title: Spring Security Oauth2: Flow to Handling Expired AccessToken
body: <p>I am just a beginner in Spring Security Oauth2.
  I try to make Authorization Server and Resource Server (separated and connect to JDBC) and the purpose is to make Single Sign-On.
  My flow success to get accesstoken and refreshtoken from Authorization Server. My accesstoken always used as parameter to access Resouce Server, and this is give a response back.</p>
  
  <pre><code>for example http://127.0.0.1:8080/Resource/res/staff?access_token=xxxxxxxxxxxxxxxxxxxxx
  </code></pre>
  
  <p>My problem, if the accesstoken expired, the spring security will prevent to access the page and give the error exception. When I must use the refreshtoken to get new token? 
  Or is my flow wrong? Is there other flow to renew accesstoken?</p>
  
  <p>Thanks</p>
  
  <p><strong>Edited:</strong></p>
  
  <p>FYI: 
  I want to make SSO using Spring Security Oauth2. I have several Apps Server (use Spring Framework) and I want to make one server that responsible to manage the login. And I want to make the Apps Server become Resource Server (also the Client)
  So I make one Authorization Server with Spring Security Oauth2. The user who wants to access the protected Resource Server must login to Authorization Server (the Resource Server authorize to Authorization Server). It will get a code and then the Resource Server will exchange this code with accessToken and refreshToken. This flow is success.</p>
  
  <p>I can also request the new accessToken using the refreshToken that given by Authorization Server.
  But I cannot call this procedure because if I access the url mapping, previously the spring security was blocking the access and give the invalid token error return.</p>
  
  <p>How can I solve the missing link?</p>
  
  <p><strong>Updated:</strong></p>
  
  <p>This is my Authorization Server Configuration:</p>
  
  <pre><code>@Configuration
  public class Oauth2AuthorizationServer {
  
   @Configuration
   @EnableAuthorizationServer
   protected static class AuthorizationServerConfiguration extends
          AuthorizationServerConfigurerAdapter {
  
      @Autowired
      @Qualifier("authenticationManagerBean")
      private AuthenticationManager authenticationManager;
  
      @Autowired
      DataSource dataSource;
  
  
      @Override
      public void configure(AuthorizationServerEndpointsConfigurer endpoints)
              throws Exception {
          endpoints
                  .tokenStore(new JdbcTokenStore(dataSource))
                  .authenticationManager(authenticationManager);
      }
  
      @Override
      public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
          oauthServer.tokenKeyAccess("isAnonymous() || permitAll()").checkTokenAccess("permitAll()");
      }
  
      @Override
      public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
          clients
                  .jdbc(dataSource);
      }
   }
  }
  </code></pre>
  
  <p>And this is my Resource Server Configuration (as Client too)</p>
  
  <pre><code>@Configuration
  public class Oauth2ResourceServer {
  
  private static final String RESOURCE_ID = "test";
  
   @Configuration @Order(10)
   protected static class NonOauthResources extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests()
                  .antMatchers("/api/halo").permitAll()
                  .antMatchers("/api/state/**").permitAll()
                  .antMatchers("/**").permitAll()
                  .and().anonymous();
      }
   }
  
   @Configuration
   @EnableResourceServer
   protected static class ResourceServerConfiguration extends
          ResourceServerConfigurerAdapter {
  
      @Override
      public void configure(ResourceServerSecurityConfigurer resources) {
          RemoteTokenServices tokenService = new RemoteTokenServices();
          tokenService.setClientId("jsclient");
          tokenService.setClientSecret("jspasswd");
          tokenService.setCheckTokenEndpointUrl("http://localhost:8084/Server2Auth/oauth/check_token");
  
          resources
                  .resourceId(RESOURCE_ID)
                  .tokenServices(tokenService);
      }
  
      @Override
      public void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests()
                  .filterSecurityInterceptorOncePerRequest(true)
                  .antMatchers("/res/staff").hasRole("STAFF")
                  .antMatchers("/res/client").access("#oauth2.hasScope('trust')")
                  .antMatchers("/res/admin").hasRole("ADMIN")
                  .and()
                  .exceptionHandling().accessDeniedPage("/403");
      }
  
   }
  
  }
  </code></pre>
  
  <p>Resource (as Client too) request to authorize:</p>
  
  <pre><code>curl -X POST -vu clientauthcode:123456 http://localhost:10000/auth-server/oauth/token -d "client_id=clientauthcode&amp;grant_type=refresh_token&amp;refresh_token=436761f1-2f26-412b-ab0f-bbf2cd7459c4"
  </code></pre>
  
  <p>Feedback from Authorize Server:</p>
  
  <pre><code>http://localhost:10001/resource-server/api/state/new?code=8OppiR
  </code></pre>
  
  <p>Resource (as Client) exchange the code to Authorize Server:</p>
  
  <pre><code>curl -X POST -vu clientauthcode:123456 http://localhost:10000/auth-server/oauth/token -H "Accept: application/json" -d "grant_type=authorization_code&amp;code=iMAtdP&amp;redirect_uri=http://localhost:10001/resource-server/api/state/new"
  </code></pre>
  
  <p>Feedback from Authorize Server:</p>
  
  <pre><code>{
      "access_token":"08664d93-41e3-473c-b5d2-f2b30afe7053",
      "token_type":"bearer",
      "refresh_token":"436761f1-2f26-412b-ab0f-bbf2cd7459c4",
      "expires_in":43199,
      "scope":"write read"
  }
  </code></pre>
  
  <p>Resource (as Client) access the url itself</p>
  
  <pre><code>curl http://localhost:10001/resource-server/api/admin?access_token=08664d93-41e3-473c-b5d2-f2b30afe7053
  </code></pre>
  
  <p>Request new access toke using refresh token</p>
  
  <pre><code>curl -X POST -vu clientauthcode:123456 http://localhost:10000/auth-server/oauth/token -d "client_id=clientauthcode&amp;grant_type=refresh_token&amp;refresh_token=436761f1-2f26-412b-ab0f-bbf2cd7459c4"
  </code></pre>