title: Authorization code grant
body: <p>I'm working on a REST API, that listens on localhost and I want to include Spring Security. Password grant and client credentials grant works perfectly and I can go check secured data from /smarthouse and /smarthouse2. </p>
  
  <p>Although, when I try to use authorization code grant through postman, it gives me the same error and I have checked everywhere. My project is here: <a href="https://github.com/sharjak/Smarthouse" rel="nofollow noreferrer">https://github.com/sharjak/Smarthouse</a>. The action all happens in the demoapplication folder.</p>
  
  <p><a href="https://i.stack.imgur.com/K2emn.jpg" rel="nofollow noreferrer">Authorization code in Postman</a></p>
  
  <p>My code for authorization and resource server:</p>
  
  <pre><code>@Configuration
  public class OAuth2ServerConfig {
  
      @Configuration
      @EnableResourceServer
      protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
  
          @Override
          public void configure(HttpSecurity http) throws Exception {
              http
                      .anonymous().disable()
                      .csrf().disable()
                      .authorizeRequests()
                      .anyRequest()
                      .authenticated().and()
                      .formLogin();
              }
          }
  
      @Configuration
      @EnableAuthorizationServer
      protected static class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {
  
          @Autowired
          private TokenStore tokenStore;
  
          @Autowired
          private AuthenticationManager authenticationManager;
  
          @Override
          public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
  
              clients.inMemory().withClient("my-trusted-client")
                      .authorizedGrantTypes("password","authorization_code","refresh_token", "implicit")
                      .authorities("ROLE_CLIENT","ROLE_TRUSTED_CLIENT","ROLE_USER")
                      .scopes("read", "write", "trust")
                      .resourceIds("oauth2-resource")
                      .secret("secret")
                      .accessTokenValiditySeconds(6000)
                      .and()
  
                      .withClient("my-client")
                      .authorizedGrantTypes("authorization_code", "implicit")
                      .authorities("ROLE_CLIENT", "ROLE_USER")
                      .scopes("read","trust", "write")
                      .resourceIds("oauth2-resource")
                      .accessTokenValiditySeconds(6000)
                      .and()
  
                      .withClient("my-client-with-secret")
                      .authorizedGrantTypes("client_credentials","password")
                      .authorities("ROLE_CLIENT", "ROLE_USER")
                      .scopes("read", "trust", "write")
                      .resourceIds("oauth2-resource")
                      .secret("secret")
                      .accessTokenValiditySeconds(6000);
          }
  
          @Bean
          public TokenStore tokenStore() {
              return new InMemoryTokenStore();
          }
  
          @Override
          public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
              endpoints
                      .authenticationManager(authenticationManager)
                      .tokenStore(tokenStore);
          }
  
          @Override
          public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
              oauthServer.checkTokenAccess("permitAll()");
          }
      }
  }
  </code></pre>
  
  <p>Code for Websecurity server:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      private ClientDetailsService clientDetailsService;
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          http
                  .anonymous().disable()
                  .csrf().disable()
                  .authorizeRequests()
                  .antMatchers("/smarthouse", "smarthouse2", "/user").permitAll()
                  .and()
                  .formLogin();
      }
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth.inMemoryAuthentication()
                  .withUser("admin").password("password").roles("ADMIN")
                  .and()
                  .withUser("sander").password("Sander123").roles("USER");
      }
  
      @Override
      @Bean
      public AuthenticationManager authenticationManagerBean() throws Exception{
          return super.authenticationManagerBean();
      }
  
      @Bean
      public TokenStore tokenStore() {
          return new InMemoryTokenStore();
      }
  
      @Bean
      @Autowired
      public TokenStoreUserApprovalHandler userApprovalHandler(TokenStore tokenStore){
          TokenStoreUserApprovalHandler handler = new TokenStoreUserApprovalHandler();
          handler.setTokenStore(tokenStore);
          handler.setRequestFactory(new DefaultOAuth2RequestFactory(clientDetailsService));
          handler.setClientDetailsService(clientDetailsService);
          return handler;
      }
  
      @Bean
      @Autowired
      public ApprovalStore approvalStore(TokenStore tokenStore) throws Exception {
          TokenApprovalStore store = new TokenApprovalStore();
          store.setTokenStore(tokenStore);
          return store;
      }
  }
  </code></pre>
  
  <p>Stacktrace when I try to log in with a user:</p>
  
  <pre><code>    org.springframework.security.authentication.InsufficientAuthenticationException: User must be authenticated with Spring Security before authorization can be completed.
          at org.springframework.security.oauth2.provider.endpoint.AuthorizationEndpoint.authorize(AuthorizationEndpoint.java:138)
  </code></pre>
  
  <p>I'm quite a beginner, but it seems like a small problem to fix. Can anyone help me?</p>