My application is a simple resource server — I am using AadResourceServerHttpSecurityConfigurer.aadResourceServer() to validate the given access token. The specific documentation I have followed can be found here.