title: Token URL fails with spring security oauth2
body: <p>I'm trying to get a oauth2 configuration for securing my webapp and only allowing trusted clients with provided user credentials to access the app.</p>
  
  <p>This is what I have so far</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8" ?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xmlns:oauth="http://www.springframework.org/schema/security/oauth2" xmlns:sec="http://www.springframework.org/schema/security"
     xmlns:mvc="http://www.springframework.org/schema/mvc"
     xsi:schemaLocation="http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2-1.0.xsd
      http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.1.xsd
      http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd
      http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd"&gt;
  
  
      &lt;http pattern="/oauth/token" create-session="stateless" authentication-manager-ref="clientAuthenticationManager"
       xmlns="http://www.springframework.org/schema/security"&gt;
          &lt;intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" /&gt;
          &lt;anonymous enabled="false" /&gt;
          &lt;http-basic entry-point-ref="clientAuthenticationEntryPoint" /&gt;
          &lt;!-- include this only if you need to authenticate clients via request parameters --&gt;
          &lt;custom-filter ref="clientCredentialsTokenEndpointFilter" after="BASIC_AUTH_FILTER" /&gt;
         &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
      &lt;/http&gt;
  
      &lt;!-- The OAuth2 protected resources are separated out into their own block so we can deal with authorization and error handling 
  separately. This isn't mandatory, but it makes it easier to control the behaviour. --&gt;
      &lt;http request-matcher="regex" create-session="stateless" entry-point-ref="oauthAuthenticationEntryPoint"
        xmlns="http://www.springframework.org/schema/security"&gt;
          &lt;!-- &lt;anonymous enabled="false" /&gt; --&gt;
          &lt;intercept-url pattern="/api/register/.*" access="ROLE_CLIENT" /&gt;
          &lt;intercept-url pattern="/api/.*" access="ROLE_USER" /&gt;
          &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
          &lt;expression-handler ref="oauthWebExpressionHandler" /&gt;
      &lt;/http&gt;
  
      &lt;bean id="oauthAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
          &lt;property name="realmName" value="qeep" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="clientAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
          &lt;property name="realmName" value="qeep/client" /&gt;
      &lt;/bean&gt;
  
     &lt;bean id="oauthAccessDeniedHandler" class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" /&gt;    
  
     &lt;authentication-manager alias="authenticationManager" xmlns="http://www.springframework.org/schema/security"&gt;
          &lt;authentication-provider user-service-ref="qeepUserDetailsService" /&gt;
     &lt;/authentication-manager&gt;
  
     &lt;bean id="myUserDetailsService" class="com.example.core.web.rest.auth.QeepUserDetailsService"/&gt;
  
     &lt;bean id="tokenStore" class="com.example.core.web.rest.auth.QeepTokenStore" /&gt;
  
     &lt;bean id="tokenServices" class="org.springframework.security.oauth2.provider.token.DefaultTokenServices"&gt;
         &lt;property name="tokenStore" ref="tokenStore" /&gt;
         &lt;property name="supportRefreshToken" value="true" /&gt;
         &lt;property name="clientDetailsService" ref="clientDetails" /&gt;
     &lt;/bean&gt;
  
     &lt;authentication-manager id="clientAuthenticationManager" xmlns="http://www.springframework.org/schema/security"&gt;
          &lt;authentication-provider user-service-ref="clientDetailsUserService" /&gt;
     &lt;/authentication-manager&gt;
  
     &lt;bean id="clientDetailsUserService" class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService"&gt;
         &lt;constructor-arg ref="clientDetails" /&gt;
     &lt;/bean&gt;
  
     &lt;bean id="clientCredentialsTokenEndpointFilter" class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter"&gt;
         &lt;property name="authenticationManager" ref="clientAuthenticationManager" /&gt;
     &lt;/bean&gt;                
  
     &lt;oauth:client-details-service id="clientDetails"&gt;
         &lt;oauth:client client-id="my-trusted-client-with-secret" authorized-grant-types="password,authorization_code,refresh_token,implicit"
                    secret="somesecret" authorities="ROLE_CLIENT, ROLE_TRUSTED_CLIENT" /&gt;
     &lt;/oauth:client-details-service&gt;
  
     &lt;oauth:authorization-server client-details-service-ref="clientDetails" token-services-ref="tokenServices"&gt;
         &lt;oauth:authorization-code /&gt;
         &lt;oauth:implicit /&gt;
         &lt;oauth:refresh-token /&gt;
         &lt;oauth:client-credentials /&gt;
         &lt;oauth:password /&gt;
     &lt;/oauth:authorization-server&gt;
  
     &lt;sec:global-method-security pre-post-annotations="enabled" proxy-target-class="true"&gt;
         &lt;!--you could also wire in the expression handler up at the layer of the http filters. See https://jira.springsource.org/browse/SEC-1452 --&gt;
     &lt;sec:expression-handler ref="oauthExpressionHandler" /&gt;
     &lt;/sec:global-method-security&gt;
  
     &lt;oauth:expression-handler id="oauthExpressionHandler" /&gt;
  
     &lt;oauth:web-expression-handler id="oauthWebExpressionHandler" /&gt;
  &lt;/beans&gt;
  </code></pre>
  
  <p>If I access <code>/oauth/token</code> using curl, I get a client authorization request which I get through using the configured client credentials. But after this <code>/oauth/token</code> only returns <code>404 - Not found</code>. I've tried different stuff for the last hours without any success.</p>
  
  <p>I extracted the configuration from the sparklr/tonr sample of oauth2 1.0.5 which I used because we are still on spring 3.2.</p>
  
  <p>The same test works fine in the sparklr-Sample-webapp.</p>
  
  <p><strong>EDIT</strong></p>
  
  <p>The actual curl url is the following:</p>
  
  <pre><code>curl -v -H "Authorization: Basic bXktdHJ1c3RlZC1jbGllbnQtd2l0aC1zZWNyZXQ6c29tZXNlY3JldA==" "http://localhost:8084/core/oauth/token"
  </code></pre>
  
  <p>Without the Authorization-Header I get a 401 asking for the client authentication as configured ("my-trusted-client-with-secret" and "somesecret") but with the added authorization header I just get the 404 - Not found. If I test the same with the sparklr-Sample I get an error asking for the grant-type after adding the Basic-Auth-Header like above which is what I would expect.</p>
  
  <p>I hope this makes a bit clearer.</p>
  
  <p>Any ideas what's wrong with my configuration?</p>