title: Spring security oauth2 http pattern not working
body: <p>I am having an issue where url patterns do not seem to be getting filtered in the security framework.  I have tried many different url patterns, jar versions, and configurations to no avail.  The token url works, and properly generates the token.  One potential issue is I have another filter (Wicket) mapped to the / path, so I'm not sure it that is conflicting.  I am using spring core 4.0.3, security 3.2.3 and oauth 1.0 (tried 2.0 as well).  Any ideas would be appreciated.</p>
  
  <p>My configurations are below.</p>
  
  <p>web.xml:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;servlet&gt;
      &lt;servlet-name&gt;appServlet&lt;/servlet-name&gt;
      &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;/WEB-INF/spring/appServlet/servlet-context.xml&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
  &lt;/servlet&gt;
  
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;appServlet&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  
  &lt;!-- Spring Security Filter for all Requests --&gt;
  &lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  
  &lt;filter&gt;
      &lt;filter-name&gt;MyCC&lt;/filter-name&gt;
      &lt;filter-class&gt;org.apache.wicket.protocol.http.WicketFilter&lt;/filter-class&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;applicationClassName&lt;/param-name&gt;
          &lt;param-value&gt;com.wth.mycc.Wicket.Application.MyCCApplication&lt;/param-value&gt;
      &lt;/init-param&gt;
  &lt;/filter&gt;
  
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;MyCC&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;dispatcher&gt;REQUEST&lt;/dispatcher&gt;
      &lt;dispatcher&gt;ERROR&lt;/dispatcher&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>spring bean mapping xml config file:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;!-- Security Config --&gt;
  &lt;http pattern="/oauth/token" create-session="stateless"
      authentication-manager-ref="authenticationManager"
      xmlns="http://www.springframework.org/schema/security"&gt;
      &lt;intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" /&gt;
      &lt;anonymous enabled="false" /&gt;
      &lt;http-basic entry-point-ref="clientAuthenticationEntryPoint" /&gt;
      &lt;custom-filter ref="clientCredentialsTokenEndpointFilter"
          before="BASIC_AUTH_FILTER" /&gt;
      &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
  &lt;/http&gt;
  
  &lt;http pattern="/rest/**" create-session="never" 
      entry-point-ref="oauthAuthenticationEntryPoint" xmlns="http://www.springframework.org/schema/security"&gt;
      &lt;anonymous enabled="false" /&gt;
      &lt;intercept-url pattern="/getports" method="GET" /&gt;
      &lt;custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" /&gt;
      &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
  &lt;/http&gt;
  
  &lt;http pattern="/logout" create-session="never"
      entry-point-ref="oauthAuthenticationEntryPoint" xmlns="http://www.springframework.org/schema/security"&gt;
      &lt;anonymous enabled="false" /&gt;
      &lt;intercept-url pattern="/logout" method="GET" /&gt;
      &lt;logout invalidate-session="true" logout-url="/logout"
          success-handler-ref="logoutSuccessHandler" /&gt;
      &lt;custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" /&gt;
      &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
  &lt;/http&gt;
  
  
  
  &lt;bean id="logoutSuccessHandler" class="com.wth.services.auth.service.impl.LogoutImpl"&gt;
      &lt;property name="tokenstore" ref="tokenStore"&gt;&lt;/property&gt;
  &lt;/bean&gt;
  
  &lt;bean id="oauthAuthenticationEntryPoint"
      class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
  &lt;/bean&gt;
  
  &lt;bean id="clientAuthenticationEntryPoint"
      class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
      &lt;property name="realmName" value="springsec/client" /&gt;
      &lt;property name="typeName" value="Basic" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="oauthAccessDeniedHandler"
      class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler"&gt;
  &lt;/bean&gt;
  
  &lt;bean id="clientCredentialsTokenEndpointFilter"
      class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter"&gt;
      &lt;property name="authenticationManager" ref="authenticationManager" /&gt;
  &lt;/bean&gt;
  
  &lt;authentication-manager alias="authenticationManager"
      xmlns="http://www.springframework.org/schema/security"&gt;
      &lt;authentication-provider user-service-ref="clientDetailsUserService" /&gt;
  &lt;/authentication-manager&gt;
  
  &lt;bean id="clientDetailsUserService"
      class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService"&gt;
      &lt;constructor-arg ref="clientDetails" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="clientDetails"
      class="com.wth.services.auth.service.impl.ClientDetailsServiceImpl" /&gt;
  
  &lt;authentication-manager id="userAuthenticationManager"
      xmlns="http://www.springframework.org/schema/security"&gt;
      &lt;authentication-provider ref="customUserAuthenticationProvider"&gt;
      &lt;/authentication-provider&gt;
  &lt;/authentication-manager&gt;
  
  &lt;bean id="customUserAuthenticationProvider"
      class="com.wth.services.auth.service.impl.CustomAuthenticationProvider"&gt;
  &lt;/bean&gt;
  
  &lt;oauth:authorization-server
      client-details-service-ref="clientDetails" token-services-ref="tokenServices"&gt;
      &lt;oauth:authorization-code /&gt;
      &lt;oauth:implicit /&gt;
      &lt;oauth:refresh-token /&gt;
      &lt;oauth:client-credentials /&gt;
      &lt;oauth:password authentication-manager-ref="userAuthenticationManager" /&gt;
  &lt;/oauth:authorization-server&gt;
  
  &lt;oauth:resource-server id="resourceServerFilter"
      resource-id="springsec" token-services-ref="tokenServices" /&gt;
  
  &lt;bean id="tokenStore"
      class="org.springframework.security.oauth2.provider.token.InMemoryTokenStore" /&gt;
  
  &lt;bean id="tokenServices"
      class="org.springframework.security.oauth2.provider.token.DefaultTokenServices"&gt;
      &lt;property name="tokenStore" ref="tokenStore" /&gt;
      &lt;property name="supportRefreshToken" value="true" /&gt;
      &lt;property name="accessTokenValiditySeconds" value="300000"&gt;&lt;/property&gt;
      &lt;property name="clientDetailsService" ref="clientDetails" /&gt;
  &lt;/bean&gt;
  </code></pre>