A PASOE instance fails to start in OpenEdge 12.2.15 or later when <anonymous enabled='true' /> is set in <PASOE Instance>\webapps\<webapp>\WEB-INF\spring\enableOAuth2ResourceServer.xml .

The following exception is returned in the localhost.<date>.log file:

ERROR [Catalina-utility-1] o.a.catalina.core.StandardContext.filterStart - Exception starting filter [springSecurityFilterChain]
org.springframework.beans.factory.parsing.BeanDefinitionParsingException: Configuration problem: Failed to import bean definitions from relative location [spring/oauth2LoginModel.xml]
Offending resource: ServletContext resource [/WEB-INF/oeablSecurity.xml]; nested exception is org.springframework.beans.factory.parsing.BeanDefinitionParsingException: Configuration problem: Failed to import bean definitions from relative location [enableOAuth2ResourceServer.xml]
Offending resource: ServletContext resource [/WEB-INF/spring/oauth2LoginModel.xml]; nested exception is org.springframework.beans.factory.parsing.BeanDefinitionParsingException: Configuration problem: Filter beans '<OEAnonymousFilter>' and 'Root bean: class [org.springframework.security.web.authentication.AnonymousAuthenticationFilter]; scope=; abstract=false; lazyInit=null; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null' have the same 'order' value. When using custom filters, please make sure the positions do not conflict with default filters. Alternatively you can disable the default filters by removing the corresponding child elements from <http> and avoiding the use of <http auto-config='true'>.

The same configuration worked fine in OpenEdge 12.2.14 or earlier.

Changing <anonymous enabled='true' /> into <anonymous enabled='false' /> for the relevant http patterns in the <PASOE Instance>\webapps\<webapp>\WEB-INF\spring\enableOAuth2ResourceServer.xml file causes HTTP status 401 to be returned when a request is sent from an HTTP client.

The PASOE instance contains web applications that have been configured with OAuth2 authentication.

The Spring Security Framework XML configuration files have been updated as detailed in the following documentation:
https://docs.progress.com/bundle/pas-for-openedge-management-122/page/OpenEdge-12.2.15-Spring-security-changes.html

The exact cause is not known at this time.

Until the fix is available, use the workaround below.

To enable / disable anonymous access for individual http patterns, follow these steps:

• Edit the <PASOE Instance>\webapps\<webapp>\WEB-INF\spring\enableOAuth2ResourceServer.xml configuration file:
  • Change all <anonymous enabled='true' /> tags to <anonymous enabled='false' />
  • Create a new section for the relevant http patterns. If needed, duplicate the <http pattern="/web/**" ... </http> section and change the values for the patten and name attributes. These values should be unique within the XML file. For example:

<http pattern="/static/images/**"
       name="Images"
       auto-config="true" 
       use-expressions="true"
       entry-point-ref="oauth2AuthenticationEntryPoint" 
       access-decision-manager-ref="oauth2AccessDecisionManager" >

• • Within the http patterns that need to allow anonymous access, replace:

<!-- OpenEdge Anonymous Filter -->
<!-- custom-filter position="ANONYMOUS_FILTER"
                ref="OEAnonymousFilter" / -->

• • With:

<!-- OpenEdge Anonymous Filter -->
<custom-filter position="ANONYMOUS_FILTER"
                ref="OEAnonymousFilter" />

• Make sure that the relevant http patterns are included in the <PASOE Instance>\webapps\<webapp>\WEB-INF\oeablSecurityJWT.csv file with the right access. For example: "/static/images/*","GET","permitAll()" 
• Restart the PASOE instance for the changes to take effect.

Progress Article(s):
PASOE fails to start after enabling anonymous access in the enableSamlSecurity.xml file