Grails Spring Securiy Oauth Provider Plugin: Full Authentication Required to Access This Resource

Question

I am using the grails plugin "Spring Security OAuth Provider". And I can get the access code when responding with the URL below.

http://localhost:8080/oauthServer/oauth/authorize?response_type=code&client_id=test_client&scope=read&redirect_uri=http://example.com?

But when I send a request to get the access token using the access code using the URL below, I get " Full authentication is required to access this resource ."

curl -header "Authorization: Basic bnVkZ2VDbGllbnQ6YjRkNzA3NmE3YTA4N2E4MWMzMTE2ZjZlNWQzZWY0MDJjNmQ4ZjM3Nw==" http://localhost:8080/oauthServer/oauth/token?grant_type=authorization_code&code=kuH8aC

Note: base64(client_id:client_secret)=bnVkZ2VDbGllbnQ6YjRkNzA3NmE3YTA4N2E4MWMzMTE2ZjZlNWQzZWY0MDJjNmQ4ZjM3Nw==

A complete error message is given below.

<oauth>
 <error_description>
   Full authentication is required to access this resource
 </error_description>
 <error>unauthorized</error>
</oauth>

What am I missing. Please suggest.

thank

Update 1

Actually, I follow this Spring documentation of the oauth security plugin provider.

.

// Added by the Spring Security OAuth2 Provider plugin:
grails.plugin.springsecurity.oauthProvider.clientLookup.className = 'com.oauth.Client'
grails.plugin.springsecurity.oauthProvider.authorizationCodeLookup.className = 'com.oauth.AuthorizationCode'
grails.plugin.springsecurity.oauthProvider.accessTokenLookup.className = 'com.oauth.AccessToken'
grails.plugin.springsecurity.oauthProvider.refreshTokenLookup.className = 'com.oauth.RefreshToken'
grails.plugin.springsecurity.logout.postOnly = false

//grails.plugin.springsecurity.successHandler.defaultTargetUrl = '/client/index'

// Added by the Spring Security Core plugin:
grails.plugin.springsecurity.userLookup.userDomainClassName = 'com.auth.User'
grails.plugin.springsecurity.userLookup.authorityJoinClassName = 'com.auth.UserRole'
grails.plugin.springsecurity.authority.className = 'com.auth.Role'
grails.plugin.springsecurity.controllerAnnotations.staticRules = [
    '/oauth/authorize.dispatch':      ["isFullyAuthenticated() and (request.getMethod().equals('GET') or request.getMethod().equals('POST'))"],
    '/oauth/token.dispatch':          ["isFullyAuthenticated() and request.getMethod().equals('POST')"],
    '/':                              ['permitAll'],
    '/index':                         ['permitAll'],
    '/index.gsp':                     ['permitAll'],
    '/assets/**':                     ['permitAll'],
    '/**/js/**':                      ['permitAll'],
    '/**/css/**':                     ['permitAll'],
    '/**/images/**':                  ['permitAll'],
    '/**/favicon.ico':                ['permitAll']
]

grails.plugin.springsecurity.providerNames = [
        'clientCredentialsAuthenticationProvider',
        'daoAuthenticationProvider',
        'anonymousAuthenticationProvider',
        'rememberMeAuthenticationProvider'
]

grails.exceptionresolver.params.exclude = ['password', 'client_secret']

grails.plugin.springsecurity.filterChain.chainMap = [
        '/oauth/token': 'JOINED_FILTERS,-oauth2ProviderFilter,-securityContextPersistenceFilter,-logoutFilter,-rememberMeAuthenticationFilter',
        '/securedOAuth2Resources/**': 'JOINED_FILTERS,-securityContextPersistenceFilter,-logoutFilter,-rememberMeAuthenticationFilter',
        '/**': 'JOINED_FILTERS,-statelessSecurityContextPersistenceFilter,-oauth2ProviderFilter,-clientCredentialsTokenEndpointFilter'
]

.

@Secured(["#oauth2.clientHasRole('ROLE_CLIENT')"])
    def clientRoleExpression() {
        render "client role expression"
    }

    @Secured(["ROLE_CLIENT"])
    def clientRole() {
        render "client role"
    }

    @Secured(["#oauth2.clientHasAnyRole('ROLE_CLIENT', 'ROLE_TRUSTED_CLIENT')"])
    def clientHasAnyRole() {
        render "client has any role"
    }

    @Secured(["#oauth2.isClient()"])
    def client() {
        render "is client"
    }

    @Secured(["#oauth2.isUser()"])
    def user() {
        // code
    }

    @Secured(["#oauth2.isUser()"])
    def getSubscriptionDetail() {
       //code
    }

    @Secured(["#oauth2.isUser()"])
    def getHistory(){
        //code 
    }

    @Secured(["#oauth2.denyOAuthClient()"])
    def denyClient() {
        render "no client can see"
    }

    @Secured(["permitAll"])
    def anyone() {
        render "anyone can see"
    }

    def nobody() {
        render "nobody can see"
    }

    @Secured(["#oauth2.clientHasRole('ROLE_TRUSTED_CLIENT') and #oauth2.isClient() and #oauth2.hasScope('trust')"])
    def trustedClient() {
        render "trusted client"
    }

    @Secured(["hasRole('ROLE_USER') and #oauth2.isUser() and #oauth2.hasScope('trust')"])
    def trustedUser() {
        render "trusted user"
    }

    @Secured(["hasRole('ROLE_USER') or #oauth2.hasScope('read')"])
    def userRoleOrReadScope() {
        render "user role or read scope"
    }

Answer 1

, POST. curl , , -

curl -X POST

-header.

Answer 2

, . .