title: Understanding OAuth2 Client credentials flow
body: <p>I'm trying to understand and implement a client credentials flow between our new REST server and our existing client app. I've setup spring-security OAuth2 like <a href="https://stackoverflow.com/questions/14138556/spring-security-context-setup-for-2-legged-client-credentials-oauth2-server">this</a>. From my understanding so far, my server should now support the following request:</p>
  
  <pre><code>$ curl -X -v -d 'client_id=the_client&amp;client_secret=secret&amp;grant_type=client_credentials' -X POST "http://localhost:9090/oauth/token"
  </code></pre>
  
  <p>but I get </p>
  
  <pre><code>InsufficientAuthenticationException: There is no client authentication
  </code></pre>
  
  <p>caused by the <code>Principal</code> being <code>null</code> here (spring-security code) :</p>
  
  <pre><code>@FrameworkEndpoint
  @RequestMapping(value = "/oauth/token")
  public class TokenEndpoint extends AbstractEndpoint {
  
      @RequestMapping
      public ResponseEntity&lt;OAuth2AccessToken&gt; getAccessToken(Principal principal,
              @RequestParam("grant_type") String grantType, @RequestParam Map&lt;String, String&gt; parameters) {
  
          if (!(principal instanceof Authentication)) {
              throw new InsufficientAuthenticationException(
  </code></pre>
  
  <p>So it seems, I need to <strong>authenticate against the server</strong> first. But that's <strong>not what I want to do</strong>. I want two of my servers to talk to each other using a shared secret. The OAuth provider server should provide an access token to the (trusted) client server on request so that the client server can then use that token to access all REST resources on the server. This should protect the REST resources from external access. </p>
  
  <p>Later I want to provide selected resources to a third party and eventually implement some finer grained security for the server-to-server communication as well. But for now I need to protect the REST server from external access.</p>
  
  <p>Looks like I might have some misunderstandings about the whole client credentials flow or the application of spring-security right there so any clarification would be greatly appreciated.</p>