title: Customizing authentication exceptions spring oauth
body: <p>I'm using <strong>jersey</strong> as a RESTFul webserver. (jersey-server 1.8) with spring (3.2.0.RELEASE) and hibernate.
  My endpoints are protected using spring-security (3.1.3.RELEASE) with 2 legged oAuth 1.0a (spring-security-oauth 1.0.0.M4 )</p>
  
  <p>Everything works as expected and the securing works.
  Inside my ConsumerDetailsServiceImpl (implements ConsumerDetailsService, UserDetailsService, AuthenticationProvider) i throw different exceptions (all are of form OAuthException now, but i want to add my own custom exceptions)</p>
  
  <p>However no matter what i tried i cannot get to customize the different authentication and access denied exceptions the way i want, i always get the default 401 page</p>
  
  <p>My API is agreed to always return a json responseobject so i need to catch these exceptions and show 401 pages with json inside it</p>
  
  <p>My securty.xml</p>
  
  <pre><code>&lt;beans xmlns="http://www.springframework.org/schema/beans" xmlns:security="http://www.springframework.org/schema/security" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oauth="http://www.springframework.org/schema/security/oauth"
  xsi:schemaLocation="http://www.springframework.org/schema/beans
          http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
          http://www.springframework.org/schema/security
          http://www.springframework.org/schema/security/spring-security-3.1.xsd
          http://www.springframework.org/schema/security/oauth 
          http://www.springframework.org/schema/security/spring-security-oauth.xsd"&gt;
  
  
  &lt;!-- Authentication beans --&gt;
  &lt;bean name="consumerDetailsService" class="com.securitytest.core.services.impl.ConsumerDetailsServiceImpl" /&gt;
  &lt;bean name="oauthProcessingFilterEntryPoint" class="org.springframework.security.oauth.provider.OAuthProcessingFilterEntryPoint" /&gt;
  &lt;bean id="oAuthAuthenticationHandler" class="com.securitytest.core.security.CustomOAuthAuthenticationHandler" /&gt;
  
  &lt;security:http auto-config="true" use-expressions="true" entry-point-ref="oauthProcessingFilterEntryPoint" &gt;
      &lt;security:intercept-url pattern="/rest/secured/**" access="isAuthenticated()" /&gt;
      &lt;security:intercept-url pattern="/rest/unsecured/**" access="permitAll" /&gt;
      &lt;security:intercept-url pattern="/rest/**" access="isAuthenticated()" /&gt;
      &lt;security:form-login login-page='/login' default-target-url="/home"  authentication-failure-handler-ref="authenticationFailureHandler"/&gt;
      &lt;security:access-denied-handler ref="accessDeniedHandler" /&gt;
  &lt;/security:http&gt;
  
  &lt;bean id="accessDeniedHandler" class="com.securitytest.core.security.CustomoauthAccessDeniedHandler" /&gt;
    &lt;!-- this was just a test, it didn't work obviously --&gt;  
  &lt;bean id="authenticationFailureHandler"              class="org.springframework.security.web.authentication.ExceptionMappingAuthenticationFailureHandler"&gt;
      &lt;property name="exceptionMappings"&gt;
          &lt;props&gt;
              &lt;prop key="org.springframework.security.authentication.BadCredentialsException"&gt;/login/badCredentials&lt;/prop&gt;
              &lt;prop key="org.springframework.security.authentication.CredentialsExpiredException"&gt;/login/credentialsExpired&lt;/prop&gt;
              &lt;prop key="org.springframework.security.authentication.LockedException"&gt;/login/accountLocked&lt;/prop&gt;
              &lt;prop key="org.springframework.security.authentication.DisabledException"&gt;/login/accountDisabled&lt;/prop&gt;
          &lt;/props&gt;
      &lt;/property&gt;
  &lt;/bean&gt;
  
  &lt;security:authentication-manager alias="authenticationManager"&gt;
      &lt;security:authentication-provider ref="consumerDetailsService" /&gt;
  &lt;/security:authentication-manager&gt;
  
  &lt;bean id="nonceServices" class="org.springframework.security.oauth.provider.nonce.InMemoryNonceServices" /&gt;
  
  &lt;oauth:provider 
          auth-handler-ref="oAuthAuthenticationHandler" 
          consumer-details-service-ref="consumerDetailsService" 
          nonce-services-ref="nonceServices" 
          token-services-ref="tokenServices"
          require10a="true"
  
          /&gt;
  &lt;oauth:token-services id="tokenServices" /&gt;
  </code></pre>
  
  <p></p>
  
  <h2>Stuff i tried</h2>
  
  <ol>
  <li>Change the exceptionTranslationFilter -> is not allowed by the docs</li>
  <li><p>Add a custom access-denied-handler and a authentication-failure-handler-ref</p>
  
  <pre><code>&lt;security:http auto-config="true" use-expressions="true" entry-point-ref="oauthProcessingFilterEntryPoint" &gt;
     &lt;security:intercept-url pattern="/rest/secured/**" access="isAuthenticated()" /&gt;
     &lt;security:intercept-url pattern="/rest/unsecured/**" access="permitAll" /&gt;
     &lt;security:intercept-url pattern="/rest/**" access="isAuthenticated()" /&gt;
     &lt;security:form-login login-page='/login' default-target-url="/home"  authentication-failure-handler-ref="authenticationFailureHandler"/&gt;
  
     &lt;security:access-denied-handler ref="accessDeniedHandler" /&gt;
  &lt;/security:http&gt;
  </code></pre>
  
  <p>-> this gets blatantly ignored by spring-security/oauth</p></li>
  <li><p>Add a custom filter after the EXCEPTION_TRANSLATION_FILTER</p>
  
  <pre><code>&lt;security:custom-filter after="EXCEPTION_TRANSLATION_FILTER" ref="myFilter" /&gt;
  </code></pre>
  
  <p>MyFilter just implements "javax.servlet.Filter". 
  -> It goes into the doFilter but i have no idea what do with it (i can't see which exception is thrown, if any).</p></li>
  </ol>
  
  <p>Any help is appreciated!!</p>