title: How to implement Oauth2 two-legged token based security on Mule CE?
body: <p>I am working on Mule CE and need to implement token based security (preferably) using Oauth2. I have configured the authorization-server and I do see the default mappings in the log file, however when I send message on "/oauth/token" nothing happens.</p>
  
  <p>Similar config of OAuth2 works fine with Spring/Tomcat when deployed as standalone Spring web service application on Tomcat.</p>
  
  <p>Here is my Mule config:</p>
  
  <pre><code>&lt;mule xmlns:mulexml="http://www.mulesoft.org/schema/mule/xml"
      xmlns:https="http://www.mulesoft.org/schema/mule/https" xmlns:jersey="http://www.mulesoft.org/schema/mule/jersey"
      xmlns:http="http://www.mulesoft.org/schema/mule/http" xmlns="http://www.mulesoft.org/schema/mule/core"
      xmlns:doc="http://www.mulesoft.org/schema/mule/documentation" xmlns:vm="http://www.mulesource.org/schema/mule/vm/2.0"
      xmlns:spring="http://www.springframework.org/schema/beans" version="CE-3.3.1"
      xmlns:mule-ss="http://www.mulesoft.org/schema/mule/spring-security"
      xmlns:mvc="http://www.springframework.org/schema/mvc"
      xmlns:context="http://www.springframework.org/schema/context" xmlns:ss="http://www.springframework.org/schema/security"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
      xmlns:pattern="http://www.mulesoft.org/schema/mule/pattern" xmlns:util="http://www.springframework.org/schema/util"
      xsi:schemaLocation="
  http://www.mulesoft.org/schema/mule/http http://www.mulesoft.org/schema/mule/http/current/mule-http.xsd 
  http://www.mulesoft.org/schema/mule/xml http://www.mulesoft.org/schema/mule/xml/current/mule-xml.xsd 
  http://www.mulesoft.org/schema/mule/xml 
  http://www.mulesoft.org/schema/mule/xml/3.3/mule-xml.xsd
  http://www.mulesoft.org/schema/mule/http 
  http://www.mulesoft.org/schema/mule/http/current/mule-http.xsd 
  http://www.springframework.org/schema/beans 
  http://www.springframework.org/schema/beans/spring-beans-current.xsd 
  http://www.mulesoft.org/schema/mule/core 
  http://www.mulesoft.org/schema/mule/core/current/mule.xsd 
  http://www.mulesoft.org/schema/mule/https 
  http://www.mulesoft.org/schema/mule/https/current/mule-https.xsd
  http://www.mulesoft.org/schema/mule/jersey 
  http://www.mulesoft.org/schema/mule/jersey/current/mule-jersey.xsd 
  http://www.mulesoft.org/schema/mule/spring-security 
  http://www.mulesoft.org/schema/mule/spring-security/3.3/mule-spring-security.xsd
  http://www.springframework.org/schema/security/oauth2 
  http://www.springframework.org/schema/security/spring-security-oauth2-1.0.xsd
  http://www.springframework.org/schema/security 
  http://www.springframework.org/schema/security/spring-security-3.1.xsd
  http://www.springframework.org/schema/mvc
  http://www.springframework.org/schema/mvc/spring-mvc-3.1.xsd
  http://www.mulesoft.org/schema/mule/pattern 
  http://www.mulesoft.org/schema/mule/pattern/3.3/mule-pattern.xsd
  http://www.springframework.org/schema/context
  http://www.springframework.org/schema/context/spring-context-3.0.xsd
  http://www.springframework.org/schema/util 
  http://www.springframework.org/schema/util/spring-util.xsd "&gt;
  
  
  
  
      &lt;mule-ss:security-manager&gt;
          &lt;mule-ss:delegate-security-provider
              name="memory-provider" delegate-ref="authenticationManager" /&gt;
      &lt;/mule-ss:security-manager&gt;
      &lt;spring:beans&gt;
          &lt;ss:authentication-manager alias="authenticationManager"&gt;
              &lt;ss:authentication-provider ref="myAuthenticationProvider" /&gt;
          &lt;/ss:authentication-manager&gt;
          &lt;oauth:client-details-service id="clientDetailsService"&gt;
              &lt;oauth:client client-id="admin"
                  authorized-grant-types="password,authorization_code,refresh_token,implicit,client_credentials"
                  authorities="ROLE_USER, ROLE_TRUSTED_CLIENT" scope="read,write,trust"
                  access-token-validity="60" /&gt;
          &lt;/oauth:client-details-service&gt;
          &lt;oauth:authorization-server
              client-details-service-ref="clientDetailsService" token-services-ref="tokenServices"&gt;
              &lt;oauth:authorization-code /&gt;
              &lt;oauth:implicit /&gt;
              &lt;oauth:refresh-token /&gt;
              &lt;oauth:client-credentials /&gt;
              &lt;oauth:password /&gt;
          &lt;/oauth:authorization-server&gt;
      &lt;/spring:beans&gt;
  
      &lt;spring:beans&gt;
  
          &lt;mvc:annotation-driven /&gt;
          &lt;spring:bean id="myAuthenticationProvider"
              class="com.sachin.tech.security.MyUserAuthenticationProvider" /&gt;
  
          &lt;spring:bean id="oauthAuthenticationEntryPoint"
              class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
              &lt;spring:property name="realmName" value="myCustomerAppRealm" /&gt;
          &lt;/spring:bean&gt;
  
          &lt;spring:bean id="oauth2AccessDeniedHandler"
              class="org.springframework.security.web.access.AccessDeniedHandlerImpl" /&gt;
  
          &lt;spring:bean id="clientCredentialsTokenEndpointFilter"
              class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter"&gt;
              &lt;spring:property name="authenticationManager" ref="authenticationManager" /&gt;
          &lt;/spring:bean&gt;
  
          &lt;spring:bean id="tokenStore"
              class="org.springframework.security.oauth2.provider.token.InMemoryTokenStore" /&gt;
  
          &lt;spring:bean id="tokenServices"
              class="org.springframework.security.oauth2.provider.token.DefaultTokenServices"&gt;
              &lt;spring:property name="tokenStore" ref="tokenStore" /&gt;
              &lt;spring:property name="supportRefreshToken" value="true" /&gt;
              &lt;spring:property name="accessTokenValiditySeconds"
                  value="60" /&gt;
          &lt;/spring:bean&gt;
  
      &lt;/spring:beans&gt;
  
      &lt;flow name="wsauthentication_2" doc:name="wsauthentication_2"&gt;
          &lt;http:inbound-endpoint exchange-pattern="request-response"
              host="localhost" port="8098" doc:name="MyHTTPInbound2_2"
              doc:description="wsauthentication_2 Desc"&gt;
          &lt;/http:inbound-endpoint&gt;
          &lt;echo-component doc:name="Echo" /&gt;
      &lt;/flow&gt;
  
  &lt;/mule&gt;
  </code></pre>
  
  <p>The mapping seems to be fine in logs:</p>
  
  <pre><code>13:48:01,789 DEBUG FrameworkEndpointHandlerMapping:125 - Looking for request mappings in application context: org.mule.config.spring.MuleApplicationContext@7fe3a7ec: startup date [Tue Apr 23 13:47:56 IST 2013]; root of context hierarchy
  13:48:01,836  INFO FrameworkEndpointHandlerMapping:197 - Mapped "{[/oauth/error],methods=[],params=[],headers=[],consumes=[],produces=[],custom=[]}" onto public org.springframework.web.servlet.ModelAndView org.springframework.security.oauth2.provider.endpoint.WhitelabelApprovalEndpoint.handleError(javax.servlet.http.HttpServletRequest)
  13:48:01,836  INFO FrameworkEndpointHandlerMapping:197 - Mapped "{[/oauth/confirm_access],methods=[],params=[],headers=[],consumes=[],produces=[],custom=[]}" onto public org.springframework.web.servlet.ModelAndView org.springframework.security.oauth2.provider.endpoint.WhitelabelApprovalEndpoint.getAccessConfirmation(java.util.Map&lt;java.lang.String, java.lang.Object&gt;) throws java.lang.Exception
  13:48:01,851  INFO FrameworkEndpointHandlerMapping:197 - Mapped "{[/oauth/authorize],methods=[],params=[],headers=[],consumes=[],produces=[],custom=[]}" onto public org.springframework.web.servlet.ModelAndView org.springframework.security.oauth2.provider.endpoint.AuthorizationEndpoint.authorize(java.util.Map&lt;java.lang.String, java.lang.Object&gt;,java.lang.String,java.util.Map&lt;java.lang.String, java.lang.String&gt;,org.springframework.web.bind.support.SessionStatus,java.security.Principal)
  13:48:01,851  INFO FrameworkEndpointHandlerMapping:197 - Mapped "{[/oauth/authorize],methods=[POST],params=[user_oauth_approval],headers=[],consumes=[],produces=[],custom=[]}" onto public org.springframework.web.servlet.View org.springframework.security.oauth2.provider.endpoint.AuthorizationEndpoint.approveOrDeny(java.util.Map&lt;java.lang.String, java.lang.String&gt;,java.util.Map&lt;java.lang.String, ?&gt;,org.springframework.web.bind.support.SessionStatus,java.security.Principal)
  13:48:01,851  INFO FrameworkEndpointHandlerMapping:197 - Mapped "{[/oauth/token],methods=[],params=[],headers=[],consumes=[],produces=[],custom=[]}" onto public org.springframework.http.ResponseEntity&lt;org.springframework.security.oauth2.common.OAuth2AccessToken&gt; org.springframework.security.oauth2.provider.endpoint.TokenEndpoint.getAccessToken(java.security.Principal,java.lang.String,java.util.Map&lt;java.lang.String, java.lang.String&gt;)
  </code></pre>
  
  <p>Please help.</p>