title: Spring security with oauth2 adding additional parameters to authorization URL?
body: <p>I have implemented Spring Security in my restful web service. In fact, I have to add an extra parameter with the request from client side and should fetch it from the service when request for authentication/accesstoken.</p>
  
  <p><strong>spring-security.xml</strong></p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;?xml version="1.0" encoding="UTF-8" ?&gt;
      &lt;beans xmlns="http://www.springframework.org/schema/beans"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
             xmlns:context="http://www.springframework.org/schema/context"
             xmlns:sec="http://www.springframework.org/schema/security" xmlns:mvc="http://www.springframework.org/schema/mvc"
             xsi:schemaLocation="http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2-2.0.xsd
              http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.2.xsd
              http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd 
              http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
              http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd "&gt;
  
          &lt;!-- @author Nagesh.Chauhan(neel4soft@gmail.com) --&gt;  
  
          &lt;!-- This is default url to get a token from OAuth --&gt;
          &lt;http pattern="/oauth/token" create-session="stateless"
                    authentication-manager-ref="clientAuthenticationManager"
                    xmlns="http://www.springframework.org/schema/security"&gt;
              &lt;intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" /&gt;
              &lt;anonymous enabled="false" /&gt;
              &lt;http-basic entry-point-ref="clientAuthenticationEntryPoint" /&gt;
              &lt;!-- include this only if you need to authenticate clients via request 
              parameters --&gt;
              &lt;custom-filter ref="clientCredentialsTokenEndpointFilter" 
                                     after="BASIC_AUTH_FILTER" /&gt;
              &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
          &lt;/http&gt;
  
          &lt;!-- This is where we tells spring security what URL should be protected 
          and what roles have access to them --&gt;
          &lt;http pattern="/api/**" create-session="never"
                    entry-point-ref="oauthAuthenticationEntryPoint"
                    access-decision-manager-ref="accessDecisionManager"
                    xmlns="http://www.springframework.org/schema/security"&gt;
              &lt;anonymous enabled="false" /&gt;
              &lt;intercept-url pattern="/api/**" access="ROLE_APP" /&gt;
              &lt;custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" /&gt;
              &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
          &lt;/http&gt;
  
  
          &lt;bean id="oauthAuthenticationEntryPoint"
                    class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
              &lt;property name="realmName" value="test" /&gt;
          &lt;/bean&gt;
  
          &lt;bean id="clientAuthenticationEntryPoint"
                    class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
              &lt;property name="realmName" value="test/client" /&gt;
              &lt;property name="typeName" value="Basic" /&gt;
          &lt;/bean&gt;
  
          &lt;bean id="oauthAccessDeniedHandler"
                    class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" /&gt;
  
          &lt;bean id="clientCredentialsTokenEndpointFilter"
                    class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter"&gt;
              &lt;property name="authenticationManager" ref="clientAuthenticationManager" /&gt;
          &lt;/bean&gt;
  
          &lt;bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased"
                    xmlns="http://www.springframework.org/schema/beans"&gt;
              &lt;constructor-arg&gt;
                  &lt;list&gt;
                      &lt;bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" /&gt;
                      &lt;bean class="org.springframework.security.access.vote.RoleVoter" /&gt;
                      &lt;bean class="org.springframework.security.access.vote.AuthenticatedVoter" /&gt;
                  &lt;/list&gt;
              &lt;/constructor-arg&gt;
          &lt;/bean&gt;
  
          &lt;authentication-manager id="clientAuthenticationManager"
                                      xmlns="http://www.springframework.org/schema/security"&gt;
              &lt;authentication-provider user-service-ref="clientDetailsUserService" /&gt;
          &lt;/authentication-manager&gt;
  
          &lt;!-- Custom User details service which is provide the user data --&gt;
          &lt;bean id="customUserDetailsService"
                class="com.weekenter.www.service.impl.CustomUserDetailsService" /&gt;
  
          &lt;authentication-manager alias="authenticationManager"
                                  xmlns="http://www.springframework.org/schema/security"&gt;
              &lt;authentication-provider user-service-ref="customUserDetailsService"&gt;  
                  &lt;password-encoder hash="plaintext"&gt;  
                  &lt;/password-encoder&gt;
              &lt;/authentication-provider&gt; 
          &lt;/authentication-manager&gt;
  
  
  
  
          &lt;bean id="clientDetailsUserService"
                    class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService"&gt;
              &lt;constructor-arg ref="clientDetails" /&gt;
          &lt;/bean&gt;
  
  
          &lt;!-- This defined token store, we have used inmemory tokenstore for now 
          but this can be changed to a user defined one --&gt;
          &lt;bean id="tokenStore"
                    class="org.springframework.security.oauth2.provider.token.InMemoryTokenStore" /&gt;
  
          &lt;!-- This is where we defined token based configurations, token validity 
          and other things --&gt;
          &lt;bean id="tokenServices"
                    class="org.springframework.security.oauth2.provider.token.DefaultTokenServices"&gt;
              &lt;property name="tokenStore" ref="tokenStore" /&gt;
              &lt;property name="supportRefreshToken" value="true" /&gt;
              &lt;property name="accessTokenValiditySeconds" value="120" /&gt;
              &lt;property name="clientDetailsService" ref="clientDetails" /&gt;
          &lt;/bean&gt;
  
          &lt;bean id="userApprovalHandler"
                    class="org.springframework.security.oauth2.provider.approval.TokenServicesUserApprovalHandler"&gt;
              &lt;property name="tokenServices" ref="tokenServices" /&gt;
          &lt;/bean&gt;
  
          &lt;oauth:authorization-server
              client-details-service-ref="clientDetails" token-services-ref="tokenServices"
              user-approval-handler-ref="userApprovalHandler"&gt;
              &lt;oauth:authorization-code /&gt;
              &lt;oauth:implicit /&gt;
              &lt;oauth:refresh-token /&gt;
              &lt;oauth:client-credentials /&gt;
              &lt;oauth:password /&gt;
          &lt;/oauth:authorization-server&gt;
  
          &lt;oauth:resource-server id="resourceServerFilter"
                                     resource-id="test" token-services-ref="tokenServices" /&gt;
  
          &lt;oauth:client-details-service id="clientDetails"&gt;
              &lt;!-- client --&gt;
              &lt;oauth:client client-id="restapp"
                                    authorized-grant-types="authorization_code,client_credentials"
                                    authorities="ROLE_APP" scope="read,write,trust" secret="secret" /&gt;
  
              &lt;oauth:client client-id="restapp"
                                    authorized-grant-types="password,authorization_code,refresh_token,implicit"
                                    secret="restapp" authorities="ROLE_APP" /&gt;
  
          &lt;/oauth:client-details-service&gt;
  
          &lt;sec:global-method-security
              pre-post-annotations="enabled" proxy-target-class="true"&gt;
              &lt;!--you could also wire in the expression handler up at the layer of the 
              http filters. See https://jira.springsource.org/browse/SEC-1452 --&gt;
              &lt;sec:expression-handler ref="oauthExpressionHandler" /&gt;
          &lt;/sec:global-method-security&gt;
  
          &lt;oauth:expression-handler id="oauthExpressionHandler" /&gt;
          &lt;oauth:web-expression-handler id="oauthWebExpressionHandler" /&gt;
      &lt;/beans&gt;
  </code></pre>
  
  <p><strong>CustomUserDetailsService</strong></p>
  
  <pre class="lang-java prettyprint-override"><code>@Service
  @Transactional(readOnly = true)
  public class CustomUserDetailsService implements UserDetailsService {
  
      @Autowired
      private LoginDao loginDao;
  
      public UserDetails loadUserByUsername(String login)
              throws UsernameNotFoundException {
  
          boolean enabled = true;
          boolean accountNonExpired = true;
          boolean credentialsNonExpired = true;
          boolean accountNonLocked = true;
          com.weekenter.www.entity.User user = null;
          try {
              user = loginDao.getUser(login);
              if (user != null) {
                  if (user.getStatus().equals("1")) {
                      enabled = false;
                  }
              } else {
                  throw new UsernameNotFoundException(login + " Not found !");
              }
  
          } catch (Exception ex) {
              try {
                  throw new Exception(ex.getMessage());
              } catch (Exception ex1) {
              }
          }
  
          return new User(
                  user.getEmail(),
                  user.getPassword(),
                  enabled,
                  accountNonExpired,
                  credentialsNonExpired,
                  accountNonLocked,
                  getAuthorities()
          );
      }
  
      public Collection&lt;? extends GrantedAuthority&gt; getAuthorities() {
          List&lt;GrantedAuthority&gt; authList = getGrantedAuthorities(getRoles());
          return authList;
      }
  
      public List&lt;String&gt; getRoles() {
          List&lt;String&gt; roles = new ArrayList&lt;String&gt;();
          roles.add("ROLE_APP");
          return roles;
      }
  
      public static List&lt;GrantedAuthority&gt; getGrantedAuthorities(List&lt;String&gt; roles) {
          List&lt;GrantedAuthority&gt; authorities = new ArrayList&lt;GrantedAuthority&gt;();
  
          for (String role : roles) {
              authorities.add(new SimpleGrantedAuthority(role));
          }
          return authorities;
      }
  
  }
  </code></pre>
  
  <p>Currently I am requesting with the URL:</p>
  
  <p><code>http://localhost:8084/Domain/oauth/token?grant_type=password&amp;client_id=restapp&amp;client_secret=restapp&amp;username=anoo@codelynks.com&amp;password=mypass</code></p>
  
  <p>And I will get the response</p>
  
  <pre><code>{
  "access_token":"76e928b2-45e2-4283-88a4-6c01f41b51d3","token_type":"bearer","refresh_token":"8748e8ad-79c1-465d-94fe-13394eea370d","expires_in":119
  }
  </code></pre>
  
  <p>I have to enhance it by adding additional parameter <code>deviceToken</code>.</p>
  
  <p>And the URL would be:</p>
  
  <p><code>http://localhost:8084/Domain/oauth/token?grant_type=password&amp;client_id=restapp&amp;client_secret=restapp&amp;username=anoo@codelynks.com&amp;password=mypass&amp;deviceToken=something</code></p>
  
  <p>I have treid by implementing <code>UsernamePasswordAuthenticationFilter</code>, but it didn't work. How can I get the <code>deviceToken</code> parameter from the web service without affecting the output?</p>