Oaut2RestTemplate with client_credentials error (anonymous not allowed)

Question

I'm trying to access a web service which is protected by Spring Security using `ResourceServerConfigurerAdapter` (with Oauth2 `client_credentials`) Following is the security configuration ``` //Micoservice 1 @Configuration @EnableResourceServer class ResourceServerConfiguration extends ResourceServerConfigurerAdapter { @Autowired private Environment env; @Autowired private DummyUserFilter dummyUserFilter; @Override public void configure(HttpSecurity http) throws Exception { http.addFilterAfter(dummyUserFilter, LogoutFilter.class) .formLogin().disable() .httpBasic().disable() .csrf().disable() .antMatcher("/**") .authorizeRequests() .antMatchers("/js/**", "/webjars/**").permitAll() .anyRequest() .authenticated(); } } ``` This application (Microservice 1) is to be accessed by another application (Microservice 2) with the `Oauth2RestTemplate`. Following is the `Oauth2RestTemplate` configuration. ``` //MicroService 2 @Configuration public class RestTemplateConfig { @Bean public RestTempla…

Accepted Answer

I had the same problem and concluded that the `AccessTokenProvider` interface, which has multiple implementors is the culprit. By default, the `OAuth2RestTemplate` instantiates the `AccessTokenProviderChain` which tries to re-use the existing login context. However, if no such login exists, this is bound to fail. Try

```
restTemplate.setAccessTokenProvider(new ResourceOwnerPasswordAccessTokenProvider());
```

in your factory method. This uses a token provider which owns its credentials and doesn't reference the thread local `SecurityContextHolder` in its implementation at all.

Oaut2RestTemplate with client_credentials error (anonymous not allowed)

Solution

Problem