title: spring-oauth2: HTTP Status 403 - Access Denied
body: <p>I try to send a request to my rest-api with curl and spring security oauth2 but i get this error:</p>
  
  <pre><code>* Hostname was NOT found in DNS cache
  *   Trying 127.0.0.1...
  * Connected to localhost (127.0.0.1) port 8080 (#0)
  &gt; GET /test/oauth/token HTTP/1.1
  &gt; User-Agent: curl/7.35.0
  &gt; Host: localhost:8080
  &gt; Accept: application/json
  &gt; Authorization: Basic bXktdHJ1c3RlZC1jbGllbnQ6MTIzNDU=
  &gt; Content-Length: 99
  &gt; Content-Type: application/x-www-form-urlencoded
  &gt; 
  * upload completely sent off: 99 out of 99 bytes
  &lt; HTTP/1.1 403 Forbidden
  * Server Apache-Coyote/1.1 is not blacklisted
  &lt; Server: Apache-Coyote/1.1
  &lt; X-Content-Type-Options: nosniff
  &lt; X-XSS-Protection: 1; mode=block
  &lt; Cache-Control: no-cache, no-store, max-age=0, must-revalidate
  &lt; Pragma: no-cache
  &lt; Expires: 0
  &lt; X-Frame-Options: DENY
  &lt; Content-Type: text/html;charset=utf-8
  &lt; Content-Language: en
  &lt; Content-Length: 1030
  &lt; Date: Wed, 09 Sep 2015 19:37:49 GMT
  &lt; 
  &lt;!DOCTYPE html&gt;&lt;html&gt;&lt;head&gt;&lt;title&gt;Apache Tomcat/8.0.20 - Error report&lt;/title&gt;&lt;style type="text/css"&gt;H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}.line {height: 1px; background-color: #525D76; border: none;}&lt;/style&gt; &lt;/head&gt;&lt;body&gt;&lt;h1&gt;HTTP Status 403 - Access Denied&lt;/h1&gt;&lt;div class="line"&gt;&lt;/div&gt;&lt;p&gt;&lt;b&gt;type&lt;/b&gt; Status report&lt;/p&gt;&lt;p&gt;&lt;b&gt;message&lt;/b&gt; &lt;u&gt;Access Denied&lt;/u&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;description&lt;/b&gt; &lt;u&gt;Access to the specified resource has been forbidden.&lt;/u&gt;&lt;/p&gt;&lt;hr class="line"&gt;&lt;h3&gt;Apache Tomcat/8.0.20&lt;/h3&gt;&lt;/body&gt;&lt;* Connection #0 to host localhost left intact
  </code></pre>
  
  <p>my request: </p>
  
  <pre><code>curl -X GET -k -vu my-trusted-client:12345 http://localhost:8080/test/oauth/token -H "Accept: application/jd "grant_type=password&amp;scope=read&amp;client_secret=12345&amp;client_id=my-trusted-client&amp;resource_id=rest_api"
  </code></pre>
  
  <p>a part of my code: </p>
  
  <p>my oauth2serverconfiguration:</p>
  
  <pre><code>@Configuration
  @EnableResourceServer
  public class OAuth2ServerConfiguration {
  
      @Configuration
      @EnableAuthorizationServer
      protected static class OAuth2Config extends AuthorizationServerConfigurerAdapter {
  
          @Autowired
          private AuthenticationManager authenticationManager;
  
          @Override
          public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
              endpoints.authenticationManager(authenticationManager);
          }
  
          @Override
          public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
              // @formatter:off
              clients.inMemory()
                  .withClient("my-trusted-client")
                      .authorizedGrantTypes("password", "authorization_code", "refresh_token", "implicit")
                      .authorities("USER")
                      .scopes("read", "write", "trust")
                      .resourceIds("rest_api")
                      .secret("12345")
                      .accessTokenValiditySeconds(600);
              // @formatter:on
          }
      }
  }
  </code></pre>
  
  <p>my securityconfiguration class:</p>
  
  <pre><code>@Configuration
  @EnableWebMvcSecurity
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(AuthenticationManagerBuilder builder) throws Exception {
          //builder.userDetailsService(userService).passwordEncoder(new BCryptPasswordEncoder());
      }
  
      @Override
      @Bean
      public AuthenticationManager authenticationManagerBean() throws Exception {
          return super.authenticationManagerBean();
      }
  
      @Override
      protected void configure(HttpSecurity security) throws Exception {
          security.authorizeRequests()
              .antMatchers("/oauth/token")
              .hasRole("USER")
              .antMatchers("/greeting").authenticated();
      }
  }
  </code></pre>
  
  <p>My controller: </p>
  
  <pre><code>@Path("/oauth")
  @Produces(MediaType.APPLICATION_JSON)
  public class TestController {
  
      public TestController() {
          ApplicationContext applicationContext = new AnnotationConfigApplicationContext(OAuth2ServerConfiguration.class);
          AutowireCapableBeanFactory acbFactory = applicationContext.getAutowireCapableBeanFactory();
          acbFactory.autowireBean(this);
      }
  
      @GET
      @Path("/token")
      public Response testToken() {
  
          return Response.status(200).entity("is working \n").build();
      }
  }
  </code></pre>
  
  <p>Spring has already generate the refresh_token but i don't get the access_token
  can somebody help me? What is false? My code or my request?</p>
  
  <p>Thank.</p>