title: getting 403 forbidden error , from oauth2.0 using spring security
body: <p>I've implemented oauth2.0 in using spring oauth. it's working flawlessly in localhost, but when i deploy it to server , after successfull client  credentials authorization, i'm getting 403 forbidden. </p>
  
  <p>logs from localhost: works fine. returns the refresh token and access-token.</p>
  
  <pre><code>2016-08-15 23:16:06 DEBUG AntPathRequestMatcher:151 - Checking match of request : '/oauth/token'; against '/oauth/token'
  2016-08-15 23:16:06 DEBUG FilterChainProxy:324 - /oauth/token?grant_type=password&amp;client_id=my-trusted-client&amp;username=manju&amp;password=123456 at position 1 of 8 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
  2016-08-15 23:16:06 DEBUG FilterChainProxy:324 - /oauth/token?grant_type=password&amp;client_id=my-trusted-client&amp;username=manju&amp;password=123456 at position 2 of 8 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
  2016-08-15 23:16:06 DEBUG FilterChainProxy:324 - /oauth/token?grant_type=password&amp;client_id=my-trusted-client&amp;username=manju&amp;password=123456 at position 3 of 8 in additional filter chain; firing Filter: 'HeaderWriterFilter'
  2016-08-15 23:16:06 DEBUG HstsHeaderWriter:128 - Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@3639a75a
  2016-08-15 23:16:06 DEBUG FilterChainProxy:324 - /oauth/token?grant_type=password&amp;client_id=my-trusted-client&amp;username=manju&amp;password=123456 at position 4 of 8 in additional filter chain; firing Filter: 'BasicAuthenticationFilter'
  2016-08-15 23:16:06 DEBUG FilterChainProxy:324 - /oauth/token?grant_type=password&amp;client_id=my-trusted-client&amp;username=manju&amp;password=123456 at position 5 of 8 in additional filter chain; firing Filter: 'ClientCredentialsTokenEndpointFilter'
  2016-08-15 23:16:06 DEBUG AntPathRequestMatcher:151 - Checking match of request : '/oauth/token'; against '/oauth/token'
  2016-08-15 23:16:06 DEBUG ClientCredentialsTokenEndpointFilter:211 - Request is to process authentication
  2016-08-15 23:16:06 DEBUG ProviderManager:162 - Authentication attempt using org.springframework.security.authentication.dao.DaoAuthenticationProvider
  2016-08-15 23:16:06 DEBUG ClientCredentialsTokenEndpointFilter:317 - Authentication success. Updating SecurityContextHolder to contain: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@7e8cecce: Principal: org.springframework.security.core.userdetails.User@776427a2: Username: my-trusted-client; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_CLIENT,ROLE_TRUSTED_CLIENT; Credentials: [PROTECTED]; Authenticated: true; Details: null; Granted Authorities: ROLE_CLIENT, ROLE_TRUSTED_CLIENT
  2016-08-15 23:16:06 DEBUG FilterChainProxy:324 - /oauth/token?grant_type=password&amp;client_id=my-trusted-client&amp;username=manju&amp;password=123456 at position 6 of 8 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
  2016-08-15 23:16:06 DEBUG FilterChainProxy:324 - /oauth/token?grant_type=password&amp;client_id=my-trusted-client&amp;username=manju&amp;password=123456 at position 7 of 8 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
  2016-08-15 23:16:06 DEBUG FilterChainProxy:324 - /oauth/token?grant_type=password&amp;client_id=my-trusted-client&amp;username=manju&amp;password=123456 at position 8 of 8 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
  2016-08-15 23:16:06 DEBUG AntPathRequestMatcher:151 - Checking match of request : '/oauth/token'; against '/oauth/token'
  2016-08-15 23:16:06 DEBUG FilterSecurityInterceptor:218 - Secure object: FilterInvocation: URL: /oauth/token?grant_type=password&amp;client_id=my-trusted-client&amp;username=manju&amp;password=123456; Attributes: [IS_AUTHENTICATED_FULLY]
  2016-08-15 23:16:06 DEBUG FilterSecurityInterceptor:347 - Previously Authenticated: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@7e8cecce: Principal: org.springframework.security.core.userdetails.User@776427a2: Username: my-trusted-client; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_CLIENT,ROLE_TRUSTED_CLIENT; Credentials: [PROTECTED]; Authenticated: true; Details: null; Granted Authorities: ROLE_CLIENT, ROLE_TRUSTED_CLIENT
  2016-08-15 23:16:06 DEBUG AffirmativeBased:65 - Voter: org.springframework.security.access.vote.RoleVoter@34886fcd, returned: 0
  2016-08-15 23:16:06 DEBUG AffirmativeBased:65 - Voter: org.springframework.security.access.vote.AuthenticatedVoter@2a0cac42, returned: 1
  2016-08-15 23:16:06 DEBUG FilterSecurityInterceptor:242 - Authorization successful
  2016-08-15 23:16:06 DEBUG FilterSecurityInterceptor:255 - RunAsManager did not change Authentication object
  2016-08-15 23:16:06 DEBUG FilterChainProxy:309 - /oauth/token?grant_type=password&amp;client_id=my-trusted-client&amp;username=manju&amp;password=123456 reached end of additional filter chain; proceeding with original chain
  2016-08-15 23:16:06 DEBUG DispatcherServlet:861 - DispatcherServlet with name 'mvc-dispatcher' processing POST request for [/EWS/oauth/token]
  2016-08-15 23:16:06 DEBUG RequestMappingHandlerMapping:306 - Looking up handler method for path /oauth/token
  2016-08-15 23:16:06 DEBUG RequestMappingHandlerMapping:316 - Did not find handler method for [/oauth/token]
  2016-08-15 23:16:06 DEBUG FrameworkEndpointHandlerMapping:306 - Looking up handler method for path /oauth/token
  2016-08-15 23:16:06 DEBUG FrameworkEndpointHandlerMapping:313 - Returning handler method [public org.springframework.http.ResponseEntity&lt;org.springframework.security.oauth2.common.OAuth2AccessToken&gt; org.springframework.security.oauth2.provider.endpoint.TokenEndpoint.postAccessToken(java.security.Principal,java.util.Map&lt;java.lang.String, java.lang.String&gt;) throws org.springframework.web.HttpRequestMethodNotSupportedException]
  2016-08-15 23:16:06 DEBUG DefaultListableBeanFactory:251 - Returning cached instance of singleton bean 'oauth2TokenEndpoint'
  2016-08-15 23:16:06 DEBUG ResourceOwnerPasswordTokenGranter:63 - Getting access token for: my-trusted-client
  2016-08-15 23:16:06 DEBUG ProviderManager:162 - Authentication attempt using org.springframework.security.authentication.dao.DaoAuthenticationProvider
  2016-08-15 23:16:06 DEBUG DefaultListableBeanFactory:251 - Returning cached instance of singleton bean 'transactionManager'
  </code></pre>
  
  <p>logs from server after deployment to cloud: throws 403 forbidden code.</p>
  
  <pre><code>2016-08-14 14:45:23 DEBUG AntPathRequestMatcher:151 - Checking match of request : '/app/oauth/token'; against '/app/oauth/token'
  2016-08-14 14:45:23 DEBUG FilterChainProxy:324 - /app/oauth/token?grant_type=password&amp;client_id=my-trusted-client&amp;username=manju&amp;password=123456 at position 1 of 8 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
  2016-08-14 14:45:23 DEBUG FilterChainProxy:324 - /app/oauth/token?grant_type=password&amp;client_id=my-trusted-client&amp;username=manju&amp;password=123456 at position 2 of 8 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
  2016-08-14 14:45:23 DEBUG FilterChainProxy:324 - /app/oauth/token?grant_type=password&amp;client_id=my-trusted-client&amp;username=manju&amp;password=123456 at position 3 of 8 in additional filter chain; firing Filter: 'HeaderWriterFilter'
  2016-08-14 14:45:23 DEBUG HstsHeaderWriter:128 - Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@1798528
  2016-08-14 14:45:23 DEBUG FilterChainProxy:324 - /app/oauth/token?grant_type=password&amp;client_id=my-trusted-client&amp;username=manju&amp;password=123456 at position 4 of 8 in additional filter chain; firing Filter: 'BasicAuthenticationFilter'
  2016-08-14 14:45:23 DEBUG FilterChainProxy:324 - /app/oauth/token?grant_type=password&amp;client_id=my-trusted-client&amp;username=manju&amp;password=123456 at position 5 of 8 in additional filter chain; firing Filter: 'ClientCredentialsTokenEndpointFilter'
  2016-08-14 14:45:23 DEBUG AntPathRequestMatcher:151 - Checking match of request : '/app/oauth/token'; against '/app/oauth/token'
  2016-08-14 14:45:23 DEBUG ClientCredentialsTokenEndpointFilter:211 - Request is to process authentication
  2016-08-14 14:45:23 DEBUG ProviderManager:162 - Authentication attempt using org.springframework.security.authentication.dao.DaoAuthenticationProvider
  2016-08-14 14:45:23 DEBUG ClientCredentialsTokenEndpointFilter:317 - Authentication success. Updating SecurityContextHolder to contain: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@7e8cecce: Principal: org.springframework.security.core.userdetails.User@776427a2: Username: my-trusted-client; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_CLIENT,ROLE_TRUSTED_CLIENT; Credentials: [PROTECTED]; Authenticated: true; Details: null; Granted Authorities: ROLE_CLIENT, ROLE_TRUSTED_CLIENT
  2016-08-14 14:45:23 DEBUG FilterChainProxy:324 - /app/oauth/token?grant_type=password&amp;client_id=my-trusted-client&amp;username=manju&amp;password=123456 at position 6 of 8 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
  2016-08-14 14:45:23 DEBUG FilterChainProxy:324 - /app/oauth/token?grant_type=password&amp;client_id=my-trusted-client&amp;username=manju&amp;password=123456 at position 7 of 8 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
  2016-08-14 14:45:23 DEBUG FilterChainProxy:324 - /app/oauth/token?grant_type=password&amp;client_id=my-trusted-client&amp;username=manju&amp;password=123456 at position 8 of 8 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
  2016-08-14 14:45:23 DEBUG AntPathRequestMatcher:151 - Checking match of request : '/app/oauth/token'; against '/app/oauth/token'
  2016-08-14 14:45:23 DEBUG FilterSecurityInterceptor:218 - Secure object: FilterInvocation: URL: /app/oauth/token?grant_type=password&amp;client_id=my-trusted-client&amp;username=manju&amp;password=123456; Attributes: [IS_AUTHENTICATED_FULLY]
  2016-08-14 14:45:23 DEBUG FilterSecurityInterceptor:347 - Previously Authenticated: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@7e8cecce: Principal: org.springframework.security.core.userdetails.User@776427a2: Username: my-trusted-client; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_CLIENT,ROLE_TRUSTED_CLIENT; Credentials: [PROTECTED]; Authenticated: true; Details: null; Granted Authorities: ROLE_CLIENT, ROLE_TRUSTED_CLIENT
  2016-08-14 14:45:23 DEBUG AffirmativeBased:65 - Voter: org.springframework.security.access.vote.RoleVoter@f7e452a, returned: 0
  2016-08-14 14:45:23 DEBUG AffirmativeBased:65 - Voter: org.springframework.security.access.vote.AuthenticatedVoter@24b0576d, returned: 1
  2016-08-14 14:45:23 DEBUG FilterSecurityInterceptor:242 - Authorization successful
  2016-08-14 14:45:23 DEBUG FilterSecurityInterceptor:255 - RunAsManager did not change Authentication object
  2016-08-14 14:45:23 DEBUG FilterChainProxy:309 - /app/oauth/token?grant_type=password&amp;client_id=my-trusted-client&amp;username=manju&amp;password=123456 reached end of additional filter chain; proceeding with original chain
  2016-08-14 14:45:23 DEBUG ExceptionTranslationFilter:116 - Chain processed normally
  2016-08-14 14:45:23 DEBUG SecurityContextPersistenceFilter:105 - SecurityContextHolder now cleared, as request processing completed 
  </code></pre>
  
  <p>logs don't say anything about 403 error. it skips token endpoint.</p>
  
  <p>note: neither my localhost not production server has SSL.</p>
  
  <p>Spring security configuration file:</p>
  
  <pre><code>&lt;beans xmlns="http://www.springframework.org/schema/beans"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns:context="http://www.springframework.org/schema/context"
         xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
         xmlns:sec="http://www.springframework.org/schema/security"
         xmlns:mvc="http://www.springframework.org/schema/mvc"
         xsi:schemaLocation="http://www.springframework.org/schema/beans
  
         http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
         http://www.springframework.org/schema/security
         http://www.springframework.org/schema/security/spring-security-4.0.xsd
         http://www.springframework.org/schema/security/oauth2
         http://www.springframework.org/schema/security/spring-security-oauth2-1.0.xsd
         http://www.springframework.org/schema/mvc
         http://www.springframework.org/schema/mvc/spring-mvc.xsd
         http://www.springframework.org/schema/context
         http://www.springframework.org/schema/context/spring-context-4.0.xsd"&gt;
  
  
      &lt;!-- Definition of the Authentication Service --&gt;
      &lt;http pattern="/oauth/token" create-session="stateless" authentication-manager-ref="clientAuthenticationManager"
            xmlns="http://www.springframework.org/schema/security"
             use-expressions="false"&gt;
          &lt;intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY"/&gt;
          &lt;anonymous enabled="false"/&gt;
          &lt;http-basic entry-point-ref="clientAuthenticationEntryPoint"/&gt;
          &lt;!-- include this only if you need to authenticate clients via request parameters --&gt;
          &lt;custom-filter ref="clientCredentialsTokenEndpointFilter" after="BASIC_AUTH_FILTER"/&gt;
          &lt;access-denied-handler ref="oauthAccessDeniedHandler"/&gt;
          &lt;csrf disabled="true" /&gt;
      &lt;/http&gt;
  
      &lt;!-- Protected resources --&gt;
      &lt;http pattern="/rest/**"
            create-session="never"
            use-expressions="false"
            entry-point-ref="oauthAuthenticationEntryPoint"
            access-decision-manager-ref="accessDecisionManager"
            xmlns="http://www.springframework.org/schema/security"&gt;
          &lt;anonymous enabled="false"/&gt;
          &lt;intercept-url pattern="/rest/**" access="ROLE_USER" /&gt;
          &lt;custom-filter ref="resourceServerFilter"
                         before="PRE_AUTH_FILTER"/&gt;
          &lt;access-denied-handler
                  ref="oauthAccessDeniedHandler"/&gt;
          &lt;csrf disabled="true" /&gt;
      &lt;/http&gt;
  
       &lt;bean id="oauthAuthenticationEntryPoint"
            class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
          &lt;property name="realmName" value="dstest"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="clientAuthenticationEntryPoint"
            class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
          &lt;property name="realmName" value="dstest/client"/&gt;
          &lt;property name="typeName" value="Basic"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="oauthAccessDeniedHandler"
            class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler"/&gt;
  
      &lt;bean id="clientCredentialsTokenEndpointFilter"
            class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter"&gt;
          &lt;property name="authenticationManager" ref="clientAuthenticationManager"/&gt;
          &lt;property name="filterProcessesUrl" value="/oauth/token"/&gt; 
      &lt;/bean&gt;
  
      &lt;bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased"
            xmlns="http://www.springframework.org/schema/beans"&gt;
          &lt;constructor-arg&gt;
              &lt;list&gt;
                  &lt;bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter"/&gt;
                  &lt;bean class="org.springframework.security.access.vote.RoleVoter"/&gt;
                  &lt;bean class="org.springframework.security.web.access.expression.WebExpressionVoter"/&gt;
                  &lt;bean class="org.springframework.security.access.vote.AuthenticatedVoter"/&gt;
              &lt;/list&gt;
          &lt;/constructor-arg&gt;
      &lt;/bean&gt;
  
      &lt;!-- Authentication in config file --&gt;
      &lt;authentication-manager id="clientAuthenticationManager" xmlns="http://www.springframework.org/schema/security"&gt;
          &lt;authentication-provider user-service-ref="clientDetailsUserService"/&gt;
      &lt;/authentication-manager&gt;
  
  
       &lt;authentication-manager alias="authenticationManager"
          xmlns="http://www.springframework.org/schema/security"&gt;
          &lt;authentication-provider  user-service-ref="myUserDetailsService"&gt;  
              &lt;password-encoder hash="bcrypt" /&gt;   
          &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  
  
      &lt;bean id="clientDetailsUserService"
            class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService"&gt;
          &lt;constructor-arg ref="clientDetails"/&gt;
      &lt;/bean&gt;
  
      &lt;!-- Token Store  in memory
      &lt;bean id="tokenStore" class="org.springframework.security.oauth2.provider.token.store.JdbcTokenStore"/&gt;
      --&gt;
      &lt;bean id="tokenStore" class="org.springframework.security.oauth2.provider.token.store.JdbcTokenStore"&gt;
          &lt;constructor-arg ref="jdbcTemplate" /&gt;
      &lt;/bean&gt;
  
  
      &lt;bean id="tokenServices" class="org.springframework.security.oauth2.provider.token.DefaultTokenServices"&gt;
          &lt;property name="tokenStore" ref="tokenStore"/&gt;
          &lt;property name="supportRefreshToken" value="true"/&gt;
          &lt;property name="clientDetailsService" ref="clientDetails"/&gt;
          &lt;!-- VIV --&gt;
          &lt;property name="accessTokenValiditySeconds" value="10"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="oAuth2RequestFactory" class="org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory"&gt;
          &lt;constructor-arg ref="clientDetails" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="userApprovalHandler"
            class="org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler"&gt;
           &lt;property name="requestFactory" ref="oAuth2RequestFactory" /&gt;
          &lt;property name="tokenStore" ref="tokenStore" /&gt;
      &lt;/bean&gt;
  
      &lt;!-- Token management --&gt;
      &lt;oauth:authorization-server client-details-service-ref="clientDetails" token-services-ref="tokenServices"
                                  user-approval-handler-ref="userApprovalHandler"&gt;
          &lt;oauth:authorization-code/&gt;
          &lt;oauth:implicit/&gt;
          &lt;oauth:refresh-token/&gt;
          &lt;oauth:client-credentials/&gt;
          &lt;oauth:password /&gt;
      &lt;/oauth:authorization-server&gt;
  
      &lt;oauth:resource-server id="resourceServerFilter"
                             resource-id="dstest"
                             token-services-ref="tokenServices"/&gt;
  
      &lt;!-- Client Definition --&gt;
      &lt;oauth:client-details-service id="clientDetails"&gt;
  
          &lt;oauth:client client-id="my-trusted-client"
                        authorized-grant-types="password,authorization_code,refresh_token,implicit,redirect"
                        authorities="ROLE_CLIENT, ROLE_TRUSTED_CLIENT"
                        redirect-uri="/web"
                        scope="read,write,trust"
                        access-token-validity="6000"
                        refresh-token-validity="6000"/&gt;
  
      &lt;/oauth:client-details-service&gt;
  
      &lt;!--
       &lt;sec:global-method-security pre-post-annotations="enabled" proxy-target-class="true"&gt;
          &lt;sec:expression-handler ref="oauthExpressionHandler"/&gt;
      &lt;/sec:global-method-security&gt;
      &lt;oauth:expression-handler id="oauthExpressionHandler"/&gt;
      &lt;oauth:web-expression-handler id="oauthWebExpressionHandler"/&gt;
      --&gt;
  
      &lt;!-- Stateless RESTful service using Basic authentication 
      &lt;sec:http pattern="/rest/**" create-session="stateless"&gt;
          &lt;sec:intercept-url pattern='/**' access="hasRole('ROLE_USER')" /&gt;
          &lt;sec:http-basic /&gt;
      &lt;/sec:http&gt; --&gt;
  
      &lt;!-- enable use-expressions --&gt;
      &lt;sec:http  auto-config="true" use-expressions="false" &gt; 
          &lt;sec:intercept-url pattern="/admin/**" access="ROLE_ADMIN" /&gt;
  
          &lt;!-- access denied page --&gt;
          &lt;sec:access-denied-handler error-page="/403" /&gt;
  
          &lt;sec:form-login 
              login-page="/login" 
              default-target-url="/admin/"
              always-use-default-target="true"
              login-processing-url="/j_spring_security_check"
              authentication-failure-url="/login?error" 
              username-parameter="username"
              password-parameter="password" /&gt;
          &lt;sec:logout logout-success-url="/login?logout" logout-url="/j_spring_security_logout" /&gt;
          &lt;!-- enable csrf protection --&gt;
          &lt;sec:csrf disabled="true"/&gt;
  
      &lt;/sec:http&gt;
  
      &lt;!--
      &lt;sec:authentication-manager alias="authenticationManager"&gt;
          &lt;sec:authentication-provider user-service-ref="myUserDetailsService" &gt;
              &lt;sec:password-encoder hash="bcrypt" /&gt;    
          &lt;/sec:authentication-provider&gt;
      &lt;/sec:authentication-manager&gt;
      --&gt;
  
  &lt;/beans&gt;
  </code></pre>