title: uaa "InvalidClientException, Client ID mismatch"
body: <p>I cloned <a href="https://github.com/cloudfoundry/uaa" rel="nofollow noreferrer">https://github.com/cloudfoundry/uaa</a>, ran the server locally to test an authorization code flow.</p>
  
  <p>I'm getting a strange <code>InvalidClientException, Client ID mismatch</code> error when trying to exchange an authorization code for a token.</p>
  
  <p>My client is defined like this:</p>
  
  <pre><code>#!/bin/bash
  uaac client delete cfbrowser
  uaac client add cfbrowser -s exploradorcf\
       --authorities uaa.none\
       --authorized_grant_types authorization_code\
       --scope 'uaa.user cloud_controller.read cloud_controller.write\
   openid password.write scim.userids cloud_controller.admin scim.read scim.write'\
       --redirect_uri "http://localhost:1223/oauth/code-grant"
  </code></pre>
  
  <p>I can use the following curl command to successfully obtain a token, note this is using built-in client <code>login</code>:</p>
  
  <pre><code>curl 'http://localhost:8080/uaa/oauth/token' -i -X POST -H 'Accept: application/json'\
   -H 'Content-Type: application/x-www-form-urlencoded' \
   -d 'client_id=login&amp;client_secret=loginsecret&amp;grant_type=authorization_code&amp;response_type=token&amp;token_format=opaque&amp;redirect_uri=http%3A%2F%2Flocalhost%3A1223%2Foauth%2Fcode-grant&amp;code=nL3MPz'
  HTTP/1.1 200 OK
  Server: Apache-Coyote/1.1
  Cache-Control: no-store
  Pragma: no-cache
  X-XSS-Protection: 1; mode=block
  X-Frame-Options: DENY
  X-Content-Type-Options: nosniff
  Content-Type: application/json;charset=UTF-8
  Transfer-Encoding: chunked
  Date: Wed, 10 Aug 2016 17:50:27 GMT
  
  {"access_token":"206f1b38e6ee4cbe9ace51038a4a70ad","token_type":"bearer","refresh_token":"206f1b38e6ee4cbe9ace51038a4a70ad-r","expires_in":43199,"scope":"openid oauth.approvals","jti":"206f1b38e6ee4cbe9ace51038a4a70ad"}
  </code></pre>
  
  <p>If I change the client_id and client_secret:</p>
  
  <pre><code>curl 'http://localhost:8080/uaa/oauth/token' -i -X POST -H 'Accept: application/json'\
   -H 'Content-Type: application/x-www-form-urlencoded' \
   -d 'client_id=cfbrowser&amp;client_secret=exploradorcf&amp;grant_type=authorization_code&amp;response_type=token&amp;token_format=opaque&amp;redirect_uri=http%3A%2F%2Flocalhost%3A1223%2Foauth%2Fcode-grant&amp;code=nL3MPz'
  </code></pre>
  
  <p>I get "Client ID mismatch"</p>
  
  <pre><code>HTTP/1.1 401 Unauthorized
  Server: Apache-Coyote/1.1
  Cache-Control: no-store
  Pragma: no-cache
  WWW-Authenticate: Bearer error="invalid_client", error_description="Client ID mismatch"
  X-XSS-Protection: 1; mode=block
  X-Frame-Options: DENY
  X-Content-Type-Options: nosniff
  Content-Type: application/json;charset=UTF-8
  Transfer-Encoding: chunked
  Date: Wed, 10 Aug 2016 18:04:17 GMT
  
  {"error":"invalid_client","error_description":"Client ID mismatch"}
  </code></pre>
  
  <p>Looking at the uaa-server.log logs, I can see:</p>
  
  <pre><code>[2016-08-10 22:44:42.493] cloudfoundry-identity-server - ???? [http-nio-8080-exec-8] .... DEBUG --- UaaRequestMatcher: [loginAuthenticateRequestMatcher] Checking match of request : '/uaa/oauth/authorize'; '/uaa/authenticate' with parameters={} and headers {Authorization=[bearer ], accept=[application/json]}
  [2016-08-10 22:44:42.493] cloudfoundry-identity-server - ???? [http-nio-8080-exec-8] .... DEBUG --- UaaRequestMatcher: [loginAuthorizeRequestMatcher] Checking match of request : '/uaa/oauth/authorize'; '/uaa/oauth/authorize' with parameters={source=login} and headers {accept=[application/json]}
  [2016-08-10 22:44:42.494] cloudfoundry-identity-server - ???? [http-nio-8080-exec-8] .... DEBUG --- UaaRequestMatcher: [loginTokenRequestMatcher] Checking match of request : '/uaa/oauth/authorize'; '/uaa/oauth/token' with parameters={source=login, grant_type=password, add_new=} and headers {Authorization=[bearer ], accept=[application/json]}
  [2016-08-10 22:44:42.494] cloudfoundry-identity-server - ???? [http-nio-8080-exec-8] .... DEBUG --- UaaRequestMatcher: [loginAuthorizeRequestMatcherOld] Checking match of request : '/uaa/oauth/authorize'; '/uaa/oauth/authorize' with parameters={login={} and headers {accept=[application/json]}
  [2016-08-10 22:44:42.494] cloudfoundry-identity-server - ???? [http-nio-8080-exec-8] .... DEBUG --- UaaRequestMatcher: [passcodeTokenMatcher] Checking match of request : '/uaa/oauth/authorize'; '/uaa/oauth/token' with parameters={grant_type=password, passcode=} and headers {accept=[application/json, application/x-www-form-urlencoded]}
  [2016-08-10 22:44:42.494] cloudfoundry-identity-server - ???? [http-nio-8080-exec-8] .... DEBUG --- UaaRequestMatcher: [oauthAuthorizeRequestMatcher] Checking match of request : '/uaa/oauth/authorize'; '/uaa/oauth/authorize' with parameters={response_type=token, source=credentials} and headers {accept=[application/json, application/x-www-form-urlencoded]}
  [2016-08-10 22:44:42.494] cloudfoundry-identity-server - ???? [http-nio-8080-exec-8] .... DEBUG --- UaaRequestMatcher: [oauthAuthorizeApiRequestMatcher] Checking match of request : '/uaa/oauth/authorize'; '/uaa/oauth/authorize' with parameters={response_type=code, client_id=} and headers {Authorization=[bearer ]}
  [2016-08-10 22:44:42.494] cloudfoundry-identity-server - ???? [http-nio-8080-exec-8] .... DEBUG --- UaaRequestMatcher: [xOauthCallbackRequestMatcher] Checking match of request : '/uaa/oauth/authorize'; '/uaa/login/callback' with parameters={code=} and headers {}
  [2016-08-10 22:44:42.495] cloudfoundry-identity-server - ???? [http-nio-8080-exec-8] .... DEBUG --- UaaRequestMatcher: [oauthAuthorizeRequestMatcherOld] Checking match of request : '/uaa/oauth/authorize'; '/uaa/oauth/authorize' with parameters={response_type=token, credentials={} and headers {accept=[application/json, application/x-www-form-urlencoded]}
  [2016-08-10 22:44:42.495] cloudfoundry-identity-server - ???? [http-nio-8080-exec-8] .... DEBUG --- UaaRequestMatcher: [autologinAuthorizeRequestMatcher] Checking match of request : '/uaa/oauth/authorize'; '/uaa/oauth/authorize' with parameters={response_type=code, code=} and headers {}
  [2016-08-10 22:44:42.495] cloudfoundry-identity-server - ???? [http-nio-8080-exec-8] .... DEBUG --- UaaRequestMatcher: [autologinRequestMatcher] Checking match of request : '/uaa/oauth/authorize'; '/uaa/autologin' with parameters={code=} and headers {}
  [2016-08-10 22:44:42.499] cloudfoundry-identity-server - ???? [http-nio-8080-exec-8] .... DEBUG --- DisableIdTokenResponseTypeFilter: Processing id_token disable filter
  [2016-08-10 22:44:42.499] cloudfoundry-identity-server - ???? [http-nio-8080-exec-8] .... DEBUG --- DisableIdTokenResponseTypeFilter: pre id_token disable:false pathinfo:null request_uri:/uaa/oauth/authorize response_type:code
  [2016-08-10 22:44:42.499] cloudfoundry-identity-server - ???? [http-nio-8080-exec-8] .... DEBUG --- DisableIdTokenResponseTypeFilter: post id_token disable:false pathinfo:null request_uri:/uaa/oauth/authorize response_type:code
  [2016-08-10 22:44:42.500] cloudfoundry-identity-server - ???? [http-nio-8080-exec-8] .... DEBUG --- SecurityFilterChainPostProcessor$HttpsEnforcementFilter: Filter chain 'uiSecurity' processing request GET /uaa/oauth/authorize
  [2016-08-10 22:44:42.500] cloudfoundry-identity-server - ???? [http-nio-8080-exec-8] .... DEBUG --- SessionResetFilter: Evaluating user-id for session reset:a6350566-abd3-4cc5-89e5-5cd83a5f0d70
  [2016-08-10 22:44:42.513] cloudfoundry-identity-server - ???? [http-nio-8080-exec-8] .... DEBUG --- UserManagedAuthzApprovalHandler: Looking up user approved authorizations for client_id=login and username=marissa
  [2016-08-10 22:44:42.515] cloudfoundry-identity-server - ???? [http-nio-8080-exec-8] .... DEBUG --- JdbcApprovalStore: Filtering approvals with filter: [sql: (LOWER(user_id) = LOWER(:__wnq8ah_0) AND LOWER(client_id) = LOWER(:__wnq8ah_1)), params: {__wnq8ah_1=login, __wnq8ah_0=a6350566-abd3-4cc5-89e5-5cd83a5f0d70}]
  [2016-08-10 22:44:42.516] cloudfoundry-identity-server - ???? [http-nio-8080-exec-8] .... DEBUG --- UserManagedAuthzApprovalHandler: Valid user approved/denied scopes are [openid, oauth.approvals]
  [2016-08-10 22:44:42.518] cloudfoundry-identity-server - ???? [http-nio-8080-exec-8] .... DEBUG --- UaaTokenStore: [oauth_code] Removed 0 expired entries.
  [2016-08-10 22:44:42.519] cloudfoundry-identity-server - ???? [http-nio-8080-exec-8] .... DEBUG --- UaaTokenStore: [oauth_code] Removed 0 old entries.
  [2016-08-10 22:44:42.570] cloudfoundry-identity-server - ???? [http-nio-8080-exec-9] .... DEBUG --- UaaRequestMatcher: [loginAuthenticateRequestMatcher] Checking match of request : '/uaa/oauth/token'; '/uaa/authenticate' with parameters={} and headers {Authorization=[bearer ], accept=[application/json]}
  [2016-08-10 22:44:42.570] cloudfoundry-identity-server - ???? [http-nio-8080-exec-9] .... DEBUG --- UaaRequestMatcher: [loginAuthorizeRequestMatcher] Checking match of request : '/uaa/oauth/token'; '/uaa/oauth/authorize' with parameters={source=login} and headers {accept=[application/json]}
  [2016-08-10 22:44:42.571] cloudfoundry-identity-server - ???? [http-nio-8080-exec-9] .... DEBUG --- UaaRequestMatcher: [loginTokenRequestMatcher] Checking match of request : '/uaa/oauth/token'; '/uaa/oauth/token' with parameters={source=login, grant_type=password, add_new=} and headers {Authorization=[bearer ], accept=[application/json]}
  [2016-08-10 22:44:42.571] cloudfoundry-identity-server - ???? [http-nio-8080-exec-9] .... DEBUG --- UaaRequestMatcher: [loginAuthorizeRequestMatcherOld] Checking match of request : '/uaa/oauth/token'; '/uaa/oauth/authorize' with parameters={login={} and headers {accept=[application/json]}
  [2016-08-10 22:44:42.571] cloudfoundry-identity-server - ???? [http-nio-8080-exec-9] .... DEBUG --- UaaRequestMatcher: [passcodeTokenMatcher] Checking match of request : '/uaa/oauth/token'; '/uaa/oauth/token' with parameters={grant_type=password, passcode=} and headers {accept=[application/json, application/x-www-form-urlencoded]}
  [2016-08-10 22:44:42.573] cloudfoundry-identity-server - ???? [http-nio-8080-exec-9] .... DEBUG --- DisableIdTokenResponseTypeFilter: Processing id_token disable filter
  [2016-08-10 22:44:42.573] cloudfoundry-identity-server - ???? [http-nio-8080-exec-9] .... DEBUG --- DisableIdTokenResponseTypeFilter: pre id_token disable:false pathinfo:null request_uri:/uaa/oauth/token response_type:token
  [2016-08-10 22:44:42.574] cloudfoundry-identity-server - ???? [http-nio-8080-exec-9] .... DEBUG --- DisableIdTokenResponseTypeFilter: post id_token disable:false pathinfo:null request_uri:/uaa/oauth/token response_type:token
  [2016-08-10 22:44:42.574] cloudfoundry-identity-server - ???? [http-nio-8080-exec-9] .... DEBUG --- SecurityFilterChainPostProcessor$HttpsEnforcementFilter: Filter chain 'tokenEndpointSecurity' processing request POST /uaa/oauth/token
  [2016-08-10 22:44:42.575] cloudfoundry-identity-server - ???? [http-nio-8080-exec-9] ....  INFO --- Audit: ClientAuthenticationSuccess ('Client authentication success'): principal=cfbrowser, origin=[remoteAddress=127.0.0.1, clientId=cfbrowser], identityZoneId=[uaa]
  [2016-08-10 22:44:42.585] cloudfoundry-identity-server - ???? [http-nio-8080-exec-9] .... DEBUG --- UaaTokenStore: [oauth_code] Removed 0 expired entries.
  [2016-08-10 22:44:42.586] cloudfoundry-identity-server - ???? [http-nio-8080-exec-9] .... DEBUG --- UaaTokenStore: [oauth_code] Removed 0 old entries.
  [2016-08-10 22:44:42.589] cloudfoundry-identity-server - ???? [http-nio-8080-exec-9] ....  INFO --- TokenEndpoint: Handling error: InvalidClientException, Client ID mismatch
  </code></pre>
  
  <p>So I don't see anything wrong with the client id from the logs.</p>
  
  <p>Comparing the 2 clients:</p>
  
  <pre><code>$ uaac client get login
    scope: openid oauth.approvals
    client_id: login
    resource_ids: none
    authorized_grant_types: client_credentials authorization_code refresh_token
    autoapprove: true
    authorities: clients.read emails.write scim.userids password.write idps.write
        notifications.write oauth.login scim.write critical_notifications.write
    lastmodified: 1470892674539
  $ uaac client get cfbrowser
    scope: cloud_controller.read password.write scim.userids cloud_controller.write
        openid scim.write scim.read uaa.user cloud_controller.admin
    client_id: cfbrowser
    resource_ids: none
    authorized_grant_types: authorization_code refresh_token
    redirect_uri: http://localhost:1223/oauth/code-grant
    autoapprove: 
    authorities: uaa.none
    name: cfbrowser
    lastmodified: 1470894239209
  </code></pre>
  
  <p>Doesn't tell me anything interesting.</p>
  
  <ul>
  <li>I tried searching for the "Client ID mismatch" string within the
  source, hoping to add some print statements around the code logging
  the error, but couldn't find it within
  <a href="https://github.com/cloudfoundry/uaa" rel="nofollow noreferrer">https://github.com/cloudfoundry/uaa</a></li>
  <li>I tried using jdb to debug the entire server, but ran into this
  <a href="https://stackoverflow.com/questions/38887959/debug-gradle-built-project-with-jdb">jdb+gradle problem</a>.</li>
  <li>I did a general search for "Client ID mismatch", I found it most
  likely comes from the spring-security-oauth project <a href="https://github.com/semantico/spring-security-oauth/blob/6b4faa6ea467c93c968016696a7eafb209e145d4/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/code/AuthorizationCodeTokenGranter.java#L84" rel="nofollow noreferrer">here</a>:</li>
  </ul>
  
  <p>code:</p>
  
  <pre><code>if (clientId != null &amp;&amp; !clientId.equals(unconfirmedAuthorizationRequest.getClientId())) {
              // just a sanity check.
              throw new InvalidClientException("Client ID mismatch");
  }
  </code></pre>
  
  <p>So I tried cloning and building that project to <code>mvn install</code> locally, again hoping to log what is
  <code>clientId</code> compared to <code>unconfirmedAuthorizationRequest.getClientId()</code>, but <a href="https://github.com/semantico/spring-security-oauth/issues/1" rel="nofollow noreferrer">wasn't able to build</a>:</p>
  
  <p>I feel I've exhausted most of what I can think of for self-help. My questions are:</p>
  
  <ol>
  <li>Why am I getting this "Client ID mismatch"?</li>
  <li>What is the java source class and method producing this error and log?</li>
  <li>What other steps should I have taken for debugging this issue myself?</li>
  </ol>