title: "Full authentication is required to access this resource" on spring oauth2 authorization server on /oauth/token request
body: <p>I'm trying to create a page that will hold some user data that may be accessed through some client webpage. That brought me to oauth2 (authorization code) and Spring. Currently I'm working on some kind of proof of concept for this basing my code on <a href="https://github.com/dynamind/spring-boot-security-oauth2-minimal/" rel="nofollow">https://github.com/dynamind/spring-boot-security-oauth2-minimal/</a> and this workflow <a href="https://techannotation.files.wordpress.com/2015/06/oauth2-0-authorization-code.png" rel="nofollow">https://techannotation.files.wordpress.com/2015/06/oauth2-0-authorization-code.png</a></p>
  
  <p>I already have a resource server that uses login page for authentication of users and then gives them a possibility of some kind of approval for sharing their data. Then it redirects user to a page set up for client.</p>
  
  <pre><code>@SpringBootApplication
  public class AuthorizationServerApplication extends SpringBootServletInitializer {
  
      private static final Logger log = LoggerFactory.getLogger(AuthorizationServerApplication.class);
  
      public static void main(String[] args) {
          ApplicationContext context = SpringApplication.run(AuthorizationServerApplication.class, args);
      }
  
      @Override
      protected SpringApplicationBuilder configure(SpringApplicationBuilder application) {
          return application.sources(AuthorizationServerApplication.class);
      }
  
      @Configuration
      @EnableWebSecurity
      @EnableGlobalMethodSecurity(prePostEnabled = true)
      protected static class SecurityConfig extends WebSecurityConfigurerAdapter {
  
          @Override
          @Autowired // &lt;-- This is crucial otherwise Spring Boot creates its own
          protected void configure(AuthenticationManagerBuilder auth) throws Exception {
              log.info("Defining inMemoryAuthentication (2 users)");
              auth.inMemoryAuthentication()
  
                      .withUser("user").password("password").roles("USER")
  
                      .and()
  
                      .withUser("admin").password("password").roles("USER", "ADMIN");
          }
  
          @Override
          protected void configure(HttpSecurity http) throws Exception {
              http.formLogin()
  
                      .and()
  
                      .httpBasic().disable().anonymous().disable().authorizeRequests().anyRequest().authenticated();
          }
      }
  
      @Configuration
      @EnableAuthorizationServer
      protected static class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
  
          @Value("${config.oauth2.privateKey}")
          private String privateKey;
  
          @Value("${config.oauth2.publicKey}")
          private String publicKey;
  
          @Autowired
          private AuthenticationManager authenticationManager;
  
          @Bean
          public JwtAccessTokenConverter tokenEnhancer() {
              log.info("Initializing JWT with public key:\n" + publicKey);
              JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
              converter.setSigningKey(privateKey);
              converter.setVerifierKey(publicKey);
              return converter;
          }
  
          @Bean
          public JwtTokenStore tokenStore() {
              return new JwtTokenStore(tokenEnhancer());
          }
  
          /**
           * Defines the security constraints on the token endpoints
           * /oauth/token_key and /oauth/check_token Client credentials are
           * required to access the endpoints
           *
           * @param oauthServer
           * @throws Exception
           */
          @Override
          public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
              oauthServer.tokenKeyAccess("isAnonymous() || hasRole('ROLE_TRUSTED_CLIENT')") // permitAll()
                      .checkTokenAccess("hasRole('TRUSTED_CLIENT')"); // isAuthenticated()
          }
  
          /**
           * Defines the authorization and token endpoints and the token services
           *
           * @param endpoints
           * @throws Exception
           */
          @Override
          public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
              endpoints
  
                      // Which authenticationManager should be used for the
                      // password grant
                      // If not provided, ResourceOwnerPasswordTokenGranter is not
                      // configured
                      .authenticationManager(authenticationManager)
  
                      // Use JwtTokenStore and our jwtAccessTokenConverter
                      .tokenStore(tokenStore()).accessTokenConverter(tokenEnhancer());
          }
  
          @Override
          public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
              clients.inMemory()
  
                      // Public client where client secret is vulnerable (e.g.
                      // mobile apps, browsers)
                      .withClient("clientname") // No secret!
                      .authorizedGrantTypes("authorization_code").scopes("read")
                      .redirectUris("http://localhost:8080/client")
  
              ;
          }
  
      }
  
  }
  </code></pre>
  
  <p>Currently I'm dealing with a simplest possible client webpage. I created a page with link to authorization server (localhost:8081/oauth/authorize...). User clicks on it and is redirected to authorization server, logs in there, approves sharing his/hers data and is then redirected back to client site (localhost:8080/client but with code given by authorization server), but now with additional option to click one more link (localhost:8081/oauth/token...) that has returned code in it. All this works, but when user clicks this second link and is redirected to authorization server, this auth server responds with "Full authentication is required to access this resource".</p>
  
  <pre><code>&lt;!DOCTYPE HTML&gt;
  &lt;html xmlns:th="http://www.thymeleaf.org"&gt;
  &lt;head&gt;
  &lt;title&gt;client page&lt;/title&gt;
  &lt;meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /&gt;
  &lt;/head&gt;
  &lt;body&gt;
      &lt;p th:text="'oooo text oooo'" /&gt;
      if you want it
      &lt;a
          th:href="@{http://localhost:8081/oauth/authorize(response_type='code',client_id='client',key='value',scope='read',redirect_uri='http://localhost:8080/client')}"&gt;clickit&lt;/a&gt;
  
      &lt;a th:if="${param.code != null}"
          th:href="@{http://localhost:8081/oauth/token(grant_type='authorization_code',code=${param.code[0]},redirect_uri='http://localhost:8080/client')}"&gt;
          approve
      &lt;/a&gt;
      &lt;div th:if=" ${param.code !=null}
              "
          th:text="${'requestParam: ' + param.code[0]}"&gt;&lt;/div&gt;
  
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>Do you have any ideas for this problem?</p>