title: Spring Security Oauth2 and Spring Boot issue
body: <p>I am trying to build a Spring Boot application to prototype a solution for Oauth2.But I am getting an error while starting spring boot application.
  Error Message is,</p>
  
  <pre><code>Caused by: org.xml.sax.SAXParseException; lineNumber: 134; columnNumber: 20; cvc-complex-type.2.4.c: The matching wildcard is strict, but no declaration can be found for element 'oauth:implicit'.
  </code></pre>
  
  <p>Attaching my eclipse classpath file to reflect the jars on classpath :</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;classpath&gt;
      &lt;classpathentry kind="src" path="src/main/java" including="**/*.java"/&gt;
      &lt;classpathentry kind="src" path="src/main/resources" excluding="**/*.java|**/application*.yml|**/application*.properties"/&gt;
      &lt;classpathentry kind="output" path="target/classes"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/javax/validation/validation-api/1.1.0.Final/validation-api-1.1.0.Final.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/javax/mail/mailapi/1.4.3/mailapi-1.4.3.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/javax/activation/activation/1.1/activation-1.1.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/javax/servlet/servlet-api/2.3/servlet-api-2.3.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/javax/servlet/jstl/1.2/jstl-1.2.jar"/&gt;
      &lt;classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/springframework/boot/spring-boot-starter-security/1.4.0.RELEASE/spring-boot-starter-security-1.4.0.RELEASE.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/springframework/boot/spring-boot-starter/1.4.0.RELEASE/spring-boot-starter-1.4.0.RELEASE.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/springframework/boot/spring-boot/1.4.0.RELEASE/spring-boot-1.4.0.RELEASE.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/springframework/spring-core/4.3.1.RELEASE/spring-core-4.3.1.RELEASE.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/springframework/spring-context/4.3.1.RELEASE/spring-context-4.3.1.RELEASE.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/springframework/spring-aop/4.3.1.RELEASE/spring-aop-4.3.1.RELEASE.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/springframework/spring-beans/4.3.1.RELEASE/spring-beans-4.3.1.RELEASE.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/springframework/spring-expression/4.3.1.RELEASE/spring-expression-4.3.1.RELEASE.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/springframework/boot/spring-boot-autoconfigure/1.4.0.RELEASE/spring-boot-autoconfigure-1.4.0.RELEASE.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/springframework/boot/spring-boot-starter-logging/1.4.0.RELEASE/spring-boot-starter-logging-1.4.0.RELEASE.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/ch/qos/logback/logback-classic/1.1.7/logback-classic-1.1.7.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/ch/qos/logback/logback-core/1.1.7/logback-core-1.1.7.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/slf4j/slf4j-api/1.7.21/slf4j-api-1.7.21.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/slf4j/jcl-over-slf4j/1.7.21/jcl-over-slf4j-1.7.21.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/slf4j/jul-to-slf4j/1.7.21/jul-to-slf4j-1.7.21.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/slf4j/log4j-over-slf4j/1.7.21/log4j-over-slf4j-1.7.21.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/yaml/snakeyaml/1.17/snakeyaml-1.17.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/springframework/security/spring-security-config/4.1.1.RELEASE/spring-security-config-4.1.1.RELEASE.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/springframework/security/spring-security-core/4.1.1.RELEASE/spring-security-core-4.1.1.RELEASE.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/springframework/security/spring-security-web/4.1.1.RELEASE/spring-security-web-4.1.1.RELEASE.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/springframework/spring-web/4.3.1.RELEASE/spring-web-4.3.1.RELEASE.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/springframework/security/oauth/spring-security-oauth2/2.0.6.RELEASE/spring-security-oauth2-2.0.6.RELEASE.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/springframework/spring-webmvc/4.3.1.RELEASE/spring-webmvc-4.3.1.RELEASE.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/aopalliance/aopalliance/1.0/aopalliance-1.0.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/commons-codec/commons-codec/1.10/commons-codec-1.10.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/codehaus/jackson/jackson-mapper-asl/1.9.13/jackson-mapper-asl-1.9.13.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/codehaus/jackson/jackson-core-asl/1.9.13/jackson-core-asl-1.9.13.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/springframework/boot/spring-boot-starter-web/1.4.0.RELEASE/spring-boot-starter-web-1.4.0.RELEASE.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/springframework/boot/spring-boot-starter-tomcat/1.4.0.RELEASE/spring-boot-starter-tomcat-1.4.0.RELEASE.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/apache/tomcat/embed/tomcat-embed-core/8.5.4/tomcat-embed-core-8.5.4.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/apache/tomcat/embed/tomcat-embed-el/8.5.4/tomcat-embed-el-8.5.4.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/apache/tomcat/embed/tomcat-embed-websocket/8.5.4/tomcat-embed-websocket-8.5.4.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/hibernate/hibernate-validator/5.2.4.Final/hibernate-validator-5.2.4.Final.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/jboss/logging/jboss-logging/3.3.0.Final/jboss-logging-3.3.0.Final.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/com/fasterxml/classmate/1.3.1/classmate-1.3.1.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/com/fasterxml/jackson/core/jackson-databind/2.8.1/jackson-databind-2.8.1.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/com/fasterxml/jackson/core/jackson-annotations/2.8.1/jackson-annotations-2.8.1.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/com/fasterxml/jackson/core/jackson-core/2.8.1/jackson-core-2.8.1.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/com/github/fge/json-schema-validator/2.2.6/json-schema-validator-2.2.6.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/com/google/code/findbugs/jsr305/3.0.0/jsr305-3.0.0.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/joda-time/joda-time/2.9.4/joda-time-2.9.4.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/com/googlecode/libphonenumber/libphonenumber/6.2/libphonenumber-6.2.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/com/github/fge/json-schema-core/1.2.5/json-schema-core-1.2.5.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/com/github/fge/uri-template/0.9/uri-template-0.9.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/com/github/fge/msg-simple/1.1/msg-simple-1.1.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/com/github/fge/btf/1.2/btf-1.2.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/com/google/guava/guava/16.0.1/guava-16.0.1.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/com/github/fge/jackson-coreutils/1.8/jackson-coreutils-1.8.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/mozilla/rhino/1.7R4/rhino-1.7R4.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/net/sf/jopt-simple/jopt-simple/4.6/jopt-simple-4.6.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/springframework/spring-jdbc/4.3.1.RELEASE/spring-jdbc-4.3.1.RELEASE.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/springframework/spring-tx/4.3.1.RELEASE/spring-tx-4.3.1.RELEASE.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/springframework/security/spring-security-taglibs/4.1.1.RELEASE/spring-security-taglibs-4.1.1.RELEASE.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/springframework/security/spring-security-acl/4.1.1.RELEASE/spring-security-acl-4.1.1.RELEASE.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/cglib/cglib/2.2.2/cglib-2.2.2.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/asm/asm/3.3.1/asm-3.3.1.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/mysql/mysql-connector-java/5.1.39/mysql-connector-java-5.1.39.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/apache/httpcomponents/httpclient/4.1.2/httpclient-4.1.2.jar"/&gt;
      &lt;classpathentry kind="var" path="M2_REPO/org/apache/httpcomponents/httpcore/4.4.5/httpcore-4.4.5.jar"/&gt;
  &lt;/classpath&gt;
  </code></pre>
  
  <p>And Here is my spring configuration file.</p>
  
  <pre><code>&lt;beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xmlns:oauth="http://www.springframework.org/schema/security/oauth2" xmlns:sec="http://www.springframework.org/schema/security"
  xmlns:mvc="http://www.springframework.org/schema/mvc" xmlns:context="http://www.springframework.org/schema/context"
  xsi:schemaLocation="
      http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2-2.0.xsd
       http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.1.xsd
       http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd
       http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
       http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
      "&gt;
  
  &lt;context:annotation-config/&gt;
  
  &lt;!-- Scan for annotation configured controller --&gt;
  &lt;context:component-scan base-package="com.company.contentpipeline.integration.mock"/&gt;
  
  
  &lt;!-- Just for testing... --&gt;
  &lt;http pattern="/oauth/cache_approvals" security="none" xmlns="http://www.springframework.org/schema/security" /&gt;
  &lt;http pattern="/oauth/uncache_approvals" security="none" xmlns="http://www.springframework.org/schema/security" /&gt;
  
  &lt;http pattern="/oauth/token" create-session="stateless" authentication-manager-ref="clientAuthenticationManager"
      xmlns="http://www.springframework.org/schema/security"&gt;
      &lt;intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY"  /&gt;
      &lt;anonymous enabled="false" /&gt;
      &lt;!-- &lt;http-basic  entry-point-ref="clientAuthenticationEntryPoint" /&gt; --&gt;
      &lt;!-- include this only if you need to authenticate clients via request parameters --&gt;
      &lt;custom-filter ref="clientCredentialsTokenEndpointFilter" before="PRE_AUTH_FILTER" /&gt;
      &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
  &lt;/http&gt;
  
  &lt;!-- The OAuth2 protected resources are separated out into their own block so we can deal with authorization and error handling 
      separately. This isn't mandatory, but it makes it easier to control the behaviour.
  &lt;http pattern="/oauth/(users|clients)/.*" request-matcher="regex" create-session="stateless" entry-point-ref="oauthAuthenticationEntryPoint"
      use-expressions="true" xmlns="http://www.springframework.org/schema/security"&gt;
      &lt;anonymous enabled="false" /&gt;
      &lt;intercept-url pattern="/oauth/users/([^/].*?)/tokens/.*"
          access="#oauth2.clientHasRole('ROLE_CLIENT') and (hasRole('ROLE_USER') or #oauth2.isClient()) and #oauth2.hasScope('write')"
          method="DELETE" /&gt;
      &lt;intercept-url pattern="/oauth/users/.*"
          access="#oauth2.clientHasRole('ROLE_CLIENT') and (hasRole('ROLE_USER') or #oauth2.isClient()) and #oauth2.hasScope('read')"
          method="GET" /&gt;
      &lt;intercept-url pattern="/oauth/clients/.*"
          access="#oauth2.clientHasRole('ROLE_CLIENT') and #oauth2.isClient() and #oauth2.hasScope('read')" method="GET" /&gt;
      &lt;intercept-url pattern="/**" access="denyAll()"/&gt;
      &lt;custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" /&gt;
      &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
      &lt;expression-handler ref="oauthWebExpressionHandler" /&gt;
  &lt;/http&gt;
   --&gt;
  
  
  &lt;!-- The OAuth2 protected resources are separated out into their own block so we can deal with authorization and error handling 
      separately. This isn't mandatory, but it makes it easier to control the behaviour. --&gt;
  &lt;http pattern="/**" create-session="never" entry-point-ref="oauthAuthenticationEntryPoint"
      access-decision-manager-ref="accessDecisionManager" xmlns="http://www.springframework.org/schema/security"&gt;
      &lt;anonymous enabled="false" /&gt;
      &lt;intercept-url pattern="/me" access="ROLE_USER,SCOPE_READ" /&gt;
      &lt;custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" /&gt;
      &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
  &lt;/http&gt;
  
  &lt;!-- &lt;http access-denied-page="/login.jsp?authorization_error=true" disable-url-rewriting="true"
      xmlns="http://www.springframework.org/schema/security"&gt;
      &lt;intercept-url pattern="/oauth/**" access="ROLE_USER" /&gt;
      &lt;intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /&gt;
  
      &lt;form-login authentication-failure-url="/login.jsp?authentication_error=true" default-target-url="/index.jsp"
          login-page="/login.jsp" login-processing-url="/login.do" /&gt;
      &lt;logout logout-success-url="/index.jsp" logout-url="/logout.do" /&gt;
      &lt;anonymous /&gt;
  &lt;/http&gt; --&gt;
  
  &lt;bean id="oauthAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
      &lt;property name="realmName" value="sparklr" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="clientAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
      &lt;property name="realmName" value="sparklr/client" /&gt;
      &lt;property name="typeName" value="Basic" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="oauthAccessDeniedHandler" class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" /&gt;
  
  &lt;bean id="clientCredentialsTokenEndpointFilter" class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter"&gt;
      &lt;property name="authenticationManager" ref="clientAuthenticationManager" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased" xmlns="http://www.springframework.org/schema/beans"&gt;
      &lt;constructor-arg&gt;
          &lt;list&gt;
              &lt;bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" /&gt;
              &lt;bean class="org.springframework.security.access.vote.RoleVoter" /&gt;
              &lt;bean class="org.springframework.security.access.vote.AuthenticatedVoter" /&gt;
          &lt;/list&gt;
      &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  
  &lt;authentication-manager id="clientAuthenticationManager" xmlns="http://www.springframework.org/schema/security"&gt;
      &lt;authentication-provider user-service-ref="clientDetailsUserService" /&gt;
  &lt;/authentication-manager&gt;
  
  &lt;authentication-manager alias="authenticationManager" xmlns="http://www.springframework.org/schema/security"&gt;
      &lt;authentication-provider&gt;
          &lt;jdbc-user-service  id="userDetailsService" data-source-ref="jdbcTemplate" /&gt;
      &lt;/authentication-provider&gt;
  &lt;/authentication-manager&gt;
  
  &lt;bean id="clientDetailsUserService" class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService"&gt;
      &lt;constructor-arg ref="clientDetails" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="tokenStore" class="org.springframework.security.oauth2.provider.token.JdbcTokenStore"&gt;
      &lt;constructor-arg ref="jdbcTemplate" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="jdbcTemplate"
    class="org.springframework.jdbc.datasource.DriverManagerDataSource"&gt;
    &lt;property name="driverClassName" value="com.mysql.jdbc.Driver"/&gt;
    &lt;property name="url" value="jdbc:mysql://localhost/oauthdb"/&gt;
    &lt;property name="username" value="oauthuser"/&gt;
    &lt;property name="password" value="oauthuser"/&gt;
  </code></pre>
  
  <p></p>
  
  <pre><code>&lt;bean id="tokenServices" class="org.springframework.security.oauth2.provider.token.DefaultTokenServices"&gt;
      &lt;property name="tokenStore" ref="tokenStore" /&gt;
      &lt;property name="supportRefreshToken" value="true" /&gt;
      &lt;property name="clientDetailsService" ref="clientDetails" /&gt;
  &lt;/bean&gt;
  
  &lt;oauth:authorization-server client-details-service-ref="clientDetails" token-services-ref="tokenServices"/&gt;
      &lt;oauth:implicit/&gt;
      &lt;oauth:refresh-token /&gt;
      &lt;oauth:client-credentials /&gt;
      &lt;oauth:password /&gt;
  &lt;/oauth:authorization-server&gt;
  
  &lt;bean id="clientDetails" class="org.springframework.security.oauth2.provider.JdbcClientDetailsService"&gt;
          &lt;constructor-arg ref="jdbcTemplate" /&gt;
  &lt;/bean&gt;
  
  &lt;oauth:resource-server id="resourceServerFilter" resource-id="sparklr" token-services-ref="tokenServices" /&gt;
  
  &lt;mvc:annotation-driven /&gt;
  
  &lt;mvc:default-servlet-handler /&gt;
  
  &lt;sec:global-method-security pre-post-annotations="enabled" proxy-target-class="true"&gt;
      &lt;!--you could also wire in the expression handler up at the layer of the http filters. See https://jira.springsource.org/browse/SEC-1452 --&gt;
      &lt;sec:expression-handler ref="oauthExpressionHandler" /&gt;
  &lt;/sec:global-method-security&gt;
  
  &lt;oauth:expression-handler id="oauthExpressionHandler" /&gt;
  
  &lt;oauth:web-expression-handler id="oauthWebExpressionHandler" /&gt;
  </code></pre>
  
  <p></p>
  
  <p>Any thoughts ?
  I have already tried changing XSD declaration from "oauth2-2.0.xsd" to "oauth2.xsd" and I do have "spring-security-config" in my classpath.</p>