title: Grails OAuth2 signin Password Credentials Grant returns invalid_client
body: <p>I am working on a basic grails app protected by OAuth2 authentication -- <a href="https://github.com/adeady/api-gateway-spring/tree/master/grails-oauth-service" rel="nofollow">code here</a>.  It is nothing more than what spring-security and spring-security-oauth plugins have for a getting started app.  In my bootstrap I have (as per getting started):</p>
  
  <pre><code>Role roleUser = new Role(authority: 'ROLE_USER').save(flush: true)
  
  User user = new User(
          username: 'user',
          password: 'password',
          enabled: true,
          accountExpired: false,
          accountLocked: false,
          passwordExpired: false
  ).save(flush: true)
  
  UserRole.create(user, roleUser, true)
  
  new Client(
          clientId: 'my-client',
          authorizedGrantTypes: ['authorization_code', 'refresh_token', 'implicit', 'password', 'client_credentials'],
          authorities: ['ROLE_CLIENT'],
          scopes: ['read', 'write'],
              redirectUris: ['http://example.com']
  ).save(flush: true)
  </code></pre>
  
  <p>I am trying to understand the OAuth login flow following the example flows listed in the <a href="http://bluesliverx.github.io/grails-spring-security-oauth2-provider/guide/single.html#exampleFlows" rel="nofollow">documentation</a>.  </p>
  
  <p>Whenever I try to authenticate using the <a href="http://bluesliverx.github.io/grails-spring-security-oauth2-provider/guide/single.html#password" rel="nofollow">"Resource Owner Password Credentials Grant"</a> with this request: </p>
  
  <pre><code>$ curl -X POST -d "client_id=my-client" \
      -d "grant_type=password" -d "username=user" \
      -d "password=password" -d "scope=read" \
       http://localhost:9090/grails-oauth-service/oauth/token
  </code></pre>
  
  <p>I get the following message:</p>
  
  <pre><code>{"error":"invalid_client","error_description":"Bad client credentials"}
  </code></pre>
  
  <p>What am I doing wrong?  How would I (or my client) correctly make a single call to authenticate to the service?</p>