Após atualizar o spring para 3.0 e o java para 17, passei a receber acesso negado em todos momentos com API KEY passando os values no cabeçalho

Question

Esse é meu filtro. Uso gradlew, openApi para gerenciar a geração de classe, e como segurança API KEY, passando as credenciais no cabeçalho da request.

`@Configuration @EnableWebSecurity public class SoarSecurityConfiguration {

private static final Logger logger = LoggerFactory.getLogger(SoarSecurityConfiguration.class);

private final AuthenticationEntryPointException authenticationEntryPointException;

private final SoarApiKeyAuthenticationProvider apiKeyAuthenticationProvider;

@Autowired
public SoarSecurityConfiguration(final AuthenticationEntryPointException authenticationEntryPointException,
                                 final SoarApiKeyAuthenticationProvider apiKeyAuthenticationProvider) {
    this.authenticationEntryPointException = authenticationEntryPointException;
    this.apiKeyAuthenticationProvider = apiKeyAuthenticationProvider;
}

@Bean
public SecurityFilterChain soarSecurityFilterChain(HttpSecurity httpSecurity) throws Exception {
    httpSecurity
            .formLogin(AbstractHttpConfigurer::disable)
            .cors(AbstractHttpConfigurer::disable)
            .csrf(AbstractHttpConfigurer::disable)
            .servletApi(httpSecurityServletApiConfigurer -> httpSecurityServletApiConfigurer.configure(httpSecurity))
            .authorizeHttpRequests(authorize -> authorize
                    .requestMatchers("/").permitAll()
                    .requestMatchers("/actuator/health").permitAll()
                    .requestMatchers("/actuator/health/liveness").permitAll()
                    .requestMatchers("/actuator/health/readiness").permitAll()
                    //.requestMatchers("/rest/**").permitAll()
                    .anyRequest().authenticated())
            .exceptionHandling(exceptionHandling -> exceptionHandling.authenticationEntryPoint(authenticationEntryPointException))
            .sessionManagement(sessionManager -> sessionManager.sessionCreationPolicy(SessionCreationPolicy.STATELESS));

    logger.info("SecurityConfiguration Configure HttpSecurity done.");
    return httpSecurity.build();
}`

Uso o API KEY como Authorization, passando no cabeçalho a chave e o valor de autenticação do método. resposta no postaman { "title": "Access denied", "detail": "Full authentication is required to access this resource", "type": "https://www.httpstatus.com.br/403/", "status": 403, "code": 2034, "instance": "/lite-soar/rest/orgs/000/incidents/incidents/23/tasks", "violations": [] }