demo-auth After adding security.oauth2.resource.filter-order=3,all my protected resource configurated in SecurityConfiguration are accessible The problem is solved