title: Spring oauth includes stacktrace in response body when a request is sent
body: <p>In the OAuth 2 code,an error such as requesting a refresh token using an invalid token value ends up generating a response that includes the stack trace, and I don't see a way to configure or disable this extra information.</p>
  
  <p>When i hit the api url i get the below stack trace, while it should have shown only 401 unauthorized</p>
  
  <pre><code>   "stackTrace": [
  {
    "methodName": "translate",
    "fileName": "DefaultWebResponseExceptionTranslator.java",
    "lineNumber": 53,
    "className": "org.springframework.security.oauth2.provider.error.DefaultWebResponseExceptionTranslator",
    "nativeMethod": false
  },
  {
    "methodName": "doHandle",
    "fileName": "AbstractOAuth2SecurityExceptionHandler.java",
    "lineNumber": 59,
    "className": "org.springframework.security.oauth2.provider.error.AbstractOAuth2SecurityExceptionHandler",
    "nativeMethod": false
  },
  {
    "methodName": "commence",
    "fileName": "OAuth2AuthenticationEntryPoint.java",
    "lineNumber": 54,
    "className": "org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint",
    "nativeMethod": false
  },
  {
    "methodName": "sendStartAuthentication",
    "fileName": "ExceptionTranslationFilter.java",
    "lineNumber": 186,
    "className": "org.springframework.security.web.access.ExceptionTranslationFilter",
    "nativeMethod": false
  },
  {
    "methodName": "handleSpringSecurityException",
    "fileName": "ExceptionTranslationFilter.java",
    "lineNumber": 161,
    "className": "org.springframework.security.web.access.ExceptionTranslationFilter",
    "nativeMethod": false
  },
  {
    "methodName": "doFilter",
    "fileName": "ExceptionTranslationFilter.java",
    "lineNumber": 131,
    "className": "org.springframework.security.web.access.ExceptionTranslationFilter",
    "nativeMethod": false
  },
  {
    "methodName": "doFilter",
    "fileName": "FilterChainProxy.java",
    "lineNumber": 342,
    "className": "org.springframework.security.web.FilterChainProxy$VirtualFilterChain",
    "nativeMethod": false
  },
  {
    "methodName": "doFilter",
    "fileName": "SessionManagementFilter.java",
    "lineNumber": 103,
    "className": "org.springframework.security.web.session.SessionManagementFilter",
    "nativeMethod": false
  },
  {
    "methodName": "doFilter",
    "fileName": "FilterChainProxy.java",
    "lineNumber": 342,
    "className": "org.springframework.security.web.FilterChainProxy$VirtualFilterChain",
    "nativeMethod": false
  },
  {
    "methodName": "doFilter",
    "fileName": "SecurityContextHolderAwareRequestFilter.java",
    "lineNumber": 154,
    "className": "org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter",
    "nativeMethod": false
  },
  {
    "methodName": "doFilter",
    "fileName": "FilterChainProxy.java",
    "lineNumber": 342,
    "className": "org.springframework.security.web.FilterChainProxy$VirtualFilterChain",
    "nativeMethod": false
  },
  {
    "methodName": "doFilter",
    "fileName": "RequestCacheAwareFilter.java",
    "lineNumber": 45,
    "className": "org.springframework.security.web.savedrequest.RequestCacheAwareFilter",
    "nativeMethod": false
  },
  {
    "methodName": "doFilter",
    "fileName": "FilterChainProxy.java",
    "lineNumber": 342,
    "className": "org.springframework.security.web.FilterChainProxy$VirtualFilterChain",
    "nativeMethod": false
  },
  {
    "methodName": "doFilter",
    "fileName": "OAuth2AuthenticationProcessingFilter.java",
    "lineNumber": 131,
    "className": "org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter",
    "nativeMethod": false
  },
  {
    "methodName": "doFilter",
    "fileName": "FilterChainProxy.java",
    "lineNumber": 342,
    "className": "org.springframework.security.web.FilterChainProxy$VirtualFilterChain",
    "nativeMethod": false
  },
  {
    "methodName": "doFilterInternal",
    "fileName": "WebAsyncManagerIntegrationFilter.java",
    "lineNumber": 50,
    "className": "org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter",
    "nativeMethod": false
  },
  {
    "methodName": "doFilter",
    "fileName": "OncePerRequestFilter.java",
    "lineNumber": 107,
    "className": "org.springframework.web.filter.OncePerRequestFilter",
    "nativeMethod": false
  },
  {
    "methodName": "doFilter",
    "fileName": "FilterChainProxy.java",
    "lineNumber": 342,
    "className": "org.springframework.security.web.FilterChainProxy$VirtualFilterChain",
    "nativeMethod": false
  },
  {
    "methodName": "doFilter",
    "fileName": "SecurityContextPersistenceFilter.java",
    "lineNumber": 87,
    "className": "org.springframework.security.web.context.SecurityContextPersistenceFilter",
    "nativeMethod": false
  },
  {
    "methodName": "doFilter",
    "fileName": "FilterChainProxy.java",
    "lineNumber": 342,
    "className": "org.springframework.security.web.FilterChainProxy$VirtualFilterChain",
    "nativeMethod": false
  },
  {
    "methodName": "doFilterInternal",
    "fileName": "FilterChainProxy.java",
    "lineNumber": 192,
    "className": "org.springframework.security.web.FilterChainProxy",
    "nativeMethod": false
  },
  {
    "methodName": "doFilter",
    "fileName": "FilterChainProxy.java",
    "lineNumber": 160,
    "className": "org.springframework.security.web.FilterChainProxy",
    "nativeMethod": false
  },
  {
    "methodName": "invokeDelegate",
    "fileName": "DelegatingFilterProxy.java",
    "lineNumber": 344,
    "className": "org.springframework.web.filter.DelegatingFilterProxy",
    "nativeMethod": false
  },
  {
    "methodName": "doFilter",
    "fileName": "DelegatingFilterProxy.java",
    "lineNumber": 261,
    "className": "org.springframework.web.filter.DelegatingFilterProxy",
    "nativeMethod": false
  },
  {
    "methodName": "doFilter",
    "fileName": "FilterInstanceWrapper.java",
    "lineNumber": 195,
    "className": "com.ibm.ws.webcontainer.filter.FilterInstanceWrapper",
    "nativeMethod": false
  },
  {
    "methodName": "doFilter",
    "fileName": "WebAppFilterChain.java",
    "lineNumber": 91,
    "className": "com.ibm.ws.webcontainer.filter.WebAppFilterChain",
    "nativeMethod": false
  },
  {
    "methodName": "doFilter",
    "fileName": "WebAppFilterManager.java",
    "lineNumber": 928,
    "className": "com.ibm.ws.webcontainer.filter.WebAppFilterManager",
    "nativeMethod": false
  },
  {
    "methodName": "invokeFilters",
    "fileName": "WebAppFilterManager.java",
    "lineNumber": 1025,
    "className": "com.ibm.ws.webcontainer.filter.WebAppFilterManager",
    "nativeMethod": false
  },
  {
    "methodName": "handleRequest",
    "fileName": "WebApp.java",
    "lineNumber": 3748,
    "className": "com.ibm.ws.webcontainer.webapp.WebApp",
    "nativeMethod": false
  },
  {
    "methodName": "handleRequest",
    "fileName": "WebGroup.java",
    "lineNumber": 304,
    "className": "com.ibm.ws.webcontainer.webapp.WebGroup",
    "nativeMethod": false
  },
  {
    "methodName": "handleRequest",
    "fileName": "WebContainer.java",
    "lineNumber": 962,
    "className": "com.ibm.ws.webcontainer.WebContainer",
    "nativeMethod": false
  },
  {
    "methodName": "handleRequest",
    "fileName": "WSWebContainer.java",
    "lineNumber": 1662,
    "className": "com.ibm.ws.webcontainer.WSWebContainer",
    "nativeMethod": false
  },
  {
    "methodName": "ready",
    "fileName": "WCChannelLink.java",
    "lineNumber": 195,
    "className": "com.ibm.ws.webcontainer.channel.WCChannelLink",
    "nativeMethod": false
  },
  {
    "methodName": "handleDiscrimination",
    "fileName": "HttpInboundLink.java",
    "lineNumber": 459,
    "className": "com.ibm.ws.http.channel.inbound.impl.HttpInboundLink",
    "nativeMethod": false
  },
  {
    "methodName": "handleNewRequest",
    "fileName": "HttpInboundLink.java",
    "lineNumber": 526,
    "className": "com.ibm.ws.http.channel.inbound.impl.HttpInboundLink",
    "nativeMethod": false
  },
  {
    "methodName": "processRequest",
    "fileName": "HttpInboundLink.java",
    "lineNumber": 312,
    "className": "com.ibm.ws.http.channel.inbound.impl.HttpInboundLink",
    "nativeMethod": false
  },
  {
    "methodName": "ready",
    "fileName": "HttpInboundLink.java",
    "lineNumber": 283,
    "className": "com.ibm.ws.http.channel.inbound.impl.HttpInboundLink",
    "nativeMethod": false
  },
  {
    "methodName": "sendToDiscriminators",
    "fileName": "NewConnectionInitialReadCallback.java",
    "lineNumber": 214,
    "className": "com.ibm.ws.tcp.channel.impl.NewConnectionInitialReadCallback",
    "nativeMethod": false
  },
  {
    "methodName": "complete",
    "fileName": "NewConnectionInitialReadCallback.java",
    "lineNumber": 113,
    "className": "com.ibm.ws.tcp.channel.impl.NewConnectionInitialReadCallback",
    "nativeMethod": false
  },
  {
    "methodName": "futureCompleted",
    "fileName": "AioReadCompletionListener.java",
    "lineNumber": 165,
    "className": "com.ibm.ws.tcp.channel.impl.AioReadCompletionListener",
    "nativeMethod": false
  },
  {
    "methodName": "invokeCallback",
    "fileName": "AbstractAsyncFuture.java",
    "lineNumber": 217,
    "className": "com.ibm.io.async.AbstractAsyncFuture",
    "nativeMethod": false
  },
  {
    "methodName": "fireCompletionActions",
    "fileName": "AsyncChannelFuture.java",
    "lineNumber": 161,
    "className": "com.ibm.io.async.AsyncChannelFuture",
    "nativeMethod": false
  },
  {
    "methodName": "completed",
    "fileName": "AsyncFuture.java",
    "lineNumber": 138,
    "className": "com.ibm.io.async.AsyncFuture",
    "nativeMethod": false
  },
  {
    "methodName": "complete",
    "fileName": "ResultHandler.java",
    "lineNumber": 204,
    "className": "com.ibm.io.async.ResultHandler",
    "nativeMethod": false
  },
  {
    "methodName": "runEventProcessingLoop",
    "fileName": "ResultHandler.java",
    "lineNumber": 775,
    "className": "com.ibm.io.async.ResultHandler",
    "nativeMethod": false
  },
  {
    "methodName": "run",
    "fileName": "ResultHandler.java",
    "lineNumber": 905,
    "className": "com.ibm.io.async.ResultHandler$2",
    "nativeMethod": false
  },
  {
    "methodName": "run",
    "fileName": "ThreadPool.java",
    "lineNumber": 1814,
    "className": "com.ibm.ws.util.ThreadPool$Worker",
    "nativeMethod": false
  }
    ],
  
       "additionalInformation": null,
    "oauth2ErrorCode": "unauthorized",
   "httpErrorCode": 401,
    "summary": "error=\"unauthorized\", error_description=\"An Authentication     object was not found in the SecurityContext\"",
    "message": "An Authentication object was not found in the SecurityContext",
    "localizedMessage": "An Authentication object was not found in the SecurityContext"
    }
  </code></pre>
  
  <p>This is my pom.xml :</p>
  
  <pre><code>    &lt;properties&gt;
      &lt;spring.version&gt;4.1.2.RELEASE&lt;/spring.version&gt;
      &lt;jackson.version&gt;1.9.13&lt;/jackson.version&gt;
      &lt;javax.validation.version&gt;1.1.0.Final&lt;/javax.validation.version&gt;
          &lt;spring.security.version&gt;3.2.5.RELEASE&lt;/spring.security.version&gt;
  &lt;/properties&gt;
  
  &lt;dependencies&gt;
  
    &lt;dependency&gt;
          &lt;groupId&gt;javax.validation&lt;/groupId&gt;
          &lt;artifactId&gt;validation-api&lt;/artifactId&gt;
          &lt;version&gt;${javax.validation.version}&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;!-- &lt;dependency&gt;
          &lt;groupId&gt;junit&lt;/groupId&gt;
          &lt;artifactId&gt;junit&lt;/artifactId&gt;
          &lt;version&gt;3.8.1&lt;/version&gt;
          &lt;scope&gt;test&lt;/scope&gt;
      &lt;/dependency&gt; --&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework&lt;/groupId&gt;
          &lt;artifactId&gt;spring-core&lt;/artifactId&gt;
          &lt;version&gt;${spring.version}&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework&lt;/groupId&gt;
          &lt;artifactId&gt;spring-web&lt;/artifactId&gt;
          &lt;version&gt;${spring.version}&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework&lt;/groupId&gt;
          &lt;artifactId&gt;spring-webmvc&lt;/artifactId&gt;
          &lt;version&gt;${spring.version}&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework&lt;/groupId&gt;
          &lt;artifactId&gt;spring-jdbc&lt;/artifactId&gt;
          &lt;version&gt;${spring.version}&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;com.fasterxml.jackson.core&lt;/groupId&gt;
          &lt;artifactId&gt;jackson-core&lt;/artifactId&gt;
          &lt;version&gt;2.4.1&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;com.fasterxml.jackson.core&lt;/groupId&gt;
          &lt;artifactId&gt;jackson-databind&lt;/artifactId&gt;
          &lt;version&gt;2.4.1.1&lt;/version&gt;
      &lt;/dependency&gt;
  
          &lt;!-- Spring Security --&gt;
          &lt;dependency&gt;
          &lt;groupId&gt;org.springframework&lt;/groupId&gt;
          &lt;artifactId&gt;spring-context-support&lt;/artifactId&gt;
          &lt;version&gt;${spring.version}&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
          &lt;artifactId&gt;spring-security-web&lt;/artifactId&gt;
          &lt;version&gt;${spring.security.version}&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
          &lt;artifactId&gt;spring-security-config&lt;/artifactId&gt;
          &lt;version&gt;${spring.security.version}&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.security.oauth&lt;/groupId&gt;
          &lt;artifactId&gt;spring-security-oauth2&lt;/artifactId&gt;
          &lt;version&gt;1.0.0.RELEASE&lt;/version&gt;
      &lt;/dependency&gt;
  
          &lt;dependency&gt;
          &lt;groupId&gt;commons-httpclient&lt;/groupId&gt;
          &lt;artifactId&gt;commons-httpclient&lt;/artifactId&gt;
          &lt;version&gt;3.1&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;log4j&lt;/groupId&gt;
          &lt;artifactId&gt;log4j&lt;/artifactId&gt;
          &lt;version&gt;1.2.17&lt;/version&gt;
      &lt;/dependency&gt;
  
  &lt;!--    &lt;dependency&gt;
          &lt;groupId&gt;org.slf4j&lt;/groupId&gt;
          &lt;artifactId&gt;slf4j-api&lt;/artifactId&gt;
          &lt;version&gt;1.6.1&lt;/version&gt;
      &lt;/dependency&gt; --&gt;
  
      &lt;dependency&gt;
          &lt;groupId&gt;org.slf4j&lt;/groupId&gt;
          &lt;artifactId&gt;slf4j-log4j12&lt;/artifactId&gt;
          &lt;version&gt;1.6.1&lt;/version&gt;
      &lt;/dependency&gt;
  
      &lt;dependency&gt;
          &lt;groupId&gt;javax.mail&lt;/groupId&gt;
          &lt;artifactId&gt;mail&lt;/artifactId&gt;
          &lt;version&gt;1.5.0-b01&lt;/version&gt;
      &lt;/dependency&gt;
  
  &lt;dependency&gt;
      &lt;groupId&gt;org.apache.commons&lt;/groupId&gt;
      &lt;artifactId&gt;commons-lang3&lt;/artifactId&gt;
      &lt;version&gt;3.0&lt;/version&gt;
  &lt;/dependency&gt;
  </code></pre>
  
  <p>This is my spring-servlet.xml</p>
  
  <pre><code>    &lt;beans xmlns="http://www.springframework.org/schema/beans"
  xmlns:mvc="http://www.springframework.org/schema/mvc" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xmlns:p="http://www.springframework.org/schema/p" xmlns:context="http://www.springframework.org/schema/context"
  xmlns:task="http://www.springframework.org/schema/task"
  xsi:schemaLocation="
      http://www.springframework.org/schema/beans    
      http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
      http://www.springframework.org/schema/context
      http://www.springframework.org/schema/context/spring-context-3.0.xsd
      http://www.springframework.org/schema/task
      http://www.springframework.org/schema/task/spring-task-3.0.xsd
      http://www.springframework.org/schema/mvc
      http://www.springframework.org/schema/mvc/spring-mvc-4.0.xsd"&gt;
  
  &lt;!-- &lt;mvc:annotation-driven content-negotiation-manager="contentNegotiationManager" 
      /&gt; --&gt;
  &lt;mvc:default-servlet-handler /&gt;
  &lt;mvc:annotation-driven /&gt;
  &lt;context:component-scan base-package="com.peoplcheck.*" /&gt;
  &lt;task:annotation-driven /&gt;
  &lt;mvc:resources mapping="/resources/**" location="/resources/" /&gt;
  
  &lt;bean id="dataSource" class="org.springframework.jndi.JndiObjectFactoryBean"&gt;
      &lt;property name="jndiName" value="jdbc/peoplecheck" /&gt;
  &lt;/bean&gt;
  </code></pre>
  
  <p></p>
  
  <p>This is my web.xml:</p>
  
  <pre><code>&lt;servlet&gt;
      &lt;servlet-name&gt;people-check&lt;/servlet-name&gt;
      &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
      &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;async-supported&gt;true&lt;/async-supported&gt;
  &lt;/servlet&gt;
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;people-check&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
      &lt;listener&gt;
      &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
  &lt;/listener&gt;
      &lt;context-param&gt;
      &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
      &lt;param-value&gt;  
          /WEB-INF/spring-servlet.xml,  
          /WEB-INF/spring-security.xml
      &lt;/param-value&gt;
  &lt;/context-param&gt;
  
  &lt;!-- Spring Security --&gt;
  
  &lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>This is my spring-securiy.xml :</p>
  
  <pre><code>&lt;!-- This is default url to get a token from OAuth --&gt;
  &lt;http pattern="/oauth/token" create-session="stateless"
      authentication-manager-ref="clientAuthenticationManager"
      xmlns="http://www.springframework.org/schema/security"&gt;
      &lt;intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" /&gt;
      &lt;anonymous enabled="false" /&gt;
      &lt;http-basic entry-point-ref="clientAuthenticationEntryPoint" /&gt;
      &lt;!-- include this only if you need to authenticate clients via request 
          parameters --&gt;
      &lt;custom-filter ref="clientCredentialsTokenEndpointFilter"
          after="BASIC_AUTH_FILTER" /&gt;
      &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
  &lt;/http&gt;
  
  &lt;!-- This is where we tells spring security what URL should be protected 
      and what roles have access to them --&gt;
  &lt;http pattern="/**" create-session="never"
      entry-point-ref="oauthAuthenticationEntryPoint"
      access-decision-manager-ref="accessDecisionManager"
      xmlns="http://www.springframework.org/schema/security"&gt;
      &lt;anonymous enabled="false" /&gt;
      &lt;intercept-url pattern="/**" access="ROLE_APP" /&gt;
      &lt;custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" /&gt;
      &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
  &lt;/http&gt;
  
  
  &lt;bean id="oauthAuthenticationEntryPoint"
      class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
      &lt;property name="realmName" value="test" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="clientAuthenticationEntryPoint"
      class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
      &lt;property name="realmName" value="test/client" /&gt;
      &lt;property name="typeName" value="Basic" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="oauthAccessDeniedHandler"
      class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" /&gt;
  
  &lt;bean id="clientCredentialsTokenEndpointFilter"
      class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter"&gt;
      &lt;property name="authenticationManager" ref="clientAuthenticationManager" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased"
      xmlns="http://www.springframework.org/schema/beans"&gt;
      &lt;constructor-arg&gt;
          &lt;list&gt;
              &lt;bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" /&gt;
              &lt;bean class="org.springframework.security.access.vote.RoleVoter" /&gt;
              &lt;bean class="org.springframework.security.access.vote.AuthenticatedVoter" /&gt;
          &lt;/list&gt;
      &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  
  &lt;authentication-manager id="clientAuthenticationManager"
      xmlns="http://www.springframework.org/schema/security"&gt;
      &lt;authentication-provider user-service-ref="clientDetailsUserService" /&gt;
  &lt;/authentication-manager&gt;
  
  
  &lt;!-- This is simple authentication manager, with a hardcoded user/password 
      combination. We can replace this with a user defined service to get few users 
      credentials from DB --&gt;
  &lt;authentication-manager alias="authenticationManager"
      xmlns="http://www.springframework.org/schema/security"&gt;
      &lt;authentication-provider&gt;
          &lt;user-service&gt;
              &lt;user name="beingjavaguys" password="spring@java" authorities="ROLE_APP" /&gt;
          &lt;/user-service&gt;
      &lt;/authentication-provider&gt;
  &lt;/authentication-manager&gt;
  
  &lt;bean id="clientDetailsUserService"
      class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService"&gt;
      &lt;constructor-arg ref="clientDetails" /&gt;
  &lt;/bean&gt;
  
  
  &lt;!-- This defined token store, we have used inmemory tokenstore for now 
      but this can be changed to a user defined one --&gt;
  &lt;bean id="tokenStore"
      class="org.springframework.security.oauth2.provider.token.InMemoryTokenStore" /&gt;
  
  &lt;!-- This is where we defined token based configurations, token validity 
      and other things --&gt;
  &lt;bean id="tokenServices"
      class="org.springframework.security.oauth2.provider.token.DefaultTokenServices"&gt;
      &lt;property name="tokenStore" ref="tokenStore" /&gt;
      &lt;property name="supportRefreshToken" value="true" /&gt;
      &lt;property name="accessTokenValiditySeconds" value="420" /&gt;
      &lt;property name="clientDetailsService" ref="clientDetails" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="userApprovalHandler"
      class="org.springframework.security.oauth2.provider.approval.TokenServicesUserApprovalHandler"&gt;
      &lt;property name="tokenServices" ref="tokenServices" /&gt;
  &lt;/bean&gt;
  
  &lt;oauth:authorization-server
      client-details-service-ref="clientDetails" token-services-ref="tokenServices"
      user-approval-handler-ref="userApprovalHandler"&gt;
      &lt;oauth:authorization-code /&gt;
      &lt;oauth:implicit /&gt;
      &lt;oauth:refresh-token /&gt;
      &lt;oauth:client-credentials /&gt;
      &lt;oauth:password /&gt;
  &lt;/oauth:authorization-server&gt;
  
  &lt;oauth:resource-server id="resourceServerFilter"
      resource-id="test" token-services-ref="tokenServices" /&gt;
  
  &lt;oauth:client-details-service id="clientDetails"&gt;
      &lt;!-- client --&gt;
      &lt;oauth:client client-id="restapp"
          authorized-grant-types="authorization_code,client_credentials"
          authorities="ROLE_APP" scope="read,write,trust" secret="secret" /&gt;
  
      &lt;oauth:client client-id="restapp"
          authorized-grant-types="password,authorization_code,refresh_token,implicit"
          secret="restapp" authorities="ROLE_APP" /&gt;
  
  &lt;/oauth:client-details-service&gt;
  
  &lt;sec:global-method-security
      pre-post-annotations="enabled" proxy-target-class="true"&gt;
      &lt;!--you could also wire in the expression handler up at the layer of the 
          http filters. See https://jira.springsource.org/browse/SEC-1452 --&gt;
      &lt;sec:expression-handler ref="oauthExpressionHandler" /&gt;
  &lt;/sec:global-method-security&gt;
  
  &lt;oauth:expression-handler id="oauthExpressionHandler" /&gt;
  &lt;oauth:web-expression-handler id="oauthWebExpressionHandler" /&gt;
  </code></pre>
  
  <p></p>