Spring Authorization Server will use InMemoryOAuth2*Service
by default which is done by org.springframework.security.oauth2.server.authorization.config.annotation.web.configurers.OAuth2ConfigurerUtils
, and the document says:
instances in-memory and is recommended ONLY for development and testing.
Due to the states in-memory are not surviving after restarting and not shared across multiple instances for load balancing.
Spring Boot should auto-configure JdbcOAuth2AuthorizationService
and JdbcOAuth2AuthorizationConsentService
for production use, and introduce configuration properties for database schema initialization. Not sure JdbcRegisteredClientRepository
should be included also.