title: Spring Oauth2 Authorization server User Info Endpoint with multiple grant_type not working
body: <p>I've authorization server which has inbuilt DB Authentication manager. Here are the configurations.</p>
  <p><strong>AuthConfig.java</strong></p>
  <pre class="lang-java prettyprint-override"><code>@Configuration
  @EnableAuthorizationServer
  public class AuthConfig extends AuthorizationServerConfigurerAdapter {
      @Autowired
      @Qualifier(&quot;authenticationManagerBean&quot;)
      private AuthenticationManager authenticationManager;
  
      @Autowired
      private PasswordEncoder passwordEncoder;
  
      @Autowired
      private DataSource dataSource;
      
  
      @Override
      public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
          clients.jdbc(dataSource).passwordEncoder(passwordEncoder).jdbc();
      }
  
      @Override
      public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
          endpoints.authenticationManager(authenticationManager)
                   .tokenStore(tokenStore());
      }
  
      @Bean
      public TokenStore tokenStore() {
          return new InMemoryTokenStore();
      }
  }
  </code></pre>
  <p><strong>ResourceConfig.java</strong></p>
  <pre class="lang-java prettyprint-override"><code>@Configuration
  @EnableResourceServer
  public class ResourceConfig extends ResourceServerConfigurerAdapter {
      @Override
      public void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests().antMatchers(&quot;/**&quot;).permitAll().and().authorizeRequests().antMatchers(&quot;/userinfo&quot;).authenticated();
      }
  }
  </code></pre>
  <p><strong>SecurityConfig.java</strong></p>
  <pre class="lang-java prettyprint-override"><code>@Configuration
  @EnableWebSecurity
  //@Order(SecurityProperties.IGNORED_ORDER) // If added grant_type password does not work
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
      @Autowired
      private DataSource dataSource;
  
      @Override
      public void configure(WebSecurity web) throws Exception {
          web.ignoring().antMatchers(&quot;/resources/**&quot;);
      }
  
      @Override
      @Bean
      public AuthenticationManager authenticationManagerBean() throws Exception {
          return super.authenticationManagerBean();
      }
  
      // @formatter:off
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests().antMatchers(&quot;/userinfo&quot;).authenticated().and().authorizeRequests()
                  .antMatchers(&quot;/login&quot;, &quot;/oauth/token&quot;, &quot;/oauth/**&quot;).permitAll().and().formLogin().and().csrf().disable()
                  .cors().disable();
      }
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
  
          auth.jdbcAuthentication().dataSource(dataSource).passwordEncoder(passwordEncoder())
                  .usersByUsernameQuery(&quot;select username,password,enabled from TBL_USERS where username = ?&quot;)
                  .authoritiesByUsernameQuery(
                          &quot;select username, role as authority from TBL_USER_ROLES where username = ?&quot;);
      }
  
      @Bean
      public PasswordEncoder passwordEncoder() {
          return new BCryptPasswordEncoder(4);
      }
  }
  </code></pre>
  <p><strong>UserInfo.java</strong></p>
  <pre class="lang-java prettyprint-override"><code>@RestController
  public class UserInfo {
  
      @GetMapping(value=&quot;/userinfo&quot;)
      public Map&lt;String, Object&gt; user(@AuthenticationPrincipal Principal principal) {
          if (principal != null) {
             return Map.of(&quot;name&quot;, principal.getName(), &quot;authorities&quot;, SecurityContextHolder.getContext().getAuthentication().getAuthorities());
          }
          return null;
      }
  }
  </code></pre>
  <p>Though the above code snippet works for grant_type=&quot;password&quot; and other resource server able to retrieve the userinfo for client validation. However when I use <code>grant_type=&quot;implicit&quot;</code> authorization server unable to redirect to login page getting authentication error, stack trace added below.</p>
  <pre class="lang-java prettyprint-override"><code>2019-03-11 23:30:16.442 DEBUG 16401 --- [nio-8080-exec-4] o.s.s.w.a.i.FilterSecurityInterceptor    : Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@a265b6db: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@380f4: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: 588FF6DC19A9313BFD6DA9E05BE589DC; Granted Authorities: ROLE_ANONYMOUS
  2019-03-11 23:30:16.443 DEBUG 16401 --- [nio-8080-exec-4] o.s.s.access.vote.AffirmativeBased       : Voter: org.springframework.security.web.access.expression.WebExpressionVoter@7f86e65e, returned: 1
  2019-03-11 23:30:16.443 DEBUG 16401 --- [nio-8080-exec-4] o.s.s.w.a.i.FilterSecurityInterceptor    : Authorization successful
  2019-03-11 23:30:16.443 DEBUG 16401 --- [nio-8080-exec-4] o.s.s.w.a.i.FilterSecurityInterceptor    : RunAsManager did not change Authentication object
  2019-03-11 23:30:16.443 DEBUG 16401 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy        : /oauth/authorize?response_type=token&amp;state=&amp;client_id=client_2&amp;scope=&amp;redirect_uri=http%3A%2F%2Flocalhost%3A8182%2Fresource2 reached end of additional filter chain; proceeding with original chain
  2019-03-11 23:30:16.444 DEBUG 16401 --- [nio-8080-exec-4] .s.o.p.e.FrameworkEndpointHandlerMapping : Mapped to public org.springframework.web.servlet.ModelAndView org.springframework.security.oauth2.provider.endpoint.AuthorizationEndpoint.authorize(java.util.Map&lt;java.lang.String, java.lang.Object&gt;,java.util.Map&lt;java.lang.String, java.lang.String&gt;,org.springframework.web.bind.support.SessionStatus,java.security.Principal)
  2019-03-11 23:30:16.449 DEBUG 16401 --- [nio-8080-exec-4] o.s.s.w.a.ExceptionTranslationFilter     : Authentication exception occurred; redirecting to authentication entry point
  
  org.springframework.security.authentication.InsufficientAuthenticationException: User must be authenticated with Spring Security before authorization can be completed.
      at org.springframework.security.oauth2.provider.endpoint.AuthorizationEndpoint.authorize(AuthorizationEndpoint.java:143) ~[spring-security-oauth2-2.3.4.RELEASE.jar:na]
      at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:na]
      at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:na]
      at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:na]
      at java.base/java.lang.reflect.Method.invoke(Method.java:566) ~[na:na]
      at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:189) ~[spring-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
      at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:138) ~[spring-web-5.1.5.RELEASE.jar:5.1.5.RELEASE]
      at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:102) ~[spring-webmvc-5.1.5.RELEASE.jar:5.1.5.RELEASE]
      at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:895) ~[spring-webmvc-5.1.5.RELEASE.jar:5.1.5.RELEASE]
      at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:800) ~[spring-webmvc-5.1.5.RELEASE.jar:5.1.5.RELEASE]
      at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87) ~[spring-webmvc-5.1.5.RELEASE.jar:5.1.5.RELEASE]
      at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1038) ~[spring-webmvc-5.1.5.RELEASE.jar:5.1.5.RELEASE]
      at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:942) ~[spring-webmvc-5.1.5.RELEASE.jar:5.1.5.RELEASE]
      at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1005) ~[spring-webmvc-5.1.5.RELEASE.jar:5.1.5.RELEASE]
      at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:897) ~[spring-webmvc-5.1.5.RELEASE.jar:5.1.5.RELEASE]
      at javax.servlet.http.HttpServlet.service(HttpServlet.java:634) ~[tomcat-embed-core-9.0.16.jar:9.0.16]
  </code></pre>
  <p>Some of alternatives I had tried are, remove ResourceConfig class, in this case Principal object remains null(probably because no filter to extract token is registered) and another approach I used is that In SecurityConfig add Highest order, in this case though implicit authorization works, password authorization does not work</p>
  <p><strong>How to enable userInfo endpoint with all grant_types?</strong></p>