title: Spring security throwing 401 error with valid client id and client secret
body: <p>I have a spring boot 2 app REST endpoint as below</p>
  <pre><code>@DeleteMapping(value = &quot;/deleteUser&quot;, produces = MediaType.APPLICATION_JSON_VALUE)
  public ResponseEntity deleteUser(HttpServletRequest pRequest,
                                   @RequestParam(value = &quot;userId&quot;, required = true) String userId) {
      if (validateRequest(userId)) {
          try {
              response = myService.deleteUser(userId);
          } catch (Exception e) {
              logger.error(&quot;Exception&quot;);
          }
      } else {
          response = new ResponseEntity(&quot;Invalid user request.&quot;, new HttpHeaders(), HttpStatus.FORBIDDEN);
      }
  
      return response;
  }
  </code></pre>
  <p>App doesnt have the basic auth enforced but restriction on endpoint.
  Client is invoking the url with valid credentials:</p>
  <pre><code>deleteUserUrl=https://xxxx,clientId=xxxx,clentSecret=xxx
  </code></pre>
  <p>getting the error:</p>
  <pre><code>Full authentication is required to access this resource 
  </code></pre>
  <p>here is my WebSecurityConfig file. This access is restricted to only certain role.</p>
  <pre><code>  @Configuration
    @EnableWebSecurity
    public class WebSecurityConfig extends WebSEALSecurityConfig
   {
  
      @Value(&quot;${ldap.server.admin.group}&quot;)
      private String SERVER_ADMIN_GROUP;
  
      @Value(&quot;${app.user.group}&quot;)
      private String APP_GP_USER;
  
      @Autowired
      private AuthEntryPoint unauthorizedHandler; 
      //This class just to capture 401 error
  
      @Override
      protected void configure(HttpSecurity httpSecurity) throws Exception
      {
             httpSecurity
               .authorizeRequests()
               .antMatchers(HttpMethod.OPTIONS, &quot;/**&quot;).permitAll()
               .antMatchers(&quot;/actuator/health&quot;).permitAll()
               .antMatchers(&quot;/actuator/**&quot;).hasRole(SERVER_ADMIN_GROUP)
               .antMatchers(&quot;/test/deleteUser&quot;).hasRole(APP_GP_USER)
               .and().addFilterBefore(getCmpAuthenticationSelectionFilter(), 
               BasicAuthenticationFilter.class)
                .httpBasic()
                .authenticationEntryPoint(unauthorizedHandler)
               .and().csrf().disable()
              . sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
           }
       }
  </code></pre>
  <p>Here is my CORS filter class:</p>
  <pre><code>@Configuration
  public class CORSConfig {
      @Bean
      public CorsFilter corsFilter() {    
          UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
          CorsConfiguration config = new CorsConfiguration();
          config.setAllowCredentials(true);
          config.addAllowedOrigin(&quot;*&quot;);
          config.addAllowedHeader(&quot;*&quot;);
          config.addAllowedMethod(&quot;*&quot;);
          source.registerCorsConfiguration(&quot;/**&quot;, config);
          return new CorsFilter(source);
      }
  }
  </code></pre>
  <p>Here is my gradle file:</p>
  <pre><code>  plugins {
       id 'org.springframework.boot' version '2.1.6.RELEASE'
       id 'java'
    }
  
    apply plugin: 'io.spring.dependency-management'
    apply plugin: 'java'
    apply plugin: 'eclipse'
    apply plugin: 'org.springframework.boot'
    apply plugin: 'jacoco'
    apply plugin: 'checkstyle'
    apply plugin: 'jdepend'
  
    sourceCompatibility = 1.11
  
    dependencies {
      implementation('org.springframework.boot:spring-boot-starter')
      compile('org.springframework.boot:spring-boot-starter-actuator')
      compile('org.springframework.boot:spring-boot-starter-cache')
      compile('org.springframework.boot:spring-boot-starter-web')
      compile('org.springframework.boot:spring-boot-starter-mail')
      implementation &quot;com.company:webauth-plugin:2.0.1&quot;
      implementation('org.springframework.boot:spring-boot-starter-security')
  
      compile('org.springframework.boot:spring-boot-starter-jdbc') {
         exclude group: 'org.apache.tomcat', module: 'tomcat-jdbc'
      }
  
      compile('org.apache.commons:commons-lang3:3.5')
      compile('org.springframework.boot:spring-boot-starter-data-jpa')
      compile('org.apache.commons:commons-collections4:4.0')
      compile group: 'net.minidev', name: 'json-smart', version: '1.0.9'
      compile group: 'net.sf.jt400', name: 'jt400-jdk8', version: '9.5'
      compile('org.apache.httpcomponents:httpclient:4.3.4')
      compileOnly 'org.projectlombok:lombok'
      runtime('com.microsoft:sqljdbc4:4.0')
  
      testCompile group: 'org.springframework.boot', name: 'spring-boot-starter-test'
      testCompile group: 'junit', name: 'junit'
  
   }
  </code></pre>
  <p>application.properties file:</p>
  <pre><code>  app.environment=${APP_ENV}
    server.servlet.context-path=${SERVER_CONTEXT_PATH}
    server.port=${SERVER_PORT}
  
    management.endpoints.web.exposure.include=*
    management.endpoint.shutdown.enabled=true
    management.health.ldap.enabled=false
    management.endpoints.web.cors.allow-credentials=true
  </code></pre>
  <p>Please note: This stopped working after made below changes in the app:</p>
  <ol>
  <li><p>Introduction of CORSConfig class</p>
  </li>
  <li><p>Removing the gradle dependency</p>
  <pre><code> compile group: 'org.springframework.security', name: 'spring-security-ldap', version: '5.1.2.RELEASE'
  </code></pre>
  </li>
  <li><p>Included AuthEntryPoint class to capture 401 error</p>
  </li>
  </ol>
  <p>Please advice what I am doing wrong here, thanks in advance</p>