title: Spring-Oauth2 Access Token request never succeeds due to missing CSRF 'preserved state'
body: <p>I've been working the last couple days to get an implementation of spring boot / spring security / and java configuration working with spring-security-oauth2. I've managed to work through most of the difficulties, but am stumped as to what is going wrong now.</p>
  
  <p>I am completing the following steps successfully:</p>
  
  <ul>
  <li>sending user to the provider to authorize the application to act on their behalf</li>
  <li>user is prompted to sign in to provider per security</li>
  <li>user authorizes the app, and the redirect url sends them back to the client app at the original url along with <code>?code=asdfa&amp;state=asdfasf</code>in the query string</li>
  </ul>
  
  <p>At this point, I believe whatever is using the <code>AuthorizationCodeResourceDetails</code> should be exchanging the authorization code and client app credentials for an access token. This is where the process is failing with the following stack trace.</p>
  
  <pre><code> Caused by: org.springframework.security.oauth2.common.exceptions.InvalidRequestException: Possible CSRF detected - state parameter was present but no state could be found
      at org.springframework.security.oauth2.client.token.grant.code.AuthorizationCodeAccessTokenProvider.getParametersForTokenRequest(AuthorizationCodeAccessTokenProvider.java:246)
      at org.springframework.security.oauth2.client.token.grant.code.AuthorizationCodeAccessTokenProvider.obtainAccessToken(AuthorizationCodeAccessTokenProvider.java:198)
      at org.springframework.security.oauth2.client.token.AccessTokenProviderChain.obtainNewAccessTokenInternal(AccessTokenProviderChain.java:142)
      at org.springframework.security.oauth2.client.token.AccessTokenProviderChain.obtainAccessToken(AccessTokenProviderChain.java:118)
      at org.springframework.security.oauth2.client.OAuth2RestTemplate.acquireAccessToken(OAuth2RestTemplate.java:221)
      at org.springframework.security.oauth2.client.OAuth2RestTemplate.getAccessToken(OAuth2RestTemplate.java:173)
      at org.springframework.security.oauth2.client.OAuth2RestTemplate.createRequest(OAuth2RestTemplate.java:105)
      at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:564)
      at org.springframework.security.oauth2.client.OAuth2RestTemplate.doExecute(OAuth2RestTemplate.java:128)
      at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:529)
      at org.springframework.web.client.RestTemplate.getForEntity(RestTemplate.java:261)
      at com.pvr.apps.admin.user.UserServiceImpl.getAllUsers(UserServiceImpl.java:51)
      at com.pvr.apps.admin.web.IndexController.serveUserList(IndexController.java:35)
  </code></pre>
  
  <p>Things on the client look like (I also have an <code>@EnableOAuth2Client</code> annotation on the main config).</p>
  
  <pre><code>@Component
  public class UserServiceImpl implements UserService {
  
      @Resource
      @Qualifier("accessTokenRequest")
      private AccessTokenRequest accessTokenRequest;
  
      public OAuth2ProtectedResourceDetails createResource() {
          AuthorizationCodeResourceDetails resourceDetails = new AuthorizationCodeResourceDetails();
          resourceDetails.setScope(Lists.newArrayList("read", "write"));
          resourceDetails.setClientId("admin");
          resourceDetails.setClientSecret("password");
          resourceDetails.setAuthenticationScheme(AuthenticationScheme.query);
          resourceDetails.setAccessTokenUri("http://provider.com:8080/oauth/token");
          resourceDetails.setUserAuthorizationUri("http://provider.com:8080/oauth/authorize");
          return resourceDetails;
      }
  
      @Override
      public List&lt;User&gt; getAllUsers() {
  
          RestTemplate template = new OAuth2RestTemplate(createResource(), new DefaultOAuth2ClientContext(accessTokenRequest));
  
          ResponseEntity&lt;User[]&gt; responseEntity = template.getForEntity("http://provider.com:8080/users/", User[].class);
          return Lists.newArrayList(responseEntity.getBody());
      }
  }
  </code></pre>
  
  <p>And on the provider side of things:</p>
  
  <p>The authorization server config:</p>
  
  <pre><code>@Configuration
  @EnableAuthorizationServer
  public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter{
  
      @Autowired
      private LoginUrlAuthenticationEntryPoint authenticationEntryPoint;
  
      @Autowired
      private AuthenticationManager authenticationManager;
  
  
      @Override
      public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
          oauthServer
                  .authenticationEntryPoint(authenticationEntryPoint)
                  .tokenKeyAccess("isAnonymous() || hasAuthority('ROLE_TRUSTED_CLIENT')")
                  .checkTokenAccess("hasAuthority('ROLE_TRUSTED_CLIENT')");
      }
  
      @Override
      public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
  
          JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
  
          endpoints
                  .authenticationManager(authenticationManager)
                  .accessTokenConverter(converter)
                  .tokenStore(new JwtTokenStore(converter));
      }
  
  
      // TODO: this should read from a db
      public void configure(ClientDetailsServiceConfigurer clientConfigurer) throws Exception {
          clientConfigurer.inMemory()
                  .withClient("admin").secret("password")
                  .authorizedGrantTypes(
                          GrantType.PASSWORD.type,
                          GrantType.AUTHORIZATION_CODE.type,
                          GrantType.IMPLICIT.type,
                          GrantType.REFRESH_TOKEN.type
                  )
                  .authorities("ROLE_TRUSTED_CLIENT")
                  .scopes("read", "write", "trust")
                  .accessTokenValiditySeconds(60);
      }
  }
  </code></pre>
  
  <p>and the resource server config:</p>
  
  <pre><code>@Configuration
  @EnableWebMvcSecurity
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  public class MySecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      UserDetailsService userDetailService;
  
      @Autowired
      AuthenticationProvider authenticationProvider;
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth.authenticationProvider(authenticationProvider);
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests()
                  .antMatchers("/login").permitAll()
                  .anyRequest().authenticated()
              .and()
                  .formLogin()
                      .loginProcessingUrl("/login.do")
                      .usernameParameter("uid")
                      .passwordParameter("pwd")
                      .loginPage("/login")
                      .failureUrl("/login?error=true")
              .and()
                  .userDetailsService(userDetailService);
      }
  
  }
  </code></pre>