title: Spring Security OAuth 2.0 - client secret always required for authorization code grant
body: <p>According to the spec, requests for a token using the authorization code grant are not required to be authenticated as long as the <code>client_id</code> is included in the request <strong>and</strong> the <code>client_id</code> is the same one used to generate the code.  However, with the Spring Security OAuth 2.0 implementation, it appears that basic auth is always required on the <code>/oauth/token</code> endpoint even if the client was never assigned a secret.</p>
  
  <p>It looks like there is support for allowing clients without a secret due to the <code>isSecretRequired()</code> method in the <code>ClientDetails</code> interface.  What do I need to do to enable clients without a secret to be authenticated at the <code>/oauth/token</code> URL?</p>
  
  <blockquote>
    <p><strong>4.1.3.  Access Token Request</strong></p>
    
    <p>The client makes a request to the token endpoint by sending the<br>
    following parameters using the "application/x-www-form-urlencoded"<br>
    format per Appendix B with a character encoding of UTF-8 in the HTTP<br>
    request entity-body:</p>
    
    <p>grant_type
             REQUIRED.  Value MUST be set to "authorization_code".</p>
    
    <p>code
             REQUIRED.  The authorization code received from the
             authorization server.</p>
    
    <p>redirect_uri
             REQUIRED, if the "redirect_uri" parameter was included in the
             authorization request as described in Section 4.1.1, and their
             values MUST be identical.</p>
    
    <p>client_id
             REQUIRED, if the client is not authenticating with the
             authorization server as described in Section 3.2.1.</p>
    
    <p>If the client type is confidential or the client was issued client 
    credentials (or assigned other authentication requirements), the<br>
    client MUST authenticate with the authorization server as described<br>
    in Section 3.2.1.</p>
  </blockquote>