Using Spring Security with zero-legged Oauth 1

I am writing an LTI application using Spring boot. LTI applications are basically a plug-in for a learning management system (in this case Canvas) which work by sending an Oauth1 signed POST to my server. The result of this request is displayed to the user inside of an iframe. There is a pre-shared key and secret that the LMS uses to sign the request. If the signature on the POST checks out, I have an authenticated user. I have this part working, partially based on this question.

During the initial request (which comes to the URL "/launch") I can call SecurityContextHolder.getContext().getAuthentication() and use this without problems. My problem is when the user makes another request, say for a picture or by clicking on a link in my content, the SecurityContext object isn't following them. I'm pretty sure I'm not setting up the Spring security filter chain correctly so the SecurityContextPersistenceFilter isn't being hit on subsequent requests. At the end of the day, SecurityContextHolder.getContext().getAuthentication() returns null.

The OAuth signature verification happens in a WebSecurityConfigurerAdapter like so: (again, based on this)

@Configuration
public static class OAuthSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
    //spring auto-wiring to set up the 
    //zeroLeggedOauthProviderProcessingFilter (see linked question)
    protected void configure(HttpSecurity http) throws Exception {
        http.antMatcher("/launch")
            .addFilterBefore(zeroLeggedOAuthProviderProcessingFilter, UsernamePasswordAuthenticationFilter.class)
            .authorizeRequests().anyRequest().hasRole("OAUTH")
            .and().csrf().disable();     
    }
}

So this works and creates an authenticated principal and everything. But due to that antMatcher, it only applies to the /launch path.

It seems like it should be simple to add another security configurer adapter that will ensure that all other paths in the application are protected by an authenticated session and in so doing would cause the SecurityContext associated with this user to become available but I have been unable to come up with the magic sauce. The documentation focuses more on standard login form based authentication setups. I'm also kind of new to Spring in general so I'm clearly missing something. I tried this but it causes all other requests to return a 403:

@Configuration
public static class SessionSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().anyRequest().hasRole("OAUTH")
            .and().csrf().disable();
    }
}