title: Spring Oauth2 implicit flow
body: <p>Working on implementing Oauth2 with Spring. I want to implement the implicit workflow:</p>
  
  <p>My configuration file:</p>
  
  <pre><code>@Configuration
  @EnableAutoConfiguration
  @RestController
  public class App {
  
      @Autowired
      private DataSource dataSource;
  
      public static void main(String[] args) {
          SpringApplication.run(App.class, args);
      }
  
      @RequestMapping("/")
      public String home() {
          return "Hello World";
      }
  
      @Configuration
      @EnableResourceServer
      protected static class ResourceServer extends ResourceServerConfigurerAdapter {
  
          @Autowired
          private TokenStore tokenStore;
  
          @Override
          public void configure(ResourceServerSecurityConfigurer resources)
                  throws Exception {
              resources.tokenStore(tokenStore);
          }
  
          @Override
          public void configure(HttpSecurity http) throws Exception {
              // @formatter:off
          http.authorizeRequests().antMatchers("/oauth/token").authenticated()
                  .and()
                  .authorizeRequests().anyRequest().permitAll()
                  .and()
                  .formLogin().loginPage("/login").permitAll()
                  .and()
                  .csrf().disable();
          }
  
      }
  
      @Configuration
      @EnableAuthorizationServer
      protected static class OAuth2Config extends AuthorizationServerConfigurerAdapter {
  
          @Autowired
          private AuthenticationManager auth;
  
          private BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
  
          @Bean
          public JdbcTokenStore tokenStore() {
              return new JdbcTokenStore(DBConnector.dataSource);
          }
  
          @Bean
          protected AuthorizationCodeServices authorizationCodeServices() {
              return new JdbcAuthorizationCodeServices(DBConnector.dataSource);
          }
  
          @Override
          public void configure(AuthorizationServerSecurityConfigurer security)
                  throws Exception {
              security.passwordEncoder(passwordEncoder);
          }
  
          @Override
          public void configure(AuthorizationServerEndpointsConfigurer endpoints)
                  throws Exception {
              endpoints.authorizationCodeServices(authorizationCodeServices())
                      .authenticationManager(auth).tokenStore(tokenStore())
                      .approvalStoreDisabled();            
          }
  
          @Override
          public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
              // @formatter:off
              clients.jdbc(DBConnector.dataSource)
                      .passwordEncoder(passwordEncoder)
                      .withClient("my-trusted-client")
                      .secret("test")
                      .authorizedGrantTypes("password", "authorization_code",
                              "refresh_token", "implicit")
                      .authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT")
                      .scopes("read", "write", "trust")
                      .resourceIds("oauth2-resource")
                      .accessTokenValiditySeconds(0);
  
              // @formatter:on
          }
  
      }
  
      @Autowired
      public void init(AuthenticationManagerBuilder auth) throws Exception {
          // @formatter:off 
          auth.jdbcAuthentication().dataSource(DBConnector.dataSource).withUser("dave")
                  .password("secret").roles("USER");
  
          // @formatter:on
      }
  
  }
  </code></pre>
  
  <p>This is working so far. A user is also generated in the database.</p>
  
  <p>Problem is following. When i try to do following request:</p>
  
  <p><a href="http://localhost:8080/oauth/token?grant_type=authorization_code&amp;client_id=my-trusted-client&amp;username=dave&amp;password=secret" rel="nofollow">http://localhost:8080/oauth/token?grant_type=authorization_code&amp;client_id=my-trusted-client&amp;username=dave&amp;password=secret</a></p>
  
  <p>I always get a popup window (authentication) asking me to enter a username and a password. But it doesn't matter what i enter there i never pass through. So what is wrong there? </p>
  
  <p>I would like to have it, that when i call this url, that i get back my access_token.</p>