title: Resteasy / Spring Security + Oauth 2.0 - error 404
body: <p>I'm trying to build a REST server/provider using Resteasy and Spring and wanted to secure some of the API using OAuth 2. As far as I understand, I should make the API expose an URI to generate the OAuth token (e.g. /oauth/token) and then use that to access the secured part.</p>
  
  <p>Below is the code where I use Spring Security along with its OAuth2 support and I try to expose a single /oauth/token URI while protecting /ws/v1/oauth/**. When I try to access any of those URIs without sending credentials, I get the security "Bad Credentials request" (as I would expect), but when I try to actually input corret credentials on the /oauth/token URI (through a POST method) I am met with an HTTP 404 error.</p>
  
  <p>My web.xml code.</p>
  
  <pre><code>&lt;context-param&gt;
      &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
      &lt;param-value&gt;
          classpath:spring-context.xml
          classpath:database-context.xml
          classpath:security-context.xml
      &lt;/param-value&gt;
  &lt;/context-param&gt;
  
  &lt;!-- RestEasy Bootstrap --&gt;
  &lt;listener&gt;
      &lt;listener-class&gt;org.jboss.resteasy.plugins.server.servlet.ResteasyBootstrap&lt;/listener-class&gt;
  &lt;/listener&gt;
  
  &lt;!-- Spring Bootstrap --&gt;
  &lt;listener&gt;
      &lt;listener-class&gt;org.springframework.web.context.request.RequestContextListener&lt;/listener-class&gt;
  &lt;/listener&gt;
  
  &lt;listener&gt;
      &lt;listener-class&gt;org.jboss.resteasy.plugins.spring.SpringContextLoaderListener&lt;/listener-class&gt;
  &lt;/listener&gt;
  
  &lt;!-- RestEasy Servlet --&gt;
  &lt;servlet&gt;
      &lt;servlet-name&gt;Resteasy&lt;/servlet-name&gt;
      &lt;servlet-class&gt;org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher&lt;/servlet-class&gt;
  &lt;/servlet&gt;
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;Resteasy&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/ws/*&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  
  &lt;!-- OAuth2 / Spring Security --&gt;
  &lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p></p>
  
  <p>And my security context. (which I found in an example here in stackoverflow and adapted a little)</p>
  
  <pre><code>&lt;oauth:authorization-server client-details-service-ref="clientDetails" token-services-ref="tokenServices"&gt;
      &lt;oauth:client-credentials /&gt;
  &lt;/oauth:authorization-server&gt;
  
  &lt;sec:authentication-manager alias="clientAuthenticationManager"&gt;
      &lt;sec:authentication-provider user-service-ref="clientDetailsUserService" /&gt;
  &lt;/sec:authentication-manager&gt;
  
  &lt;http pattern="/oauth/token" create-session="stateless"
          authentication-manager-ref="clientAuthenticationManager"
          xmlns="http://www.springframework.org/schema/security"&gt;
      &lt;intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" /&gt;
      &lt;anonymous enabled="false" /&gt;
      &lt;http-basic entry-point-ref="clientAuthenticationEntryPoint" /&gt;
  
      &lt;!-- include this only if you need to authenticate clients via request parameters --&gt;
      &lt;custom-filter ref="clientCredentialsTokenEndpointFilter" before="BASIC_AUTH_FILTER" /&gt;
      &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
  &lt;/http&gt;
  
  &lt;oauth:resource-server id="resourceServerFilter"
          resource-id="rest_server" token-services-ref="tokenServices" /&gt;
  
  &lt;oauth:client-details-service id="clientDetails"&gt;
      &lt;oauth:client client-id="the_client" authorized-grant-types="client_credentials" 
              authorities="ROLE_READ" secret="1234567890" /&gt;
      &lt;oauth:client client-id="password_client" authorized-grant-types="password" 
              authorities="ROLE_READ" secret="1234567890" /&gt;
  &lt;/oauth:client-details-service&gt;
  
  
  &lt;http pattern="/**" create-session="never"
          entry-point-ref="oauthAuthenticationEntryPoint"
          access-decision-manager-ref="accessDecisionManager"
          xmlns="http://www.springframework.org/schema/security"&gt;
      &lt;anonymous enabled="false" /&gt;
  
      &lt;intercept-url pattern="/ws/v1/oauth/**" access="ROLE_READ" method="GET" /&gt;
      &lt;custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" /&gt;
      &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
  &lt;/http&gt;
  
  &lt;bean id="tokenStore" class="org.springframework.security.oauth2.provider.token.InMemoryTokenStore" /&gt;
  
  &lt;bean id="tokenServices" class="org.springframework.security.oauth2.provider.token.DefaultTokenServices"&gt;
      &lt;property name="tokenStore" ref="tokenStore" /&gt;
      &lt;property name="supportRefreshToken" value="false" /&gt;
      &lt;property name="clientDetailsService" ref="clientDetails" /&gt;
      &lt;property name="accessTokenValiditySeconds" value="400000" /&gt;
      &lt;property name="refreshTokenValiditySeconds" value="0" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased"
          xmlns="http://www.springframework.org/schema/beans"&gt;
      &lt;constructor-arg&gt;
          &lt;list&gt;
              &lt;bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" /&gt;
              &lt;bean class="org.springframework.security.access.vote.RoleVoter" /&gt;
              &lt;bean class="org.springframework.security.access.vote.AuthenticatedVoter" /&gt;
          &lt;/list&gt;
      &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  
  
  &lt;bean id="oauthAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
      &lt;property name="realmName" value="theRealm" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="clientAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
      &lt;property name="realmName" value="theRealm/client" /&gt;
      &lt;property name="typeName" value="Basic" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="clientCredentialsTokenEndpointFilter" class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter"&gt;
      &lt;property name="authenticationManager" ref="clientAuthenticationManager" /&gt;
  &lt;/bean&gt;
  
  
  &lt;bean id="clientDetailsUserService" class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService"&gt;
      &lt;constructor-arg ref="clientDetails" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="oauthAccessDeniedHandler" class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" /&gt;
  
  
  &lt;sec:global-method-security pre-post-annotations="enabled" proxy-target-class="true"&gt;
      &lt;sec:expression-handler ref="oauthExpressionHandler" /&gt;
  &lt;/sec:global-method-security&gt;
  
  &lt;oauth:expression-handler id="oauthExpressionHandler" /&gt;
  
  &lt;oauth:web-expression-handler id="oauthWebExpressionHandler" /&gt;
  </code></pre>
  
  <p> </p>
  
  <p>I saw some similar problems where Spring Security was unable to register the http paths to the context because it wasn't being passed, but I have no idea how to do it in my Web.xml because I use SpringContextLoaderListener instead of ContextLoaderListener (which seems to be present in all the examples / problems I found).</p>
  
  <p>Any tips on how to get this 404 error to go away?</p>
  
  <p>EDIT - Just to clarify, I tested the /oauth/token URL with both POST and GET</p>
  
  <p>GET example:</p>
  
  <pre><code>http://127.0.0.1:9999/oauth/token?client_id=the_client&amp;client_secret=1234567890&amp;grant_type=client_credentials
  </code></pre>
  
  <p>In both cases I get the bad credentials / error 404</p>