Spring OAuth 2 Call /oauth/token Resulted in 401 (Unauthorized) -

greeting everyone, try configure simple authorization code flow via spring security oauth.

i tested authorisation , resource server configuration via following approaches:

1. create web application client , use page fire http post call /oauth/authorize.
2. after getting code, use same page fire http post code , token.
3. at end, use curl -h place token inside header , response protected resource.

but when try use rest template. throw error message 401 unauthorised error.

server side - security configure:

<http auto-config="true" pattern="/protected/**"     authentication-manager-ref="authenticationmanager">     <custom-filter ref="resourcefilter" before="pre_auth_filter" />     <csrf disabled="true" /> </http>  <http auto-config="true">     <intercept-url pattern="/**" access="hasrole('role_user')" />     <form-login default-target-url="/admin.html" />     <logout logout-success-url="/welcome.html" logout-url="/logout"/>     <csrf disabled="true" /> </http>  <authentication-manager alias="authenticationmanager">     <authentication-provider>         <user-service>             <user name="admin" password="123456" authorities="role_user,role_admin" />         </user-service>     </authentication-provider> </authentication-manager> 

server side - authorisation , resource configure:

<oauth:authorization-server     client-details-service-ref="clientdetails" error-page="error">     <oauth:authorization-code /> </oauth:authorization-server>  <oauth:client-details-service id="clientdetails">     <oauth:client client-id="admin" secret="foosecret" /> </oauth:client-details-service>  <oauth:resource-server id="resourcefilter" /> 

client side:

<oauth:client id="oauth2clientcontextfilter" /> <oauth:resource id="sso" client-id="admin"     access-token-uri="http://localhost:8080/tough/oauth/token"     user-authorization-uri="http://localhost:8080/tough/oauth/authorize"     use-current-uri="true" client-secret="secret"     client-authentication-scheme="header" type="authorization_code"     scope="trust" /> <oauth:rest-template id="template" resource="sso"/> 

if knows goes wrong, please let me know.

phew... got problem solved. there 2 issues configuration above.

1. i noticed client used wrong secret communicate authorization server.
2. token endpoint @ authorization server use authentication manager serve user authentication. result client rejected times until create new security realm token endpoint , configure use authentication manger designed client.

note client different user. client third party want access resource belong user(also called resource owner). hope above helps

:) cheers