Spring security's @EnableWebSecurity vs oauth's @EnableResourceServer

I have a system using Spring Boot, Angular 2, Spring OAuth 2 where I have implemented security using @EnableWebSecurity and implemented oauth using @EnableResourceServer and @EnableAuthorizationServer in the same application.

Following are the implemented classes:

SecurityConfig.java

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {


    @Autowired
    private ClientDetailsService clientDetailsService;

    @Autowired
    public void globalUserDetails(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
                .withUser("user").password("pass").roles("USER").and()
                .withUser("username").password("password").roles("USER");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .csrf().disable()
                .authorizeRequests()
                .antMatchers("/private/**").hasRole("USER")
                .antMatchers("/public/**").permitAll();
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }
}

AuthorizationServerConfig.java

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {

    @Autowired
    @Qualifier("authenticationManagerBean")
    private AuthenticationManager authenticationManager;

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {

        clients.inMemory()
                .withClient("my-trusted-client")
                .authorizedGrantTypes("password", "authorization_code", "refresh_token", "implicit")
                .authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT","USER")
                .scopes("read", "write", "trust")
                .secret("secret")
                .accessTokenValiditySeconds(1200).
                refreshTokenValiditySeconds(6000);
    }

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints.authenticationManager(authenticationManager);
    }

    @Override
    public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
        oauthServer.checkTokenAccess("hasAuthority('USER')");
    }

}

ResourceServerConfig.java

@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter{

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/public/**").permitAll();
        http.authorizeRequests().antMatchers("/private/**").hasRole("USER");
    }
}

All the url following the /public are accessible by any users; it's correct. The urls following /private/ are secured by both ResourceServerConfig and SecurityConfig, therefore it's not accessible to anonymous users.

When I request access_token from authorization server using grant_type=password, I get the access_token which I use to access the secured resources by appending the access_token as the parameter. But still the resources are not available and I get the response as below:

localhost:8080/private/user/test/?access_token=92f9d86f-83c4-4896-a203-e21976d4cfa2    

{
    "timestamp": 1495961323209,
    "status": 403,
   "error": "Forbidden",
   "message": "Access Denied",
   "path": "/private/user/test/"
}

But when I remove the antMatchers from SecurityConfig.configure(HttpSecurity), the resources are no longer secured even if the ResourceServerConfig.configure(HttpSecurity) is securing the patters.

My questions:

• Is there anything I need to perform in ResourceServerConfig so as to grant access to authorized users from the resource server?
• What is difference between @EnableResourceServer and @EnableWebSecurity? Do I need to implement both in this application? (I couldn't find any good answers for this questions)