io.springfox</groupId>
 <artifactId>springfox-swagger-ui</artifactId>
 <version>2.8.0</version>
 <scope>compile</scope>
 </dependency>
 <!-- Self Signed Certificate generation dependency -->
 <dependency>
 <groupId>org.bouncycastle</groupId>
 <artifactId>bcpkix-jdk15on</artifactId>
 <version>1.60</version>
 </dependency>
 <dependency>
 <groupId>com.sun.jersey</groupId>
 <artifactId>jersey-client</artifactId>
 <version>1.19.4</version>
 </dependency>
 <!-- AAD dependency -->
 <dependency>
 <groupId>org.springframework.security.oauth.boot</groupId>
 <artifactId>spring-security-oauth2-autoconfigure</artifactId>
 <version>2.1.1.RELEASE</version>
 </dependency>
 <dependency>
 <groupId>com.sun.xml.bind</groupId>
 <artifactId>jaxb-core</artifactId>
 <version>2.3.0.1</version>
 </dependency>
 <dependency>
 <groupId>javax.xml.bind</groupId>
 <artifactId>jaxb-api</artifactId>
 <version>2.3.1</version>
 </dependency>
 <!-- Junit Dependency -->
 <dependency>
 <groupId>org.junit.vintage</groupId>
 <artifactId>junit-vintage-engine</artifactId>
 <scope>test</scope>
 <exclusions>
 <exclusion>
 <groupId>org.hamcrest</groupId>
 <artifactId>hamcrest-core</artifactId>
 </exclusion>
 </exclusions>
 </dependency>
 <!-- https://mvnrepository.com/artifact/io.prometheus/simpleclient -->
 <dependency>
 <groupId>io.micrometer</groupId>
 <artifactId>micrometer-registry-prometheus</artifactId>
 <scope>runtime</scope>
 </dependency>
 <!-- https://mvnrepository.com/artifact/org.hibernate/hibernate-validator -->
 <dependency>
 <groupId>org.hibernate</groupId>
 <artifactId>hibernate-validator</artifactId>
 <version>7.0.4.Final</version>
 </dependency>
 <!-- https://mvnrepository.com/artifact/com.google.guava/guava -->
 <dependency>
 <groupId>com.google.guava</groupId>
 <artifactId>guava</artifactId>
 <version>31.1-jre</version>
 </dependency>
 <!-- https://mvnrepository.com/artifact/org.jboss.spec.javax.faces/jboss-jsf-api_2.3_spec -->
 <dependency>
 <groupId>org.jboss.spec.javax.faces</groupId>
 <artifactId>jboss-jsf-api_2.3_spec</artifactId>
 <version>3.1.0.SP02</version>
 </dependency>
 <!-- https://mvnrepository.com/artifact/com.squareup.okhttp/okhttp -->
 <dependency>
 <groupId>com.squareup.okhttp</groupId>
 <artifactId>okhttp</artifactId>
 <version>2.7.5</version>
 </dependency>
 </dependencies>
 <!-- <dependency> <groupId>com.amadeus.mdw.logging</groupId> <artifactId>logback-jtracer</artifactId> 
 <version>1.0-SNAPSHOT</version> </dependency> -->
 <build>
 <plugins>
 <plugin>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-maven-plugin</artifactId>
 </plugin>
 </plugins>
 </build>
</project>
Security config.java 
@Configuration
@EnableOAuth2Sso
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {
 @Autowired
 private Environment env;
 @Override
 public void configure(WebSecurity web) {
 web.ignoring()
 .antMatchers("/nameofapp/webservices/**");
 }
 @Override
 protected void configure(HttpSecurity http) throws Exception {
 List<String> origins = new ArrayList<String>();
 origins.add(env.getProperty("app.ui"));
 
 UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
 CorsConfiguration config = new CorsConfiguration();
 config.setAllowCredentials(true);
 config.setAllowedOrigins(origins);
 config.addAllowedHeader("*");
 config.addAllowedMethod("*");
 source.registerCorsConfiguration("/**", config);
 http.cors().configurationSource(source).and().httpBasic().and().authorizeRequests()
 .antMatchers("/nameofapp/**","/swagger*","/actuator/*").permitAll().and().authorizeRequests()
 .anyRequest().authenticated();
 http.csrf().csrfTokenRepository(new CustomCookieCsrfTokenRepository());
 http.csrf().ignoringAntMatchers("/nameofapp/webservices/**");
 http.headers().frameOptions().sameOrigin();
 http.formLogin().loginPage("/login.html");
 }
 @Bean
 public RequestContextListener requestContextListener() {
 return new RequestContextListener();
 }
 
 @Bean
 public WebMvcEndpointHandlerMapping webEndpointServletHandlerMapping(WebEndpointsSupplier webEndpointsSupplier, ServletEndpointsSupplier servletEndpointsSupplier, ControllerEndpointsSupplier controllerEndpointsSupplier, EndpointMediaTypes endpointMediaTypes, CorsEndpointProperties corsProperties, WebEndpointProperties webEndpointProperties, Environment environment) {
 List<ExposableEndpoint<?>> allEndpoints = new ArrayList();
 Collection<ExposableWebEndpoint> webEndpoints = webEndpointsSupplier.getEndpoints();
 allEndpoints.addAll(webEndpoints);
 allEndpoints.addAll(servletEndpointsSupplier.getEndpoints());
 allEndpoints.addAll(controllerEndpointsSupplier.getEndpoints());
 String basePath = webEndpointProperties.getBasePath();
 EndpointMapping endpointMapping = new EndpointMapping(basePath);
 boolean shouldRegisterLinksMapping = this.shouldRegisterLinksMapping(webEndpointProperties, environment, basePath);
 return new WebMvcEndpointHandlerMapping(endpointMapping, webEndpoints, endpointMediaTypes, corsProperties.toCorsConfiguration(), new EndpointLinksResolver(allEndpoints, basePath), shouldRegisterLinksMapping, null);
 }
 private boolean shouldRegisterLinksMapping(WebEndpointProperties webEndpointProperties, Environment environment, String basePath) {
 return webEndpointProperties.getDiscovery().isEnabled() && (StringUtils.hasText(basePath) || ManagementPortType.get(environment).equals(ManagementPortType.DIFFERENT));
 }
}

• John Williams: I have used your POM snippet, spring-boot-parent and java versions and my spring boot starts. If you can update your post with more of your code and pom that still fails to start. I can have a better look.
• Siddhant: Hi John, I have attached the securityconfig.java class as well for your reference, Hope it helps to solve my query

Answer 1

My similar setup starts. I have used your pom.xml. My only change is to swap out mariadb for h2 dependency as follows:

<dependency>
 <groupId>com.h2database</groupId>
 <artifactId>h2</artifactId>
 <scope>runtime</scope>
</dependency>

Also added the following to application.properties to allow H2 DB:

spring.datasource.url=jdbc:h2:mem:testdb
spring.datasource.driverClassName=org.h2.Driver
spring.datasource.username=sa
spring.datasource.password=
spring.jpa.database-platform=org.hibernate.dialect.H2Dialect

The only other change I made was using HttpSessionCsrfTokenRepository in place of CustomCookieCsrfTokenRepository because I don't have that code.

Startup log:

 /\\ / ___'_ __ _ _(_)_ __ __ _ \ \ \ \
( ( )\___ | '_ | '_| | '_ \/ _` | \ \ \ \
 \\/ ___)| |_)| | | | | || (_| | ) ) ) )
 ' |____| .__|_| |_|_| |_\__, | / / / /
 =========|_|==============|___/=/_/_/_/
 :: Spring Boot :: (v2.6.6)
2023年02月01日 14:26:24.325 INFO 13484 --- [ main] com.example.demo.Spring61Application : Starting Spring61Application using Java 11.0.15 on NB-3HP3HG3 with PID 13484 (C:\workspaces\stackoverflow_workspace\springboot2.7.8\target\classes started by WilliamsJ in C:\workspaces\stackoverflow_workspace\springboot2.7.8)
2023年02月01日 14:26:24.327 INFO 13484 --- [ main] com.example.demo.Spring61Application : No active profile set, falling back to 1 default profile: "default"
2023年02月01日 14:26:25.481 INFO 13484 --- [ main] o.s.b.w.embedded.tomcat.TomcatWebServer : Tomcat initialized with port(s): 8080 (http)
2023年02月01日 14:26:25.501 INFO 13484 --- [ main] o.apache.catalina.core.StandardService : Starting service [Tomcat]
2023年02月01日 14:26:25.501 INFO 13484 --- [ main] org.apache.catalina.core.StandardEngine : Starting Servlet engine: [Apache Tomcat/9.0.60]
2023年02月01日 14:26:25.634 INFO 13484 --- [ main] o.a.c.c.C.[Tomcat].[localhost].[/] : Initializing Spring embedded WebApplicationContext
2023年02月01日 14:26:25.634 INFO 13484 --- [ main] w.s.c.ServletWebServerApplicationContext : Root WebApplicationContext: initialization completed in 1269 ms
2023年02月01日 14:26:26.116 WARN 13484 --- [ main] .s.s.UserDetailsServiceAutoConfiguration : 
Using generated security password: 7d80f88b-b4ed-4bd2-9762-0aa4021e0497
This generated password is for development use only. Your security configuration must be updated before running your application in production.
2023年02月01日 14:26:26.254 WARN 13484 --- [ main] o.s.s.c.a.web.builders.WebSecurity : You are asking Spring Security to ignore Ant [pattern='/nameofapp/webservices/**']. This is not recommended -- please use permitAll via HttpSecurity#authorizeHttpRequests instead.
2023年02月01日 14:26:26.255 INFO 13484 --- [ main] o.s.s.web.DefaultSecurityFilterChain : Will secure Ant [pattern='/nameofapp/webservices/**'] with []
2023年02月01日 14:26:26.281 INFO 13484 --- [ main] o.s.s.web.DefaultSecurityFilterChain : Will not secure any request
2023年02月01日 14:26:26.404 INFO 13484 --- [ main] o.s.b.a.e.web.EndpointLinksResolver : Exposing 1 endpoint(s) beneath base path '/actuator'
2023年02月01日 14:26:26.800 INFO 13484 --- [ main] o.s.b.w.embedded.tomcat.TomcatWebServer : Tomcat started on port(s): 8080 (http) with context path ''
2023年02月01日 14:26:26.817 INFO 13484 --- [ main] com.example.demo.Spring61Application : Started Spring61Application in 2.75 seconds (JVM running for 4.234)

• Siddhant: Do you have @EnableOAuth2Sso added as an dependency injector over class SecurityConfig in your SecurityConfig.java class ?
• Siddhant: When I remove it , my application starts to build
• John Williams: I do have EnableOAuth2Sso in SecurityConfig. Can you post your full pom. Perhaps there is a clash?
• Siddhant: I uploaded my entire POM , Can you check once if it matches yours . Thanks in advance
• John Williams: I have used your pom, but with h2db iso mariadb. Still starts ok. Answer updated. I think that I need the source of CustomCookieCsrfTokenRepository