title: Spring Security 5 Spring MVC Oauth 2 Password grant type not returning token with /oauth/token
body: <p>I am working on a requirement trying to allow another trusted app (backend) to connect to our API using oauth2 password grant, but I am not able to get a token using /oauth/token.
  Our application already has a basic form login authentication running with a login form.</p>
  
  <p>Here is the original WebSecurityConfig that allows a user to login with a form. This has been working for a while.</p>
  
  <pre><code>@Configuration
  @ComponentScan("config")
  @EnableWebSecurity
  @Order(2)
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
  @Autowired
  UserDetailsServiceImpl userDetailsService;
  
  
  @Override
  protected void configure(HttpSecurity http) throws Exception {
      http.cors().and()
              .csrf().disable()
              .headers().frameOptions().disable()
          .and()
              .authorizeRequests()
              //allow anyone to access the following with the pattern
              .antMatchers("/", "/static/**", "/ping", "/topic/**",  "/oauth/token" ).permitAll()
              .anyRequest().authenticated()
          .and()
              .formLogin()
              .loginPage("/").permitAll()
              .loginProcessingUrl("/login")
              .usernameParameter("username")
              .passwordParameter("password")
          .and()
              .sessionManagement()
              .expiredUrl("/")
          .and()
              .invalidSessionUrl("/");
  }
  
  @Bean(name = "corsConfigurationSource")
  CorsConfigurationSource corsConfigurationSource() {
      CorsConfiguration configuration = new CorsConfiguration();
      configuration.setAllowedMethods(Arrays.asList("GET", "POST", "OPTIONS", "DELETE", "PUT"));
      configuration.setAllowedHeaders(Arrays.asList("Cache-Control", "Authorization", "Content-Type", "content-type", "x-requested-with", "Access-Control-Allow-Origin", "Access-Control-Allow-Headers", "x-auth-token", "x-app-id", "Origin", "Accept", "X-Requested-With", "Access-Control-Request-Method", "Access-Control-Request-Headers"));
      configuration.setAllowCredentials(true);
      UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
      source.registerCorsConfiguration("/**", configuration);
      return source;
  }
  
  @Autowired
  public void configure(AuthenticationManagerBuilder auth) throws Exception {
      auth.userDetailsService(userDetailsService);
      auth.authenticationProvider(authProvider());
  }
  
  @Bean
  public DaoAuthenticationProvider authProvider() {
      DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
      authProvider.setUserDetailsService(userDetailsService);
      authProvider.setPasswordEncoder(encoder());
      return authProvider;
  }
  
  @Bean
  public PasswordEncoder encoder() {
      return new MessageDigestPasswordEncoder("md5");
  }
  }
  </code></pre>
  
  <p>And here is the new authorization server settings I added. I am just trying to get the simplest case running. So I am using in-memory for everything.</p>
  
  <pre><code>@Configuration
  @EnableAuthorizationServer
  @ComponentScan ("config")
  public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
  
  @Autowired
  private AuthenticationManager authenticationManager;
  
  @Override
  public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
      clients.inMemory().withClient("client")
          .secret("clientpassword")
          .secret("{noop}secret")
          .authorizedGrantTypes("password")
          .scopes("read", "write");
  }
  
  @Override
  public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
      endpoints.tokenStore( new InMemoryTokenStore())
              .authenticationManager(authenticationManager)
              .allowedTokenEndpointRequestMethods(HttpMethod.POST);
  }
  }
  </code></pre>
  
  <p>And this is another WebSecurityConfig I created, trying to separate the original one with the new one:</p>
  
  <pre><code>@Configuration
  @Order(1)
  @ComponentScan ("config")
  @EnableWebSecurity (debug = true)
  public class WebSecurityOauthConfig extends WebSecurityConfigurerAdapter {
  
  
  @Override
  public void configure(HttpSecurity http) throws Exception {
      http
          .authorizeRequests()
              .anyRequest().authenticated().and()
          .sessionManagement()
              .sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
          .csrf().disable();
      }
  @Autowired
  public void configureGlobal(final AuthenticationManagerBuilder auth) throws Exception {
      auth.inMemoryAuthentication()
          .passwordEncoder(NoOpPasswordEncoder.getInstance())
          .withUser("user").password("user").roles("ROLE");
  }
  
  @Bean
  @Override
  public AuthenticationManager authenticationManagerBean() throws Exception {
     return super.authenticationManagerBean();
  }
  </code></pre>
  
  <p>And this is the version:</p>
  
  <pre><code>&lt;dependency&gt;
          &lt;groupId&gt;org.springframework&lt;/groupId&gt;
          &lt;artifactId&gt;spring-test&lt;/artifactId&gt;
          &lt;version&gt;5.0.2.RELEASE&lt;/version&gt;
          &lt;scope&gt;test&lt;/scope&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
          &lt;artifactId&gt;spring-security-core&lt;/artifactId&gt;
          &lt;version&gt;5.0.0.RELEASE&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
          &lt;artifactId&gt;spring-security-config&lt;/artifactId&gt;
          &lt;version&gt;5.0.0.RELEASE&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
          &lt;artifactId&gt;spring-security-taglibs&lt;/artifactId&gt;
          &lt;version&gt;5.0.0.RELEASE&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.security.oauth&lt;/groupId&gt;
          &lt;artifactId&gt;spring-security-oauth2&lt;/artifactId&gt;
          &lt;version&gt;2.3.3.RELEASE&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
          &lt;artifactId&gt;spring-security-oauth2-client&lt;/artifactId&gt;
          &lt;version&gt;5.0.7.RELEASE&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework&lt;/groupId&gt;
          &lt;artifactId&gt;spring-webmvc&lt;/artifactId&gt;
          &lt;version&gt;5.0.0.RELEASE&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework&lt;/groupId&gt;
          &lt;artifactId&gt;spring-orm&lt;/artifactId&gt;
          &lt;version&gt;5.0.0.RELEASE&lt;/version&gt;
      &lt;/dependency&gt;
  </code></pre>
  
  <p>This is the request I send:</p>
  
  <pre><code>curl -X POST \
    http://localhost:8081/oauth/token \
    -H 'Authorization: Basic Y2xpZW50OmNsaWVudHBhc3N3b3Jk' \
    -H 'Cache-Control: no-cache' \
    -H 'Content-Type: application/x-www-form-urlencoded' \
    -H 'Postman-Token: 06a1108e-d620-4e01-b8f7-81eb7a57ae44' \
    -H 'content-type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW' \
    -F client_id=client \
    -F user=user \
    -F password=user \
    -F grant_type=password
  </code></pre>
  
  <p>No explicit error. This is the trace log from spring security. From what I see, the DaoAuthenticationProvider is not correctly registered. I was expecting using the in-memory user, but filter chain does not include it. I also tried auto-wiring userDetailsService, but result is the same</p>
  
  <pre><code>************************************************************
  
  Request received for POST '/oauth/token':
  
  org.apache.catalina.connector.RequestFacade@47616c04
  
  servletPath:/oauth/token
  pathInfo:null
  headers: 
  content-type: multipart/form-data; boundary=--------------------------127172580218970013444831
  authorization: Basic Y2xpZW50OmNsaWVudHBhc3N3b3Jk
  cache-control: no-cache
  postman-token: db0faf20-d49c-485a-8712-4d31bc65615a
  user-agent: PostmanRuntime/7.1.5
  accept: */*
  host: localhost:8081
  cookie: JSESSIONID=AC9D0F63FB67F51917751325403CC4B1
  accept-encoding: gzip, deflate
  content-length: 505
  connection: keep-alive
  
  
  Security filter chain: [
    WebAsyncManagerIntegrationFilter
    SecurityContextPersistenceFilter
    HeaderWriterFilter
    LogoutFilter
    BasicAuthenticationFilter
    RequestCacheAwareFilter
    SecurityContextHolderAwareRequestFilter
    AnonymousAuthenticationFilter
    SessionManagementFilter
    ExceptionTranslationFilter
    FilterSecurityInterceptor
  ]
  
  
  ************************************************************
  
  
  2018-09-05 22:42:36 DEBUG OrRequestMatcher:65 - Trying to match using Ant [pattern='/oauth/token']
  2018-09-05 22:42:36 DEBUG AntPathRequestMatcher:157 - Checking match of     request : '/oauth/token'; against '/oauth/token' 2018-09-05 22:42:36 DEBUG OrRequestMatcher:68 - matched
  2018-09-05 22:42:36 DEBUG FilterChainProxy:328 - /oauth/token at position 1 of 11 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
  2018-09-05 22:42:36 DEBUG FilterChainProxy:328 - /oauth/token at position 2 of 11 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
  2018-09-05 22:42:36 DEBUG FilterChainProxy:328 - /oauth/token at position 3 of 11 in additional filter chain; firing Filter: 'HeaderWriterFilter'
  2018-09-05 22:42:36 DEBUG HstsHeaderWriter:130 - Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@42b51d34
  2018-09-05 22:42:36 DEBUG FilterChainProxy:328 - /oauth/token at position 4 of 11 in additional filter chain; firing Filter: 'LogoutFilter'
  2018-09-05 22:42:36 DEBUG OrRequestMatcher:65 - Trying to match using Ant [pattern='/logout', GET]
  2018-09-05 22:42:36 DEBUG AntPathRequestMatcher:137 - Request 'POST /oauth/token' doesn't match 'GET /logout
  2018-09-05 22:42:36 DEBUG OrRequestMatcher:65 - Trying to match using Ant [pattern='/logout', POST]
  2018-09-05 22:42:36 DEBUG AntPathRequestMatcher:157 - Checking match of request : '/oauth/token'; against '/logout'
  2018-09-05 22:42:36 DEBUG OrRequestMatcher:65 - Trying to match using Ant [pattern='/logout', PUT]
  2018-09-05 22:42:36 DEBUG AntPathRequestMatcher:137 - Request 'POST /oauth/token' doesn't match 'PUT /logout
  2018-09-05 22:42:36 DEBUG OrRequestMatcher:65 - Trying to match using Ant [pattern='/logout', DELETE]
  2018-09-05 22:42:36 DEBUG AntPathRequestMatcher:137 - Request 'POST /oauth/token' doesn't match 'DELETE /logout
  2018-09-05 22:42:36 DEBUG OrRequestMatcher:72 - No matches found
  2018-09-05 22:42:36 DEBUG FilterChainProxy:328 - /oauth/token at position 5 of 11 in additional filter chain; firing Filter: 'BasicAuthenticationFilter'
  2018-09-05 22:42:36 DEBUG BasicAuthenticationFilter:170 - Basic Authentication Authorization header found for user 'client'
  2018-09-05 22:42:36 DEBUG ProviderManager:169 - Authentication attempt using org.springframework.security.authentication.dao.DaoAuthenticationProvider
  2018-09-05 22:42:36 DEBUG DaoAuthenticationProvider:87 - Authentication failed: password does not match stored value
  2018-09-05 22:42:36 DEBUG BasicAuthenticationFilter:198 - Authentication request for failed: org.springframework.security.authentication.BadCredentialsException: Bad credentials
  2018-09-05 22:42:36 DEBUG DelegatingAuthenticationEntryPoint:78 - Trying to match using RequestHeaderRequestMatcher [expectedHeaderName=X-Requested-With, expectedHeaderValue=XMLHttpRequest]
  2018-09-05 22:42:36 DEBUG DelegatingAuthenticationEntryPoint:91 - No match found. Using default entry point org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint@68e001ed
  2018-09-05 22:42:36 DEBUG SecurityContextPersistenceFilter:119 - SecurityContextHolder now cleared, as request processing completed
  </code></pre>
  
  <p>And the response is 401 Unathorized:</p>
  
  <pre><code>&lt;html&gt;
  &lt;head&gt;
      &lt;title&gt;Apache Tomcat/7.0.47 - Error report&lt;/title&gt;
      &lt;style&gt;
          &lt;!--H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--&gt;
      &lt;/style&gt;
  &lt;/head&gt;
  &lt;body&gt;
      &lt;h1&gt;HTTP Status 401 - Unauthorized&lt;/h1&gt;
      &lt;HR size="1" noshade="noshade"&gt;
      &lt;p&gt;
          &lt;b&gt;type&lt;/b&gt; Status report
      &lt;/p&gt;
      &lt;p&gt;
          &lt;b&gt;message&lt;/b&gt;
          &lt;u&gt;Unauthorized&lt;/u&gt;
      &lt;/p&gt;
      &lt;p&gt;
          &lt;b&gt;description&lt;/b&gt;
          &lt;u&gt;This request requires HTTP authentication.&lt;/u&gt;
      &lt;/p&gt;
      &lt;HR size="1" noshade="noshade"&gt;
      &lt;h3&gt;Apache Tomcat/7.0.47&lt;/h3&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>Please help. Any suggestions welcome.</p>