Spring OAuth2 Password Flow keeps failing - spring-boot

Question

I'm trying to enable OAuth2 Password Flow in my Spring Boot application, however, I just can't get it to run, no matter what I try.
There following are my configurations.
For the TokenStore I configured a JdbcTokenStore bean and the UserDetailsService is simply loading the user from my custom user tables.
I also added the the property security.oauth2.resource.filter-order=3.
For Spring Boot I'm using 2.0.0.RELEASE and for Spring Security 2.3.0.RELEASE.
Both the authorization server and the resource server are in a single application.
The following POST (with SoapUI) keeps failing:
http://localhost:8080/oauth/token?grant_type=password&username=hans.wurst&password=bla&client_id=androidAppClient
I get the message
Access is denied (user is anonymous);
Debug tells me that the following filters were applied:
Security filter chain: [
WebAsyncManagerIntegrationFilter
SecurityContextPersistenceFilter
HeaderWriterFilter
LogoutFilter
BasicAuthenticationFilter
RequestCacheAwareFilter
SecurityContextHolderAwareRequestFilter
AnonymousAuthenticationFilter
SessionManagementFilter
ExceptionTranslationFilter
FilterSecurityInterceptor
]
Authorization server:
#Configuration
#EnableAuthorizationServer
class AuthorizationServerConfiguration : AuthorizationServerConfigurerAdapter() {
#Autowired
private lateinit var dataSource: DataSource
#Autowired
private lateinit var tokenStore: TokenStore
#Autowired
#Qualifier("authenticationManagerBean")
private lateinit var authenticationManager: AuthenticationManager
override fun configure(clients: ClientDetailsServiceConfigurer) {
clients.jdbc(dataSource)
}
override fun configure(endpoints: AuthorizationServerEndpointsConfigurer) {
endpoints
.authenticationManager(authenticationManager)
.tokenStore(tokenStore)
}
}
Web security:
#Configuration
class WebSecurityConfiguration : WebSecurityConfigurerAdapter() {
#Autowired
#Qualifier(USER_DETAILS_SERVICE)
private lateinit var userDetailsService: UserDetailsService
#Bean
#Throws(Exception::class)
override fun authenticationManagerBean(): AuthenticationManager = super.authenticationManagerBean()
#Throws(Exception::class)
override fun configure(web: WebSecurity) {
web.debug(true)
}
override fun configure(auth: AuthenticationManagerBuilder) {
auth.userDetailsService(userDetailsService)
}
override fun configure(http: HttpSecurity) {
http
.authorizeRequests()
.anyRequest()
.authenticated()
}
}
Resource server:
#Configuration
#EnableResourceServer
class ResourceServerConfiguration : ResourceServerConfigurerAdapter() {
override fun configure(http: HttpSecurity) {
http
.authorizeRequests()
.antMatchers("/registration", "/customer/check")
.anonymous()
.anyRequest()
.authenticated()
}
}
User details service:
const val USER_DETAILS_SERVICE = "userDetailsService";
#Transactional
#Service(USER_DETAILS_SERVICE)
class CustomerUserDetailsService #Autowired constructor(private val customerRepository: CustomerRepository) : UserDetailsService {
#Throws(UsernameNotFoundException::class)
override fun loadUserByUsername(username: String): UserDetails =
customerRepository
.findCustomerCredentialsByUserName(username)
?.let { User(it.userName, it.password, emptyList()) }
?: throw UsernameNotFoundException("Could not find customer with username $username")
}

Answer 1

It appears that client androidAppClient doesn't have password grant type set in authorized_grant_types.
Check client details table in DB (oauth_client_details), make sure password grant type is set for this client. If it is set along with other grant types then make sure there are no spaces in grant types like, ('password,refresh_token').
The /oauth/token endpoint's post request expects client credentials in Base64 "clientId:clientSecret" format.
curl --request POST \
--url http://localhost:8443/auth-service/oauth/token \
--header 'authorization: Basic UkVXQVJEU19QT1QUxfQURNSU46cGFzc3dvcmQ=' \
--header 'content-type: multipart/form-data; boundary=---011000010111000001101001' \
--form username=testuser \
--form password=password \
--form grant_type=password