title: OAuth2 Client Authentication Spring
body: <p>I'm trying to implement an Oauth2.0 Authorization server in <code>Spring</code>.</p>
  
  <p>I've been able to retrieve an authorization_code for a user via:<br>
  <code>/oauth/authorize</code></p>
  
  <p>but when I take that code and try to redeem an oauth token for it at:<br>
  <code>/oauth/token</code><br>
  I get an <strong>Error 401: "Bad credentials"</strong></p>
  
  <p>The url that I use to retrieve the authorization_code is:  </p>
  
  <pre><code>http://localhost:8084/Oauth/oauth/authorize?response_type=code&amp;client_id=tonr&amp;redirect_uri=www
  </code></pre>
  
  <p>and the curl command I use to attempt to grab the token is:  </p>
  
  <pre><code>curl --user tonr:secret --data "grant_type=authorization_code&amp;code=1pzAm1&amp;redirect_uri=www" http://localhost:8084/Oauth/oauth/token
  </code></pre>
  
  <p>I'm not sure if I have something misconfigured, or if I'm just misunderstanding how Oauth2 is supposed to work. any ideas?  </p>
  
  <p>here is my <strong>security.xml:</strong></p>
  
  <pre><code>&lt;beans:beans xmlns="http://www.springframework.org/schema/security"
               xmlns:beans="http://www.springframework.org/schema/beans"
               xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
               xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
               xmlns:mvc="http://www.springframework.org/schema/mvc"
               xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                          http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.3.xsd
                      http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2-1.0.xsd
                          http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd"&gt;
  
      &lt;http auto-config='true'&gt;
          &lt;intercept-url pattern="/**" access="ROLE_USER" /&gt;
      &lt;/http&gt;
  
      &lt;authentication-manager&gt;
          &lt;authentication-provider&gt;
              &lt;user-service&gt;
                  &lt;user name="jimi" password="jimispassword" authorities="ROLE_USER, ROLE_ADMIN" /&gt;
                  &lt;user name="bob" password="bobspassword" authorities="ROLE_USER" /&gt;
              &lt;/user-service&gt;
          &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  
      &lt;oauth:client-details-service id="clientDetails"&gt;
          &lt;oauth:client client-id="tonr" resource-ids="sparklr" authorized-grant-types="authorization_code,implicit"
                        authorities="ROLE_CLIENT" scope="read,write" secret="secret" /&gt;
      &lt;/oauth:client-details-service&gt;
  
      &lt;beans:bean id="tokenStore" class="org.springframework.security.oauth2.provider.token.InMemoryTokenStore" /&gt;
  
      &lt;beans:bean id="tokenServices" class="org.springframework.security.oauth2.provider.token.DefaultTokenServices"&gt;
          &lt;beans:property name="tokenStore" ref="tokenStore" /&gt;
          &lt;beans:property name="supportRefreshToken" value="true" /&gt;
          &lt;beans:property name="clientDetailsService" ref="clientDetails" /&gt;
      &lt;/beans:bean&gt;
  
      &lt;beans:bean id="userApprovalHandler" class="org.springframework.security.oauth2.provider.approval.TokenServicesUserApprovalHandler"&gt;
          &lt;beans:property name="tokenServices" ref="tokenServices"/&gt;
      &lt;/beans:bean&gt;
  
      &lt;oauth:authorization-server client-details-service-ref="clientDetails" token-services-ref="tokenServices"
                                  user-approval-handler-ref="userApprovalHandler"&gt;
          &lt;oauth:authorization-code /&gt;
          &lt;oauth:implicit /&gt;
          &lt;oauth:refresh-token /&gt;
          &lt;oauth:client-credentials /&gt;
          &lt;oauth:password /&gt;
      &lt;/oauth:authorization-server&gt;
  
      &lt;mvc:annotation-driven /&gt;
  &lt;/beans:beans&gt;
  </code></pre>
  
  <p>and here is my <strong>web.xml</strong>:</p>
  
  <pre><code>&lt;web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"&gt;
      &lt;display-name&gt;Oauth&lt;/display-name&gt;
      &lt;session-config&gt;
          &lt;session-timeout&gt;
              30
          &lt;/session-timeout&gt;
      &lt;/session-config&gt;
      &lt;welcome-file-list&gt;
          &lt;welcome-file&gt;index.jsp&lt;/welcome-file&gt;
      &lt;/welcome-file-list&gt;
  
      &lt;servlet&gt;
          &lt;servlet-name&gt;spring&lt;/servlet-name&gt;
          &lt;servlet-class&gt;
              org.springframework.web.servlet.DispatcherServlet
          &lt;/servlet-class&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;spring&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
  
      &lt;!-- this mapping is added so that view requests are not defaulted to the app-servlet declared above /\ --&gt;
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;jsp&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/WEB-INF/views/*&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
  
      &lt;!-- security stuff--&gt;
      &lt;filter&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
      &lt;/filter&gt;
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  
      &lt;context-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;/WEB-INF/security.xml&lt;/param-value&gt;
      &lt;/context-param&gt;
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
      &lt;/listener&gt;
  
  &lt;/web-app&gt;
  </code></pre>
  
  <p>Any help is greatly appreciated!</p>