Spring oauth2 Insufficient Authentication Exception

Question

The following configuration is based on the web.xml class:

public class WebApp extends AbstractDispatcherServletInitializer { @Override protected WebApplicationContext createServletApplicationContext() { AnnotationConfigWebApplicationContext context = new AnnotationConfigWebApplicationContext(); context.scan(ClassUtils.getPackageName(getClass())); return context; } @Override protected String[] getServletMappings() { return new String[]{"/api/*"}; } @Override protected WebApplicationContext createRootApplicationContext() { return null; } @Override public void onStartup(ServletContext servletContext) throws ServletException { super.onStartup(servletContext); DelegatingFilterProxy filter = new DelegatingFilterProxy("springSecurityFilterChain"); filter.setServletContext(servletContext); filter.setContextAttribute("org.springframework.web.servlet.FrameworkServlet.CONTEXT.dispatcher"); servletContext.addFilter("springSecurityFilterChain", filter).addMappingForUrlPatterns(null, false, "/api/*"); } } 

When I try to access one of the oauth endpoints, I get the following result:

 curl -u core:secret "http://localhost:8081/api/oauth/token?client_id=core&grant_type=password&username=user&password=123&response_type=token&scope=admin" {"error":"unauthorized","error_description":"There is no client authentication. Try adding an appropriate authentication filter."}% 

Strange, when I change the servlet mapping from / api / * to / it, it works as expected. So something must be wrong, but I do not know what?

Answer 1

You can set the prefix in FrameworkHandlerMapping , for example. via AuthorizationServerEndpointsConfigurer :

 @Configuration @EnableAuthorizationServer public class OAuth2Config extends AuthorizationServerConfigurerAdapter { @Override public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception { String prefix = "/api"; endpoints.prefix(prefix); } } 

Answer 2

One solution to this problem could be to check your authentication server template settings in security.xml :

  <http pattern="/oauth/token" create-session="stateless" authentication-manager-ref="clientAuthenticationManager" use-expressions="true" xmlns="http://www.springframework.org/schema/security"> 

If this is normal when you make a servlet response to the request /api/* , I think you need to check your template and remove the api from your link in the authentication server template: change pattern="/api/oauth/token" to pattern="/oauth/token"