title: Problems redirecting to access token entry point Oauth Token
body: <p>I am having problems with redirecting to access token entry point /oauth/token which will detail bellow. I am hoping someone could give me some light to it as I took a lot of time
  implementing this.</p>
  
  <p>Also, interesting is the fact that I cannot test with with SoapUI 5.0 community edition even following their instructions. It gest the authorization code but fails later as you need to set the redirect URI as "urn:ietf:wg:oauth:2.0:oob".</p>
  
  <p>Since Spring-Security-Oauth2 lacks a lot of good documentation and I had spent lots of time debugging and documenting the work I decided to share
  my comments and configuration code here which might also be helpfull to someone else.</p>
  
  <p>I am using the following dependencies versions on my pom:</p>
  
  <pre><code>&lt;org.springframework-version&gt;4.0.5.RELEASE&lt;/org.springframework-version&gt;
  &lt;org.springframework.security-version&gt;3.2.5.RELEASE&lt;/org.springframework.security-version&gt;
  &lt;org.springframework.security.oauth2-version&gt;2.0.3.RELEASE&lt;/org.springframework.security.oauth2-version&gt;
  </code></pre>
  
  <p>Now, the idea was to implement all the clientId objects, UserPrincipal, access, nonce and token stores using Cassandra as a persistency store. All those components
  are working perfectly and are tested. In fact, it fetches all the authentication/authorization, creates authorization codes.</p>
  
  <p>I've seen a bug recently on testing JDBC stores on Spring Oauth2 github but that was related to testing not the actuall implementation, specially because not
  using JDBC.</p>
  
  <p>I have wrote a client webapplication to access a REST resource which resides with the OAuth2 servers and Spring Security for logging in. All goes well until I go request
  an access token to /oauth/token.</p>
  
  <p>When I hit the secure Rest service first it properly starting doing redirections and goes tru DefaultOAuth2RequestFactory createAuthorizationRequest() method. Loads
  the ClientDetails object perfectly with the secret etc from the store. So it has all the scopes, grants etc for the Oauth2 client. It also validates properly the redirectURIParameter
  and resolves the redirect. Then it goes to the TokenStoreUserApprovalHandler and create the OAuth2Request object. Then, of course, tries to find an existing access token which
  does not exist yet on the workflow. It creates the authenticationkey from authenticationKeyGenerator and queries the store which properly returns null at this point.
  Then it redirects back to /oauth/authorize twice when on the second time it has an authorization code and marks as approved (AuthorizationEndPoint) inside approveOrDeny() method.
  The authorizationCodeServices creates the code and stores it properly in my Cassandra store.</p>
  
  <p>At this point it calls (<code>AuthorizationEndPoint</code>) <code>getSuccessfulRedirect()</code> where it adds the state parameter to the template.</p>
  
  <p>Then it calls (<code>OAuth2RestTemplate</code> class) <code>getAccessToken()</code> method. Since the access token is fine and valid it then calls <code>acquireAccessToken()</code> which returns an <code>accessTokenRequest</code> with
  <code>{code=[Q19Y6u], state=[1PyzHf]}</code> . Then it calls the <code>accessTokenProvider</code> to obtain an access token at <code>obtainAccessToken()</code>. Then the calls <code>OAuth2AccessTokenSupport</code> is called at 
  <code>retrieveToken()</code> method. And fails at <code>getRestTemplate</code>. The <code>AuthorizationCodeResourceDetails</code> is created perfectly with grant type <code>authorization_code</code> and it has both <code>authorizationScheme</code>
  and <code>clientAuthenticationScheme</code> as header. The <code>clientId</code> is correct as the <code>clientSecret</code>. The id of the <code>AuthorizationCodeResourceDetails</code> is <code>oAuth2ClientBean</code> and the <code>userAuthorizationURI</code> is
  <code>http://myhost.com:8080/MyAPI/oauth/authorize</code>. Headers show as </p>
  
  <pre><code>{Authorization=[Basic .....]}
  </code></pre>
  
  <p>The extractor is <code>org.springframework.security.oauth2.client.token.OAuth2AccessTokenSupport</code>. 
  The form is <code>{grant_type=[authorization_code], code=[Xc7yni], redirect_uri=[http://myhost.com:8080/OAuthClient/support]}</code></p>
  
  <p>And then the application freezes and it shows on the logs:</p>
  
  <pre><code>DEBUG: org.springframework.security.authentication.DefaultAuthenticationEventPublisher - No event was found for the exception org.springframework.security.authentication.InternalAuthenticationServiceException
  DEBUG: org.springframework.security.web.authentication.www.BasicAuthenticationFilter - Authentication request for failed: org.springframework.security.authentication.InternalAuthenticationServiceException
  </code></pre>
  
  <p>Then I have the following Exception on my client web application:</p>
  
  <pre><code>org.springframework.web.util.NestedServletException: Request processing failed; nested exception is error="access_denied", error_description="Error requesting access token."
      org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:973)
      org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:852)
      javax.servlet.http.HttpServlet.service(HttpServlet.java:618)
      org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:837)
  </code></pre>
  
  <p>Now, I believe I have a few things wrong on my xml configuration for OAuth2 and Spring Security. So the configuration file follows.</p>
  
  <p>I do have a few questions concerning it so here are the questions first:</p>
  
  <p>1) <code>&lt;oauth2:authorization-server&gt;</code> I am not sure if I had this configured correctly. Please look at the comments I have on my xml file.
  I have added the authorization-request-manager-ref parameter which points to my userAuthenticationManager bean, a authentication manager
  which takes a authentication-provider user-service-ref="userService"</p>
  
  <pre><code>&lt;oauth2:authorization-server client-details-service-ref="webServiceClientService" 
      token-services-ref="tokenServices" user-approval-page="/oauth/userapproval" 
      error-page="/oauth/error" authorization-endpoint-url="/oauth/authorize" 
      token-endpoint-url="/oauth/token" user-approval-handler-ref="userApprovalHandler" 
      redirect-resolver-ref="resolver"&gt;
      &lt;oauth2:authorization-code
          authorization-code-services-ref="codes" /&gt;
      &lt;oauth2:implicit/&gt;
      &lt;oauth2:refresh-token/&gt;
      &lt;oauth2:client-credentials/&gt;
      &lt;oauth2:password authentication-manager-ref="userAuthenticationManager"/&gt;
      &lt;!-- &lt;oauth2:custom-grant token-granter-ref=""/&gt; --&gt;
  &lt;/oauth2:authorization-server&gt;
  </code></pre>
  
  <p>2) authentication-manager oauthClientAuthenticationManager is used when "/oauth/token" is intercepted.
  This is defined as follows:</p>
  
  <pre><code>&lt;sec:authentication-manager id="oauthClientAuthenticationManager"&gt;
      &lt;sec:authentication-provider user-service-ref="clientDetailsUserService"&gt;
          &lt;sec:password-encoder ref="passwordEncoder" /&gt;
      &lt;/sec:authentication-provider&gt;
  &lt;/sec:authentication-manager&gt;
  </code></pre>
  
  <p>3) I have the following methodSecurityExpressionHandler bean defined which is used at sec:global-method-security.
  Not sure if this is correct or not as well.</p>
  
  <pre><code>&lt;beans:bean id="methodSecurityExpressionHandler"
          class="org.springframework.security.oauth2.provider.expression.OAuth2MethodSecurityExpressionHandler" /&gt;
  </code></pre>
  
  <p>4) I also have a bean "clientCredentialsTokenEndpointFilter" which I believe is not recommended.
  I use this as a custom-filter for entry point "/oauth/token" but I believe this is wrong. </p>
  
  <pre><code>&lt;beans:bean id="clientCredentialsTokenEndpointFilter" class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter"&gt;
      &lt;beans:property name="authenticationManager" ref="oauthClientAuthenticationManager"/&gt;
  &lt;/beans:bean&gt;
  A filter and authentication endpoint for the OAuth2 Token Endpoint. Allows clients to authenticate using request
  parameters if included as a security filter, as permitted by the specification (but not recommended). It is
  recommended by the specification that you permit HTTP basic authentication for clients, and not use this filter at
  all.
  </code></pre>
  
  <p>5) Now for the Oauth Token Endpoint:
      This is the endpoint /oauth/token as I have many questions here:</p>
  
  <ol>
  <li>This is never reached.</li>
  <li>Shall I have a custom-filter like <code>clientCredentialsTokenEndpointFilter</code> to it or not?</li>
  <li>Do I have to have a http-basic entry point?</li>
  <li>Shall I have an access attribute as in <code>IS_AUTHENTICATED_FULLY</code> or can I use an authority I have defined on my <code>UserPrincipal</code> object such as <code>OAUTH_CLIENT</code> I have added there?</li>
  <li>What about the session? Shall I say "stateless" or
  "never"</li>
  <li>Shall I add the <code>corsFilter</code> to it as well?</li>
  <li>Is the    entry point correct?  Which is the <code>OAuth2AuthenticationEntryPoint</code> class?</li>
  <li>Do I have to add the csrf token? I believe not as it will
  restrict it more.</li>
  <li>Is the expression-handler correct as a <code>org.springframework.security.oauth2.provider.expression.OAuth2WebSecurityExpressionHandle</code>?</li>
  <li>The authentication-manager-ref I can change from <code>oauthClientAuthenticationManager</code> to <code>userAuthenticationManager</code>.</li>
  </ol>
  
  <p><code>
       &lt;sec:http use-expressions="true" create-session="stateless"
          authentication-manager-ref="userAuthenticationManager"
          entry-point-ref="oauthAuthenticationEntryPoint" pattern="/oauth/token"&gt;
          &lt;sec:intercept-url pattern="/oauth/token" access="hasAuthority('OAUTH_CLIENT')" /&gt;
          &lt;!-- &lt;sec:intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" /&gt; --&gt;
          &lt;sec:http-basic entry-point-ref="oauthAuthenticationEntryPoint"/&gt;
          &lt;!--     &lt;sec:http-basic/&gt; --&gt;
          &lt;sec:anonymous enabled="false" /&gt;
          &lt;sec:custom-filter ref="clientCredentialsTokenEndpointFilter" after="BASIC_AUTH_FILTER" /&gt;
          &lt;sec:access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
          &lt;sec:expression-handler ref="webSecurityExpressionHandler" /&gt;
          &lt;!-- &lt;sec:custom-filter ref="corsFilter" after="LAST"/&gt; --&gt;
      &lt;/sec:http&gt;
  </code></p>
  
  <p>I would like to add the full config file here but there is a limit.</p>