title: Spring Security OAuth2 Resource Server Always Returning Invalid Token
body: <p>I am trying to get a basic in-memory OAuth2 server running using the Spring Libraries. I have been following the <a href="https://github.com/spring-projects/spring-security-oauth/blob/master/samples/oauth2/sparklr" rel="noreferrer">sparklr example</a>.</p>
  
  <p>I currently have configured the Server and almost everything is working, however I cannot access my restricted resource from the resource server.</p>
  
  <p>My test workflow:</p>
  
  <ol>
  <li><p>Access the oauth authorized URI to start the OAuth2 flow: <a href="http://localhost:8080/server/oauth/authorize?response_type=code&amp;client_id=client" rel="noreferrer">http://localhost:8080/server/oauth/authorize?response_type=code&amp;client_id=client</a></p></li>
  <li><p>Redirect to the login page: <a href="http://localhost:8080/server/login" rel="noreferrer">http://localhost:8080/server/login</a></p></li>
  <li><p>Handle the approval and redirect to my configured redirect page w/ a code parameter: <a href="http://localhost:8080/client?code=HMJO4K" rel="noreferrer">http://localhost:8080/client?code=HMJO4K</a></p></li>
  <li><p>Construct a GET request using Basic Auth using the client id and secret along with the grant type and code: <a href="http://localhost:8080/server/oauth/token?grant_type=authorization_code&amp;code=HMJO4K" rel="noreferrer">http://localhost:8080/server/oauth/token?grant_type=authorization_code&amp;code=HMJO4K</a></p></li>
  <li><p>Receive an access_token and refresh token object in return</p>
  
  <p>{
      access_token: "f853bcc5-7801-42d3-9cb8-303fc67b0453"
      token_type: "bearer"
      refresh_token: "57100377-dea9-4df0-adab-62e33f2a1b49"
      expires_in: 299
      scope: "read write"
  }</p></li>
  <li><p>Attempt to access a restricted resource using the access_token: <a href="http://localhost:8080/server/me?access_token=f853bcc5-7801-42d3-9cb8-303fc67b0453" rel="noreferrer">http://localhost:8080/server/me?access_token=f853bcc5-7801-42d3-9cb8-303fc67b0453</a></p></li>
  <li><p>Receive an invalid token reply</p>
  
  <p>{
      error: "invalid_token"
      error_description: "Invalid access token: f853bcc5-7801-42d3-9cb8-303fc67b0453"
  }</p></li>
  <li><p>POST to the token uri again to refresh token: <a href="http://localhost:8080/server/oauth/token?grant_type=refresh_token&amp;refresh_token=57100377-dea9-4df0-adab-62e33f2a1b49" rel="noreferrer">http://localhost:8080/server/oauth/token?grant_type=refresh_token&amp;refresh_token=57100377-dea9-4df0-adab-62e33f2a1b49</a></p></li>
  <li><p>Receive a new token</p>
  
  <p>{
      access_token: "ed104994-899c-4cd9-8860-43d5689a9420"
      token_type: "bearer"
      refresh_token: "57100377-dea9-4df0-adab-62e33f2a1b49"
      expires_in: 300
      scope: "read write"
  }</p></li>
  </ol>
  
  <p>I am really not sure what I am doing wrong, but it appears that everything other than accessing the restricted uri is working. Here is my configuration:</p>
  
  <pre><code>@Configuration
  public class Oauth2ServerConfiguration {
  
      private static final String SERVER_RESOURCE_ID = "oauth2-server";
  
      @Configuration
      @EnableResourceServer
      protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
  
          @Override
          public void configure(ResourceServerSecurityConfigurer resources) {
              resources.resourceId(SERVER_RESOURCE_ID);
          }
  
          @Override
          public void configure(HttpSecurity http) throws Exception {
              http
                  .sessionManagement()
                      .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
                  .and().requestMatchers()
                      .antMatchers("/me")
                  .and().authorizeRequests()
                      .antMatchers("/me").access("#oauth2.clientHasRole('ROLE_CLIENT')")
              ;
          }
      }
  
      @Configuration
      @EnableAuthorizationServer
      protected static class AuthotizationServerConfiguration extends AuthorizationServerConfigurerAdapter {
  
          @Autowired
          private ClientDetailsService clientDetailsService;
  
          @Autowired
          @Qualifier("authenticationManagerBean")
          private AuthenticationManager authenticationManager;
  
          @Override
          public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
              clients.inMemory()
                  .withClient("client")
                      .resourceIds(SERVER_RESOURCE_ID)
                      .secret("secret")
                      .authorizedGrantTypes("authorization_code", "refresh_token")
                      .authorities("ROLE_CLIENT")
                      .scopes("read","write")
                      .redirectUris("http://localhost:8080/client")
                      .accessTokenValiditySeconds(300)
                      .autoApprove(true)
              ;
          }
  
          @Bean
          public TokenStore tokenStore() {
              return new InMemoryTokenStore();
          }
  
          @Override
          public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
              endpoints
                  .tokenStore(tokenStore())
                  .userApprovalHandler(userApprovalHandler())
                  .authenticationManager(authenticationManager)
              ;
          }
  
          @Override
          public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
              oauthServer.realm("oauth");
          }
  
          @Bean
          public ApprovalStore approvalStore() throws Exception {
              TokenApprovalStore store = new TokenApprovalStore();
              store.setTokenStore(tokenStore());
              return store;
          }
  
          @Bean
          public UserApprovalHandler userApprovalHandler() throws Exception {
              TokenStoreUserApprovalHandler handler = new TokenStoreUserApprovalHandler();
              handler.setRequestFactory(new DefaultOAuth2RequestFactory(clientDetailsService));
              handler.setClientDetailsService(clientDetailsService);
              handler.setTokenStore(tokenStore());
  
              return handler;
          }
      }
  }
  </code></pre>
  
  <p>Is there something I am missing or am I approaching this incorrectly? Any help would be greatly appreciated.</p>