title: Spring Security 5.2 Password Flow
body: <p>I am trying to authenticate the user using the password flow in the latest version of Spring Security - 5.2. </p>
  
  <p>The <a href="https://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#oauth2Client-password-grant" rel="nofollow noreferrer">docs seem to suggest</a> how to do that. </p>
  
  <pre><code>@Bean
  public OAuth2AuthorizedClientManager passwordFlowAuthorizedClientManager(
          HttpClient httpClient,
          ClientRegistrationRepository clientRegistrationRepository,
          OAuth2AuthorizedClientRepository authorizedClientRepository) {
  
      HttpComponentsClientHttpRequestFactory requestFactory = new HttpComponentsClientHttpRequestFactory();
      requestFactory.setHttpClient(httpClient);
  
      DefaultPasswordTokenResponseClient c = new DefaultPasswordTokenResponseClient();
      RestTemplate client = new RestTemplate(requestFactory);
      client.setMessageConverters(Arrays.asList(
              new FormHttpMessageConverter(),
              new OAuth2AccessTokenResponseHttpMessageConverter()));
      client.setErrorHandler(new OAuth2ErrorResponseErrorHandler());
      c.setRestOperations(client);
  
      OAuth2AuthorizedClientProvider authorizedClientProvider = OAuth2AuthorizedClientProviderBuilder.builder()
                  .password(configurer -&gt; configurer.accessTokenResponseClient(c))
                  .refreshToken()
                  .build();
  
      DefaultOAuth2AuthorizedClientManager authorizedClientManager =
              new DefaultOAuth2AuthorizedClientManager(
                      clientRegistrationRepository, authorizedClientRepository);
      authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);
  
      authorizedClientManager.setContextAttributesMapper(authorizeRequest -&gt; {
          Map&lt;String, Object&gt; contextAttributes = new HashMap&lt;&gt;();
          String username = authorizeRequest.getAttribute(OAuth2ParameterNames.USERNAME);
          String password = authorizeRequest.getAttribute(OAuth2ParameterNames.PASSWORD);
          contextAttributes.put(OAuth2AuthorizationContext.USERNAME_ATTRIBUTE_NAME, username);
          contextAttributes.put(OAuth2AuthorizationContext.PASSWORD_ATTRIBUTE_NAME, password);
          return contextAttributes;
      });
  
      return authorizedClientManager;
  }
  
  
  
  </code></pre>
  
  <p>I execute the request, I can see the access token returned in HTTP header but the SecurityContext is not populated and the session user remains anonymous.</p>
  
  <pre><code>String username = "joe";
  String password = "joe";
  Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
  ClientRegistration r = clientRegistrationRepository.findByRegistrationId("keycloak");
  
  OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId(r.getRegistrationId())
          .principal(authentication)
          .attributes(attrs -&gt; {
              attrs.put(OAuth2ParameterNames.USERNAME, username);
              attrs.put(OAuth2ParameterNames.PASSWORD, password);
          })
          .build();
  OAuth2AuthorizedClient authorizedClient = this.authorizedClientManager.authorize(authorizeRequest);
  </code></pre>
  
  <p>Any ideas?</p>