Multiple Resource server configuration in Spring security OAuth -

i trying use single auth server access multiple resource servers multiple clients.

i trying access 2 resource servers same auth server , configuration of resource servers goes below.

@bean @scope("prototype")  protected resourceserverconfiguration resource1() {      resourceserverconfiguration resource = new resourceserverconfiguration();     resource.setconfigurers(arrays.<resourceserverconfigurer> aslist(new resourceserverconfigureradapter() {     @override     public void configure(resourceserversecurityconfigurer resources) throws exception {         resources.resourceid(resource_id1).tokenstore(tokenstore);     }      @override     public void configure(httpsecurity http) throws exception {         http         .csrf().disable()         .requestmatchers().antmatchers("/greeting")         .and()         .authorizerequests()         .antmatchers("/users").hasrole("admin");                     } }    resource.setorder(4);     return resource; }  @bean @scope("prototype")  protected resourceserverconfiguration resource2() {     resourceserverconfiguration resource = new resourceserverconfiguration();     resource.setconfigurers(arrays.<resourceserverconfigurer> aslist(new resourceserverconfigureradapter() {         @override         public void configure(resourceserversecurityconfigurer resources) throws exception {             resources.resourceid(resource_id2).tokenstore(tokenstore);         }          @override         public void configure(httpsecurity http) throws exception {             http             .csrf().disable()             .requestmatchers().antmatchers("/welcome")             .and()             .authorizerequests()             .antmatchers("/users").hasrole("admin");         }     }        resource.setorder(5);     return resource; } 

since default order of websecurityconfigureradapter 3,i have configured order of resource servers 4 , 5 respectively.

but configured beans getting overridden , can access resource "/welcome" has order 5 , if try access resource "/greeting",i getting following error,

{  "timestamp": 1444400211270,  "status": 403,  "error": "forbidden",  "message": "expected csrf token not found. has session expired?",  "path": "/greeting"} 

if interchange order between resources,i can access resource has highest value 5.

note:i have 2 clients 1 can access resource1 , can access resource2.

please advice things missing.

from javadoc of resourceserverconfigurer:

applications may provide multiple instances of interface, , in general (like other security configurers), if more 1 configures same property, last 1 wins. configurers sorted {@link order} before being applied.

so maybe put permitall() on /welcome path in both configuration.