title: java + spring security oauth token not returned with 404 page not found
body: <p>Everyone, I am aware that there is already a solution for similar kind of issue but this question is different.</p>
  
  <p>I also read the <a href="https://stackoverflow.com/questions/32828126/404-not-found-when-try-getting-oauth2-access-token-in-spring-application">link</a> present, but the solution didn't apply to me.</p>
  
  <p>My Question is that I am trying to secure my Java+Spring+Jersey webservice application using <code>oauth2.0</code> and have been using <code>spring-security-oauth2</code> library version.</p>
  
  <p>Whenever I make a call to the <code>/oauth/token</code> the application verifies the details provided under the header( <code>client_secret, client_id and grant_type</code>), the client is successfully authenticated but token data is not returned from the server rather a 404 page not found response is shown.</p>
  
  <p>here is the below configurations:</p>
  
  <ol>
  <li><p>web.xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns="http://java.sun.com/xml/ns/javaee"
      xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
      version="2.5"&gt;
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
      &lt;/listener&gt;
      &lt;context-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;WEB-INF/spring/dispatcher-servlet.xml&lt;/param-value&gt;
      &lt;/context-param&gt;
  
      &lt;servlet&gt;
          &lt;servlet-name&gt;jersey-servlet&lt;/servlet-name&gt;
          &lt;servlet-class&gt;com.sun.jersey.spi.spring.container.servlet.SpringServlet&lt;/servlet-class&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;com.sun.jersey.config.property.packages&lt;/param-name&gt;
              &lt;param-value&gt;com.tprivity.babycenter.ws&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;com.sun.jersey.api.json.POJOMappingFeature&lt;/param-name&gt;
              &lt;param-value&gt;true&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;jersey-servlet&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
  
      &lt;filter&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
      &lt;/filter&gt;
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  &lt;/web-app&gt;
  </code></pre></li>
  <li><p>dispatcher-servlet.xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:aop="http://www.springframework.org/schema/aop"
      xmlns:context="http://www.springframework.org/schema/context"
      xmlns:jdbc="http://www.springframework.org/schema/jdbc" xmlns:oauth2="http://www.springframework.org/schema/security/oauth2"
      xmlns:p="http://www.springframework.org/schema/p" xmlns:security="http://www.springframework.org/schema/security"
      xmlns:tx="http://www.springframework.org/schema/tx"
      xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
          http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.2.xsd
          http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd
          http://www.springframework.org/schema/jdbc http://www.springframework.org/schema/jdbc/spring-jdbc-3.2.xsd
          http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2.xsd
          http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd
          http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.2.xsd"&gt;
  
      &lt;security:http pattern="/oauth/token" create-session="stateless"
          authentication-manager-ref="authenticationManager"&gt;
          &lt;security:intercept-url pattern="/oauth/token"
              access="IS_AUTHENTICATED_FULLY" /&gt;
          &lt;security:anonymous enabled="false" /&gt;
          &lt;security:http-basic entry-point-ref="clientAuthenticationEntryPoint" /&gt;
          &lt;security:custom-filter ref="clientCredentialsTokenEndpointFilter"
              before="BASIC_AUTH_FILTER" /&gt;
          &lt;security:access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
      &lt;/security:http&gt;
  
      &lt;security:http pattern="/ws/**" create-session="never"
          authentication-manager-ref="authenticationManager" entry-point-ref="oauthAuthenticationEntryPoint"&gt;
          &lt;security:anonymous enabled="false" /&gt;
          &lt;security:intercept-url pattern="/ws/**"
              method="GET" access="IS_AUTHENTICATED_FULLY" /&gt;
          &lt;security:intercept-url pattern="/ws/**"
              method="POST" access="IS_AUTHENTICATED_FULLY" /&gt;
          &lt;security:custom-filter ref="resourceServerFilter"
              before="PRE_AUTH_FILTER" /&gt;
          &lt;security:access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
      &lt;/security:http&gt;
  
      &lt;bean id="oauthAuthenticationEntryPoint"
          class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
      &lt;/bean&gt;
  
      &lt;bean id="clientAuthenticationEntryPoint"
          class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
          &lt;property name="realmName" value="springsec/client" /&gt;
          &lt;property name="typeName" value="Basic" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="oauthAccessDeniedHandler"
          class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" /&gt;
  
  
      &lt;bean id="clientCredentialsTokenEndpointFilter"
          class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter"&gt;
          &lt;property name="authenticationManager" ref="authenticationManager" /&gt;
      &lt;/bean&gt;
  
      &lt;security:authentication-manager alias="authenticationManager"&gt;
          &lt;security:authentication-provider
              user-service-ref="clientDetailsUserService" /&gt;
      &lt;/security:authentication-manager&gt;
  
      &lt;bean id="clientDetailsUserService"
          class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService"&gt;
          &lt;constructor-arg ref="clientDetails" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="clientDetails"
          class="org.springframework.security.oauth2.provider.client.JdbcClientDetailsService"&gt;
          &lt;constructor-arg index="0"&gt;
              &lt;ref bean="dataSource" /&gt;
          &lt;/constructor-arg&gt;
      &lt;/bean&gt;
  
      &lt;security:authentication-manager id="userAuthenticationManager"&gt;
          &lt;security:authentication-provider
              ref="customUserAuthenticationProvider" /&gt;
      &lt;/security:authentication-manager&gt;
  
      &lt;bean id="customUserAuthenticationProvider"
          class="com.tprivity.babycenter.ws.security.CustomUserAuthenticationProvider"&gt;
      &lt;/bean&gt;
  
      &lt;!-- Authorization Server Configuration of the server is used to provide 
          implementations of the client details service and token services and to enable 
          or disable certain aspects of the mechanism globally. --&gt;
      &lt;oauth2:authorization-server
          client-details-service-ref="clientDetails" token-services-ref="tokenServices"
          user-approval-handler-ref="userApprovalHandler"&gt;
          &lt;oauth2:authorization-code /&gt;
          &lt;oauth2:implicit /&gt;
          &lt;oauth2:refresh-token /&gt;
          &lt;oauth2:client-credentials /&gt;
          &lt;oauth2:password authentication-manager-ref="userAuthenticationManager" /&gt;
      &lt;/oauth2:authorization-server&gt;
  
      &lt;oauth2:resource-server id="resourceServerFilter"
          resource-id="springsec" token-services-ref="tokenServices" /&gt;
  
      &lt;bean id="tokenStore"
          class="org.springframework.security.oauth2.provider.token.store.JdbcTokenStore"&gt;
          &lt;constructor-arg name="dataSource" ref="dataSource"&gt;&lt;/constructor-arg&gt;
      &lt;/bean&gt;
  
      &lt;!-- Configure Authentication manager --&gt;
      &lt;bean id="passwordEncoder"
          class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"&gt;
          &lt;constructor-arg name="strength" value="11" /&gt;
      &lt;/bean&gt;
  
      &lt;!-- Grants access if only grant (or abstain) votes were received. We can 
          protect REST resource methods with JSR-250 annotations such as @RolesAllowed --&gt;
      &lt;bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased"&gt;
          &lt;property name="decisionVoters"&gt;
              &lt;list&gt;
                  &lt;bean class="org.springframework.security.access.annotation.Jsr250Voter" /&gt;
              &lt;/list&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
  
      &lt;bean id="tokenServices"
          class="org.springframework.security.oauth2.provider.token.DefaultTokenServices"&gt;
          &lt;property name="tokenStore" ref="tokenStore" /&gt;
          &lt;property name="supportRefreshToken" value="true" /&gt;
          &lt;property name="accessTokenValiditySeconds" value="120"&gt;&lt;/property&gt;
          &lt;property name="clientDetailsService" ref="clientDetails" /&gt;
      &lt;/bean&gt;
  
      &lt;!-- A user approval handler that remembers approval decisions by consulting 
          existing tokens --&gt;
      &lt;bean id="oAuth2RequestFactory"
          class="org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory"&gt;
          &lt;constructor-arg ref="clientDetails" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="userApprovalHandler"
          class="org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler"&gt;
          &lt;property name="requestFactory" ref="oAuth2RequestFactory" /&gt;
          &lt;property name="tokenStore" ref="tokenStore" /&gt;
      &lt;/bean&gt;
  &lt;/beans&gt;
  </code></pre></li>
  </ol>
  
  <p>below is the logs for the same.</p>
  
  <pre><code>DEBUG [org.springframework.security.web.util.matcher.AntPathRequestMatcher] - &lt;Checking match of request : '/oauth/token'; against '/oauth/token'&gt;
  DEBUG [org.springframework.security.web.FilterChainProxy] - &lt;/oauth/token at position 1 of 7 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'&gt;
  DEBUG [org.springframework.security.web.FilterChainProxy] - &lt;/oauth/token at position 2 of 7 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'&gt;
  DEBUG [org.springframework.security.web.FilterChainProxy] - &lt;/oauth/token at position 3 of 7 in additional filter chain; firing Filter: 'ClientCredentialsTokenEndpointFilter'&gt;
  DEBUG [org.springframework.security.web.FilterChainProxy] - &lt;/oauth/token at position 4 of 7 in additional filter chain; firing Filter: 'BasicAuthenticationFilter'&gt;
  DEBUG [org.springframework.security.web.authentication.www.BasicAuthenticationFilter] - &lt;Basic Authentication Authorization header found for user 'bccws'&gt;
  DEBUG [org.springframework.security.authentication.ProviderManager] - &lt;Authentication attempt using org.springframework.security.authentication.dao.DaoAuthenticationProvider&gt;
  WARN [org.springframework.context.support.ResourceBundleMessageSource] - &lt;ResourceBundle [messages] not found for MessageSource: Can't find bundle for base name messages, locale en_US&gt;
  WARN [org.springframework.context.support.ResourceBundleMessageSource] - &lt;ResourceBundle [labels] not found for MessageSource: Can't find bundle for base name labels, locale en_US&gt;
  WARN [org.springframework.context.support.ResourceBundleMessageSource] - &lt;ResourceBundle [errors] not found for MessageSource: Can't find bundle for base name errors, locale en_US&gt;
  DEBUG [org.springframework.jdbc.core.JdbcTemplate] - &lt;Executing prepared SQL query&gt;
  DEBUG [org.springframework.jdbc.core.JdbcTemplate] - &lt;Executing prepared SQL statement [select client_id, client_secret, resource_ids, scope, authorized_grant_types, web_server_redirect_uri, authorities, access_token_validity, refresh_token_validity, additional_information, autoapprove from oauth_client_details where client_id = ?]&gt;
  DEBUG [org.springframework.jdbc.datasource.DataSourceUtils] - &lt;Fetching JDBC Connection from DataSource&gt;
  DEBUG [org.springframework.jdbc.datasource.DataSourceUtils] - &lt;Returning JDBC Connection to DataSource&gt;
  DEBUG [org.springframework.security.web.authentication.www.BasicAuthenticationFilter] - &lt;Authentication success: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@f9d8c511: Principal: org.springframework.security.core.userdetails.User@593829e: Username: bccws; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ADMIN; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ADMIN&gt;
  DEBUG [org.springframework.security.web.FilterChainProxy] - &lt;/oauth/token at position 5 of 7 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'&gt;
  DEBUG [org.springframework.security.web.FilterChainProxy] - &lt;/oauth/token at position 6 of 7 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'&gt;
  DEBUG [org.springframework.security.web.FilterChainProxy] - &lt;/oauth/token at position 7 of 7 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'&gt;
  DEBUG [org.springframework.security.web.util.matcher.AntPathRequestMatcher] - &lt;Checking match of request : '/oauth/token'; against '/oauth/token'&gt;
  DEBUG [org.springframework.security.web.access.intercept.FilterSecurityInterceptor] - &lt;Secure object: FilterInvocation: URL: /oauth/token; Attributes: [IS_AUTHENTICATED_FULLY]&gt;
  DEBUG [org.springframework.security.web.access.intercept.FilterSecurityInterceptor] - &lt;Previously Authenticated: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@f9d8c511: Principal: org.springframework.security.core.userdetails.User@593829e: Username: bccws; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ADMIN; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ADMIN&gt;
  DEBUG [org.springframework.security.access.vote.AffirmativeBased] - &lt;Voter: org.springframework.security.access.vote.RoleVoter@6dbd30e2, returned: 0&gt;
  DEBUG [org.springframework.security.access.vote.AffirmativeBased] - &lt;Voter: org.springframework.security.access.vote.AuthenticatedVoter@19d7bbb3, returned: 1&gt;
  DEBUG [org.springframework.security.web.access.intercept.FilterSecurityInterceptor] - &lt;Authorization successful&gt;
  DEBUG [org.springframework.security.web.access.intercept.FilterSecurityInterceptor] - &lt;RunAsManager did not change Authentication object&gt;
  DEBUG [org.springframework.security.web.FilterChainProxy] - &lt;/oauth/token reached end of additional filter chain; proceeding with original chain&gt;
  DEBUG [org.springframework.security.web.access.ExceptionTranslationFilter] - &lt;Chain processed normally&gt;
  DEBUG [org.springframework.security.web.context.SecurityContextPersistenceFilter] - &lt;SecurityContextHolder now cleared, as request processing completed&gt;
  </code></pre>
  
  <p>I have still been looking at the problem but not heading to any solution. Any help would be appreciated.</p>