title: Why is my Spring oauth server always returning the same access token?
body: <p>I'm using <code>Spring 4.3.8.RELEASE</code> and <code>spring-boot 1.5.3.RELEASE</code>.  I want to serve oauth access tokens to applications with the proper credentials.  I'm using the <code>org.springframework.security.oauth2.provider.token.store.JdbcTokenStore</code> class to do this.  However, I'm noticing that each time I connect with a client to my server that I have set up with OAuth, <strong>the server repeatedly returns the same access token, even after server restarts.</strong>  My OAuth server configuration is below</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8" ?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
      xmlns:sec="http://www.springframework.org/schema/security" xmlns:mvc="http://www.springframework.org/schema/mvc"
      xmlns:context="http://www.springframework.org/schema/context"
      xsi:schemaLocation="http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2-2.0.xsd
          http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.1.xsd
          http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
          http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
          http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd"&gt;
  
      &lt;http pattern="/oauth/token" create-session="stateless" authentication-manager-ref="clientAuthenticationManager" xmlns="http://www.springframework.org/schema/security"&gt;
          &lt;intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" /&gt;
          &lt;anonymous enabled="false" /&gt;
          &lt;http-basic entry-point-ref="clientAuthenticationEntryPoint" /&gt;
          &lt;!-- include this only if you need to authenticate clients via request parameters --&gt;
          &lt;custom-filter ref="clientCredentialsTokenEndpointFilter" after="BASIC_AUTH_FILTER" /&gt;
          &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
      &lt;/http&gt;
  
      &lt;!-- The OAuth2 protected resources are separated out into their own block 
          so we can deal with authorization and error handling separately. This isn't 
          mandatory, but it makes it easier to control the behaviour. --&gt;
      &lt;http pattern="/oauth/(users|clients)/.*" request-matcher="regex"
          create-session="stateless" entry-point-ref="oauthAuthenticationEntryPoint"
          use-expressions="true" xmlns="http://www.springframework.org/schema/security"&gt;
          &lt;anonymous enabled="false" /&gt;
          &lt;intercept-url pattern="/oauth/users/([^/].*?)/tokens/.*"
              access="#oauth2.clientHasRole('ROLE_CLIENT') and (hasRole('ROLE_USER') or #oauth2.isClient()) and #oauth2.hasScope('write')"
              method="DELETE" /&gt;
          &lt;intercept-url pattern="/oauth/users/.*"
              access="#oauth2.clientHasRole('ROLE_CLIENT') and (hasRole('ROLE_USER') or #oauth2.isClient()) and #oauth2.hasScope('read')"
              method="GET" /&gt;
          &lt;intercept-url pattern="/oauth/clients/.*"
              access="#oauth2.clientHasRole('ROLE_CLIENT') and #oauth2.isClient() and #oauth2.hasScope('read')"
              method="GET" /&gt;
          &lt;custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" /&gt;
          &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
          &lt;expression-handler ref="oauthWebExpressionHandler" /&gt;
      &lt;/http&gt;
  
      &lt;!-- The OAuth2 protected resources are separated out into their own block 
          so we can deal with authorization and error handling separately. This isn't 
          mandatory, but it makes it easier to control the behaviour. --&gt;
      &lt;http pattern="/me/**" create-session="never"
          entry-point-ref="oauthAuthenticationEntryPoint"
          access-decision-manager-ref="accessDecisionManager"
          xmlns="http://www.springframework.org/schema/security"&gt;
          &lt;anonymous enabled="false" /&gt;
          &lt;intercept-url pattern="/me" access="ROLE_USER,SCOPE_READ" /&gt;
          &lt;custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" /&gt;
          &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
      &lt;/http&gt;
  
      &lt;bean id="oauthAuthenticationEntryPoint"
          class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
          &lt;property name="realmName" value="sparklr2" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="clientAuthenticationEntryPoint"
          class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
          &lt;property name="realmName" value="sparklr2/client" /&gt;
          &lt;property name="typeName" value="Basic" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="oauthAccessDeniedHandler"
          class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" /&gt;
  
      &lt;bean id="clientCredentialsTokenEndpointFilter"
          class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter"&gt;
          &lt;property name="authenticationManager" ref="clientAuthenticationManager" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased"
          xmlns="http://www.springframework.org/schema/beans"&gt;
          &lt;constructor-arg&gt;
              &lt;list&gt;
                  &lt;bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" /&gt;
                  &lt;bean class="org.springframework.security.access.vote.RoleVoter" /&gt;
                  &lt;bean class="org.springframework.security.access.vote.AuthenticatedVoter" /&gt;
              &lt;/list&gt;
          &lt;/constructor-arg&gt;
      &lt;/bean&gt;
  
      &lt;authentication-manager id="clientAuthenticationManager"
          xmlns="http://www.springframework.org/schema/security"&gt;
          &lt;authentication-provider user-service-ref="clientDetailsUserService" /&gt;
      &lt;/authentication-manager&gt;
  
      &lt;authentication-manager alias="authenticationManager"
          xmlns="http://www.springframework.org/schema/security"&gt;
          &lt;authentication-provider&gt;
              &lt;user-service id="userDetailsService"&gt;
                  &lt;user name="marissa" password="koala" authorities="ROLE_USER" /&gt;
                  &lt;user name="paul" password="emu" authorities="ROLE_USER" /&gt;
              &lt;/user-service&gt;
          &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  
      &lt;bean id="clientDetailsUserService"
          class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService"&gt;
          &lt;constructor-arg ref="clientDetails" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="tokenStore" class="org.springframework.security.oauth2.provider.token.store.JdbcTokenStore"&gt;
          &lt;constructor-arg ref="dataSource" /&gt;
          &lt;property name="authenticationKeyGenerator"&gt;
              &lt;bean class="org.springframework.security.oauth2.UniqueAuthenticationKeyGenerator" /&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
  
      &lt;bean id="tokenServices"
          class="org.springframework.security.oauth2.provider.token.DefaultTokenServices"&gt;
          &lt;property name="tokenStore" ref="tokenStore" /&gt;
          &lt;property name="tokenEnhancer" ref="tokenEnhancer" /&gt;
          &lt;property name="supportRefreshToken" value="true" /&gt;
          &lt;property name="clientDetailsService" ref="clientDetails" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="tokenEnhancer"
          class="org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter" /&gt;
  
      &lt;bean id="requestFactory"
          class="org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory"&gt;
          &lt;constructor-arg name="clientDetailsService" ref="clientDetails" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="approvalStore"
          class="org.springframework.security.oauth2.provider.approval.TokenApprovalStore"&gt;
          &lt;property name="tokenStore" ref="tokenStore" /&gt;
      &lt;/bean&gt;
  
      &lt;oauth:authorization-server
          client-details-service-ref="clientDetails" token-services-ref="tokenServices"&gt;
          &lt;oauth:client-credentials /&gt;
      &lt;/oauth:authorization-server&gt;
  
      &lt;oauth:resource-server id="resourceServerFilter" entry-point-ref="entry"
          resource-id="myclientAssignment" token-services-ref="tokenServices" /&gt;
  
      &lt;bean id="entry" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"&gt;
          &lt;constructor-arg value="/assignment" /&gt;
      &lt;/bean&gt;
  
      &lt;context:property-placeholder location="classpath:application.properties"/&gt;
      &lt;oauth:client-details-service id="clientDetails"&gt;
          &lt;oauth:client client-id="${myclient.client.id}"
              authorized-grant-types="client_credentials" authorities="ROLE_CLIENT"
          access-token-validity="30"
              scope="read,write" secret="${myclient.client.secret}" /&gt;
      &lt;/oauth:client-details-service&gt; 
  
      &lt;mvc:default-servlet-handler /&gt;
  
      &lt;oauth:expression-handler id="oauthExpressionHandler" /&gt;
  
      &lt;oauth:web-expression-handler id="oauthWebExpressionHandler" /&gt;
  
      &lt;http pattern="/api/**"  
                    create-session="never"
                    entry-point-ref="oauthAuthenticationEntryPoint"
                    access-decision-manager-ref="accessDecisionManager"
                    xmlns="http://www.springframework.org/schema/security"&gt;
       &lt;anonymous enabled="false" /&gt;
       &lt;intercept-url pattern="/**"
                               access="IS_AUTHENTICATED_FULLY"/&gt;
  
       &lt;custom-filter ref="resourceServerFilter"
                               before="PRE_AUTH_FILTER" /&gt;
       &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
     &lt;/http&gt;
  
  &lt;/beans&gt;
  </code></pre>
  
  <p>Here's the shell script I'm using to connect to my local server to retrieve the token ...</p>
  
  <pre><code>#!/bin/bash
  
  ret=$(curl http://localhost:8080/myproject/oauth/token \
    -u "myclientid:mysecret" \
    -d "grant_type=client_credentials")
  echo $ret &gt; /tmp/out
  cat /tmp/out
  access_token=$( sed -e 's/^.*"access_token":"\([^"]*\)".*$/\1/' /tmp/out )
  echo $access_token
  </code></pre>
  
  <p><b>Edit:</b></p>
  
  <p>Per Hans' request, here is an example access token</p>
  
  <pre><code>eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzY29wZSI6WyJyZWFkIiwid3JpdGUiXSwiZXhwIjoxNDk2ODQ4NDAzLCJhdXRob3JpdGllcyI6WyJST0xFX0NMSUVOVCJdLCJqdGkiOiI4OGMxZjkzZC0wNmRhLTRmYTAtOTM1OS0yZWMxYzU5MWJlMGIiLCJjbGllbnRfaWQiOiJ6aW5jbGVhcm5pbmcifQ.Pf-rjPDj0ZhrNOYuhA0tK8lPLLCzlkqUuFFjb48xskA
  </code></pre>
  
  <p>and here is a second access token</p>
  
  <pre><code>eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzY29wZSI6WyJyZWFkIiwid3JpdGUiXSwiZXhwIjoxNDk2OTUzNTg0LCJhdXRob3JpdGllcyI6WyJST0xFX0NMSUVOVCJdLCJqdGkiOiIxM2I5M2M4Ni05MmIwLTQyY2UtYjFkNS1lZjRiNmZhNzJkMzgiLCJjbGllbnRfaWQiOiJ6aW5jbGVhcm5pbmcifQ.GfSHA_JcQg2WHYCI81lunMFIhxdX6REc4goshB2Lck0
  </code></pre>