title: How to configure oAuth2 with password flow with Swagger ui in spring boot rest application
body: <p>I have spring boot rest api (resources) which uses another spring boot authorisation server, I have added Swagger config to the resource application to get a nice and quick documentation/test platform for the rest API. my Swagger config looks like this:</p>
  
  <pre><code>@Configuration
  @EnableSwagger2
  public class SwaggerConfig {    
  
      @Autowired
      private TypeResolver typeResolver;
  
      @Value("${app.client.id}")
      private String clientId;
      @Value("${app.client.secret}")
      private String clientSecret;
      @Value("${info.build.name}")
      private String infoBuildName;
  
      public static final String securitySchemaOAuth2 = "oauth2";
      public static final String authorizationScopeGlobal = "global";
      public static final String authorizationScopeGlobalDesc = "accessEverything";
  
      @Bean
      public Docket api() { 
  
          List&lt;ResponseMessage&gt; list = new java.util.ArrayList&lt;ResponseMessage&gt;();
          list.add(new ResponseMessageBuilder()
                  .code(500)
                  .message("500 message")
                  .responseModel(new ModelRef("JSONResult«string»"))
                  .build());
          list.add(new ResponseMessageBuilder()
                  .code(401)
                  .message("Unauthorized")
                  .responseModel(new ModelRef("JSONResult«string»"))
                  .build());
  
  
          return new Docket(DocumentationType.SWAGGER_2)  
            .select()                                  
            .apis(RequestHandlerSelectors.any())              
            .paths(PathSelectors.any())     
            .build()
            .securitySchemes(Collections.singletonList(securitySchema()))
            .securityContexts(Collections.singletonList(securityContext()))
            .pathMapping("/")
            .directModelSubstitute(LocalDate.class,String.class)
            .genericModelSubstitutes(ResponseEntity.class)
            .alternateTypeRules(
                newRule(typeResolver.resolve(DeferredResult.class,
                        typeResolver.resolve(ResponseEntity.class, WildcardType.class)),
                    typeResolver.resolve(WildcardType.class)))
            .useDefaultResponseMessages(false)
            .apiInfo(apiInfo())
            .globalResponseMessage(RequestMethod.GET,list)
            .globalResponseMessage(RequestMethod.POST,list);
      }
  
  
      private OAuth securitySchema() {
  
          List&lt;AuthorizationScope&gt; authorizationScopeList = newArrayList();
          authorizationScopeList.add(new AuthorizationScope("global", "access all"));
  
          List&lt;GrantType&gt; grantTypes = newArrayList();
          final TokenRequestEndpoint tokenRequestEndpoint = new TokenRequestEndpoint("http://server:port/oauth/token", clientId, clientSecret);
          final TokenEndpoint tokenEndpoint = new TokenEndpoint("http://server:port/oauth/token", "access_token");
          AuthorizationCodeGrant authorizationCodeGrant = new AuthorizationCodeGrant(tokenRequestEndpoint, tokenEndpoint);
  
          grantTypes.add(authorizationCodeGrant);
  
          OAuth oAuth = new OAuth("oauth", authorizationScopeList, grantTypes);
  
          return oAuth;
      }
  
  
      private SecurityContext securityContext() {
          return SecurityContext.builder().securityReferences(defaultAuth())
                  .forPaths(PathSelectors.ant("/api/**")).build();
      }
  
      private List&lt;SecurityReference&gt; defaultAuth() {
  
          final AuthorizationScope authorizationScope =
                  new AuthorizationScope(authorizationScopeGlobal, authorizationScopeGlobalDesc);
          final AuthorizationScope[] authorizationScopes = new AuthorizationScope[1];
          authorizationScopes[0] = authorizationScope;
          return Collections
                  .singletonList(new SecurityReference(securitySchemaOAuth2, authorizationScopes));
      }
  
  
  
      private ApiInfo apiInfo() {
          return new ApiInfoBuilder()
                  .title(“My rest API")
                  .description(" description here … ”)
                  .termsOfServiceUrl("https://www.example.com/")
                  .contact(new Contact(“XXXX XXXX”,
                                       "http://www.example.com", “xxxx@example.com”))
                  .license("license here”)
                  .licenseUrl("https://www.example.com")
                  .version("1.0.0")
                  .build();
      }
  
  }
  </code></pre>
  
  <p>The way I get the access token from the Authorisation server is by using http POST to this link with basic authorisation in the header for clientid/clientpass:</p>
  
  <pre><code>http://server:port/oauth/token?grant_type=password&amp;username=&lt;username&gt;&amp;password=&lt;password&gt;
  </code></pre>
  
  <p>the response is something like:</p>
  
  <pre><code>{
      "access_token": "e3b98877-f225-45e2-add4-3c53eeb6e7a8",
      "token_type": "bearer",
      "refresh_token": "58f34753-7695-4a71-c08a-d40241ec3dfb",
      "expires_in": 4499,
      "scope": "read trust write"
  }
  </code></pre>
  
  <p>in Swagger UI I can see an Authorisation button, which opens a dialog to make the authorisation request, but it is not working and directing me to a link as following, </p>
  
  <pre><code>http://server:port/oauth/token?response_type=code&amp;redirect_uri=http%3A%2F%2Fserver%3A8080%2Fwebjars%2Fspringfox-swagger-ui%2Fo2c.html&amp;realm=undefined&amp;client_id=undefined&amp;scope=global%2CvendorExtensions&amp;state=oauth
  </code></pre>
  
  <p>what I am missing here?</p>
  
  <p><a href="https://i.stack.imgur.com/Y9tiL.jpg" rel="noreferrer"><img src="https://i.stack.imgur.com/Y9tiL.jpg" alt="Swagger UI has an Authorisation button"></a></p>