title: spring security oauth2 returning 404
body: <p>Trying to implement OAuth2 and running into a few issues following various resources on the web but could not find any resolutions.  The issue is that when I access the /token endpoint I get a 404.  Here is my config:</p>
  
  <p>web.xml - Dispatcher servlet is mapped to /services/api/* and my security config security.xml is loaded by ContextLoaderListener.</p>
  
  <p>OAuth2 mapping in security.xml:</p>
  
  <pre><code>    &lt;!-- OAUTH2 Configuration --&gt;
  
  &lt;!-- Token request Endpoint configuration --&gt;
  &lt;http pattern="/services/api/oauth2/token" use-expressions="true" create-session="stateless" authentication-manager-ref="OAuth2ClientAuthenticationManager"&gt;
      &lt;intercept-url pattern="/services/api/oauth2/token" access="hasAnyRole('ADMIN','USER')"/&gt;
      &lt;anonymous enabled="false"/&gt;
      &lt;http-basic entry-point-ref="OAuth2TokenEntryPoint"/&gt;
      &lt;custom-filter ref="clientCredentialsTokenEndpointFilter" before="BASIC_AUTH_FILTER"/&gt; &lt;!-- processes client credentials params on the request --&gt;
      &lt;access-denied-handler ref="OAuth2AccessDeniedHandler"/&gt;        
  &lt;/http&gt;
  
  &lt;!-- Resource endpoints protected by Oauth2 --&gt;
  &lt;http pattern="/services/api/oauth2/**" create-session="never" entry-point-ref="OAuth2EntryPoint" access-decision-manager-ref="OAuth2AccessDecisionManager"&gt;
      &lt;anonymous enabled="false"/&gt;
      &lt;intercept-url pattern="/services/api/oauth2/**" access="hasAnyRole('ADMIN','USER')"/&gt;
      &lt;custom-filter ref="OAuth2ResourceServer" before="PRE_AUTH_FILTER"/&gt;
      &lt;access-denied-handler ref="OAuth2AccessDeniedHandler"/&gt;        
  &lt;/http&gt;
  
  &lt;!-- Authentication entrypoint for calls to obtain access tokens --&gt;
  &lt;b:bean id="OAuth2TokenEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
      &lt;b:property name="realmName" value="oauth/oauthClient"/&gt;
      &lt;b:property name="typeName" value="Basic"/&gt;     
  &lt;/b:bean&gt;
  
  &lt;!-- Authentication entrypoint for calls to access Oauth2 protected resources --&gt;
  &lt;b:bean id="OAuth2EntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
      &lt;b:property name="realmName" value="oauth"/&gt;
  &lt;/b:bean&gt;
  
  &lt;b:bean id="OAuth2AccessDeniedHandler"  class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" /&gt;
  
  &lt;b:bean id="clientCredentialsTokenEndpointFilter"  class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter"&gt;
      &lt;b:property name="authenticationManager" ref="OAuth2ClientAuthenticationManager" /&gt;
  &lt;/b:bean&gt;
  
  &lt;b:bean id="OAuth2AccessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased"&gt;
   &lt;b:constructor-arg&gt;
    &lt;b:list&gt;
     &lt;b:bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" /&gt;
     &lt;b:bean class="org.springframework.security.access.vote.RoleVoter" /&gt;
     &lt;b:bean class="org.springframework.security.access.vote.AuthenticatedVoter" /&gt;
     &lt;b:bean class="org.springframework.security.web.access.expression.WebExpressionVoter"/&gt;
    &lt;/b:list&gt;
   &lt;/b:constructor-arg&gt;
  &lt;/b:bean&gt;
  
  &lt;!-- Authentication Manager for OAuth2 clients --&gt;
  &lt;authentication-manager id="OAuth2ClientAuthenticationManager"&gt;
      &lt;authentication-provider user-service-ref="OAuth2ClientDetailsUserService" /&gt;
  &lt;/authentication-manager&gt;
  
  &lt;b:bean id="OAuth2ClientDetailsUserService" class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService"&gt;
      &lt;b:constructor-arg ref="OAuth2ClientDetails" /&gt;
  &lt;/b:bean&gt;
  
  &lt;!-- Configure Oauth2 Token storage and services --&gt;
  &lt;b:bean id="OAuth2TokenStore" class="org.springframework.security.oauth2.provider.token.store.JdbcTokenStore"&gt;
   &lt;b:constructor-arg ref="pvDataSource" /&gt;
  &lt;/b:bean&gt;
  
  &lt;b:bean id="OAuth2TokenServices" class="org.springframework.security.oauth2.provider.token.DefaultTokenServices"&gt;
      &lt;b:property name="tokenStore" ref="OAuth2TokenStore" /&gt;
      &lt;b:property name="supportRefreshToken" value="true" /&gt;
      &lt;b:property name="accessTokenValiditySeconds" value="120"/&gt;
      &lt;b:property name="clientDetailsService" ref="OAuth2ClientDetails" /&gt;
  &lt;/b:bean&gt;
  
  &lt;b:bean id="OAuth2RequestFactory" class="org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory"&gt;
      &lt;b:constructor-arg name="clientDetailsService" ref="OAuth2ClientDetails" /&gt;
  &lt;/b:bean&gt;
  
  &lt;b:bean id="OAuth2UserApprovalHandler" class="org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler"&gt;
      &lt;b:property name="tokenStore" ref="OAuth2TokenStore"/&gt;
      &lt;b:property name="requestFactory" ref="OAuth2RequestFactory" /&gt;
  &lt;/b:bean&gt;   
  
  &lt;oauth:authorization-server client-details-service-ref="OAuth2ClientDetails" token-services-ref="OAuth2TokenServices"&gt;
      &lt;oauth:authorization-code /&gt;
      &lt;oauth:implicit/&gt;
      &lt;oauth:refresh-token/&gt;
      &lt;oauth:client-credentials /&gt;
      &lt;oauth:password/&gt;
  &lt;/oauth:authorization-server&gt;
  
  &lt;oauth:resource-server id="OAuth2ResourceServer" resource-id="oauth" token-services-ref="OAuth2TokenServices" /&gt; 
  
  &lt;!-- Configuration of OAuth2 clients --&gt;
  &lt;oauth:client-details-service id="OAuth2ClientDetails"&gt;
      &lt;oauth:client client-id="client1" authorized-grant-types="password,authorization_code,refresh_token,implicit,client_credentials" authorities="ROLE_ADMIN,ROLE_USER" scope="read,write,trust" secret="secret"/&gt;    
  &lt;/oauth:client-details-service&gt;
  </code></pre>
  
  <p>In my database I have a record for the client in the oauth_client_details table with client_id = client1, client_secret = secret, authorities = ROLE_ADMIN, scope = read,trust, authorized_grant_types = client_credentials,authorization_code,implicit</p>
  
  <p>My request is to URL: <a href="http://localhost:8080/springsec/services/api/oauth2/token?grant_type=client_credentials" rel="nofollow noreferrer">http://localhost:8080/springsec/services/api/oauth2/token?grant_type=client_credentials</a></p>
  
  <p>Header: Basic Auth with username: client1, password: secret</p>
  
  <p>In the log I see the following, note that the OAuth2 client account was found in the database and the Authorization was successful, after this point I expected it to return a valid OAuth2 token and populate the respective tables with token information but it goes off into a 404 because the endpoint pattern was not found which is really bizzare:</p>
  
  <pre><code>16:28:39.853 [tomcat-http--3] DEBUG o.s.s.w.a.w.BasicAuthenticationFilter - Basic Authentication Authorization header found for user 'client1'
  16:28:39.855 [tomcat-http--3] DEBUG o.s.s.authentication.ProviderManager - Authentication attempt using org.springframework.security.authentication.dao.DaoAuthenticationProvider
  16:28:39.861 [tomcat-http--3] DEBUG o.s.s.w.a.w.BasicAuthenticationFilter - Authentication success: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@c80a02b4: Principal: org.springframework.security.core.userdetails.User@334b85c6: Username: client1; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_ADMIN,ROLE_USER; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ADMIN, ROLE_USER
  16:28:39.861 [tomcat-http--3] DEBUG o.s.security.web.FilterChainProxy - /services/api/oauth2/token?grant_type=client_credentials at position 7 of 9 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
  16:28:39.863 [tomcat-http--3] DEBUG o.s.security.web.FilterChainProxy - /services/api/oauth2/token?grant_type=client_credentials at position 8 of 9 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
  16:28:39.863 [tomcat-http--3] DEBUG o.s.security.web.FilterChainProxy - /services/api/oauth2/token?grant_type=client_credentials at position 9 of 9 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
  Checking match of request : '/services/api/oauth2/token'; against '/services/api/oauth2/token'
  16:28:39.863 [tomcat-http--3] DEBUG o.s.s.w.a.i.FilterSecurityInterceptor - Secure object: FilterInvocation: URL: /services/api/oauth2/token?grant_type=client_credentials; Attributes: [hasAnyRole('ADMIN','USER')]
  16:28:39.863 [tomcat-http--3] DEBUG o.s.s.w.a.i.FilterSecurityInterceptor - Previously Authenticated: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@c80a02b4: Principal: org.springframework.security.core.userdetails.User@334b85c6: Username: client1; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_ADMIN,ROLE_USER; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ADMIN, ROLE_USER
  16:28:39.871 [tomcat-http--3] DEBUG o.s.s.access.vote.AffirmativeBased - Voter: org.springframework.security.web.access.expression.WebExpressionVoter@2105b1f8, returned: 1
  16:28:39.871 [tomcat-http--3] DEBUG o.s.s.w.a.i.FilterSecurityInterceptor - Authorization successful
  16:28:39.871 [tomcat-http--3] DEBUG o.s.s.w.a.i.FilterSecurityInterceptor - RunAsManager did not change Authentication object
  16:28:39.871 [tomcat-http--3] DEBUG o.s.security.web.FilterChainProxy - /services/api/oauth2/token?grant_type=client_credentials reached end of additional filter chain; proceeding with original chain
  16:28:39.876 [tomcat-http--3] DEBUG o.s.web.servlet.DispatcherServlet - DispatcherServlet with name 'webservices' processing GET request for [/springsec/services/api/oauth2/token]
  16:28:39.880 [tomcat-http--3] DEBUG o.s.w.s.m.m.a.RequestMappingHandlerMapping - Looking up handler method for path /oauth2/token
  16:28:39.886 [tomcat-http--3] DEBUG o.s.w.s.m.m.a.RequestMappingHandlerMapping - Did not find handler method for [/oauth2/token]
  16:28:39.886 [tomcat-http--3] DEBUG o.s.s.o.p.e.FrameworkEndpointHandlerMapping - Looking up handler method for path /oauth2/token
  16:28:39.887 [tomcat-http--3] DEBUG o.s.s.o.p.e.FrameworkEndpointHandlerMapping - Did not find handler method for [/oauth2/token]
  16:28:39.887 [tomcat-http--3] WARN  o.s.web.servlet.PageNotFound - No mapping found for HTTP request with URI [/springsec/services/api/oauth2/token] in DispatcherServlet with name 'webservices'
  16:28:39.887 [tomcat-http--3] DEBUG o.s.web.servlet.DispatcherServlet - Successfully completed request
  16:28:39.888 [tomcat-http--3] DEBUG o.s.s.w.a.ExceptionTranslationFilter - Chain processed normally
  16:28:39.888 [tomcat-http--3] DEBUG o.s.s.w.c.SecurityContextPersistenceFilter - SecurityContextHolder now cleared, as request processing completed
  </code></pre>
  
  <p>What am I doing wrong here?  Any help is appreciated.</p>