Question: The error format of spring security oauth conforms with the OAuth spec and looks like this.

```
{
  "error":"insufficient_scope",
  "error_description":"Insufficient scope for this resource",
  "scope":"do.something"
}

```

Especially on a resource server I find it a bit strange to get a different error format for authentication issues. So I would like to change the way this exception is rendered.

The [documentation](http://projects.spring.io/spring-security-oauth/docs/oauth2.html) says

> 
> Error handling in an Authorization Server uses standard Spring MVC
>  features, namely @ExceptionHandler methods
> 
> 
> 

So I tried something like this to customize the format of the error:

```
@ControllerAdvice
@Order(Ordered.HIGHEST_PRECEDENCE)
public class MyErrorHandler {

    @ExceptionHandler(value = {InsufficientScopeException.class})
    ResponseEntity<MyErrorRepresentation> handle(RuntimeException ex, HttpServletRequest request) {
        return errorResponse(HttpStatus.FORBIDDEN,
                MyErrorRepresentation.builder()
                        .errorId("insufficient.scope")
                        .build(),
                request);
    }
}

```

But this does not work. 

Looking at the code, all the error rendering seems to be done in `DefaultWebResponseExceptionTranslator#handleOAuth2Exception`. But implementing a custom `WebResponseExceptionTranslator` would not allow changing the format.

Any hints?

Answer: 
Spring Boot version: 2.2.5

You really don't have to write that much code. All you need to do create a custom `AuthenticationEntryPoint` by extending [**OAuth2AuthenticationEntryPoint**](https://docs.spring.io/spring-security/oauth/apidocs/org/springframework/security/oauth2/provider/error/OAuth2AuthenticationEntryPoint.html), override **enhanceResponse** method of it and register it via Resource Server configuration.

First part:

```
@Configuration
@EnableResourceServer
public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {

    @Override
    public void configure(ResourceServerSecurityConfigurer config) {
        config.authenticationEntryPoint(new CustomOauth2AuthenticationEntryPoint());
    }
}

```

Second part:

```
public class CustomOauth2AuthenticationEntryPoint extends OAuth2AuthenticationEntryPoint {

    @Override
    protected ResponseEntity<String> enhanceResponse(ResponseEntity<?> response, Exception exception) {
        return ResponseEntity.status(response.getStatusCode()).body("My custom response body.");
    }
}

```

Keep in mind that according to [spec](https://www.rfc-editor.org/rfc/rfc7235#section-3.1) 401 response **must** send `WWW-Authenticate` header. The **enhanceResponse** that we override sends that header. Take a look at the [implementation](https://github.com/spring-projects/spring-security-oauth/blob/master/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/error/OAuth2AuthenticationEntryPoint.java) and send that header if you return 401.
You have to setAuthenticationEntryPoint in TokenEndpointAuthenticationFilter Bean if you config by AuthorizationServer

```
    @Bean
public TokenEndpointAuthenticationFilter tokenEndpointAuthenticationFilter() {
    CustomOauth2AuthenticationEntryPoint entryPoint = new CustomOauth2AuthenticationEntryPoint();
    TokenEndpointAuthenticationFilter filter = new TokenEndpointAuthenticationFilter(authenticationManager, requestFactory());
    filter.setAuthenticationEntryPoint(entryPoint);
    return filter;
}

```