title: Spring Security Oauth2 - InsufficientAuthenticationException: Authentication is required to obtain an access token (anonymous not allowed)
body: <p>I am trying to understand why anonymous users in the client can't get an access token.</p>
  
  <p>I found this <a href="http://forum.spring.io/forum/spring-projects/security/oauth/121682-authentication-is-required-to-obtain-an-access-token-anonymous-not-allowed" rel="nofollow noreferrer">post on the Spring Blog</a> regarding this topic, where Dave Syer answers this:</p>
  
  <blockquote>
    <p>Remember this is an issue to do with the client app, not the auth
    server, so try and see it from the point of view of the cllient. At
    step 1. there is a user trying to access a protected resource. <strong>If you
    can't idenitify that user then all your users end up with the same
    access token (the one that the first user obtains using his
    credentials at the auth server)</strong>. This is definitely a bad idea.</p>
  </blockquote>
  
  <p>However I don't see why anonymous users would share the same token:</p>
  
  <pre><code>    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
  
      if (auth instanceof AnonymousAuthenticationToken) {
          if (!resource.isClientOnly()) {
              throw new InsufficientAuthenticationException(
                      "Authentication is required to obtain an access token (anonymous not allowed)");
          }
      }
  </code></pre>
  
  <p>Although they are not fully authenticated, they have a JSESSIONID bound to every individual anonymous user.</p>
  
  <p>The <code>OAuth2ClientContext</code>, which would contain the accessToken, is a session scoped Spring bean. Since anonymous users have a HttpSession they have independent <code>OAuth2ClientContext</code>s so they could store individual accessTokens.</p>
  
  <p>Could someone explain if this makes sense or what I am not understanding?</p>