title: "Access is denied (user is not anonymous)" with spring-security-oauth2
body: <p>I'm new to Spring Security and Oauth, and I'm trying to set up a simple example protecting the access to resources in path "/api" with Oauth2. I'm using spring-security-oauth2-1.0.0.RC2.  After some time dealing with configuration, I'm able to get tokens, but when I try to send requests to "/api" resources, I'm facing two questions:</p>
  
  <ul>
  <li><p>Initially, I'm sending authorization header with "OAuth2" prefix, but spring-security-oauth2 seems to need headers with "Bearer" prefix in the tokens to find them. What's the difference between these tokens?</p></li>
  <li><p>After Spring validated the token, I'm getting a security error: "ExceptionTranslationFilter - Access is denied (user is not anonymous)" and I'm stuck with this problem. Since I'm using InMemory token store, I have to login each time to authorize client, then I'm getting this error. Here is the spring configuration:</p></li>
  </ul>
  
  <p>
          
          
          
          
          
          
      </p>
  
  <pre><code>&lt;http pattern="/api/**" create-session="never" entry-point-ref="oauthAuthenticationEntryPoint"
      access-decision-manager-ref="accessDecisionManager" xmlns="http://www.springframework.org/schema/security"&gt;
      &lt;anonymous enabled="false" /&gt;
      &lt;intercept-url pattern="/api/**" access="ROLE_CLIENT,SCOPE_READ" /&gt;
      &lt;custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" /&gt;
      &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
  &lt;/http&gt;
  
  &lt;http disable-url-rewriting="true" xmlns="http://www.springframework.org/schema/security"&gt;
      &lt;intercept-url pattern="/oauth/**" access="ROLE_USER" /&gt;
      &lt;!--intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /--&gt;
      &lt;form-login/&gt;
      &lt;logout logout-success-url="/index.jsp" logout-url="/logout" /&gt;
  &lt;/http&gt;
  
  &lt;bean id="oauthAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"&gt;
      &lt;property name="realmName" value="O2Server" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="oauthAccessDeniedHandler" class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" /&gt;
  
  &lt;bean id="clientCredentialsTokenEndpointFilter" class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter"&gt;
      &lt;property name="authenticationManager" ref="clientAuthenticationManager" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased" xmlns="http://www.springframework.org/schema/beans"&gt;
      &lt;constructor-arg&gt;
          &lt;list&gt;
              &lt;bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" /&gt;
              &lt;bean class="org.springframework.security.access.vote.RoleVoter" /&gt;
              &lt;bean class="org.springframework.security.access.vote.AuthenticatedVoter" /&gt;
          &lt;/list&gt;
      &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  
  &lt;authentication-manager id="clientAuthenticationManager" xmlns="http://www.springframework.org/schema/security"&gt;
      &lt;authentication-provider user-service-ref="clientDetailsUserService" /&gt;
  &lt;/authentication-manager&gt;
  
  &lt;authentication-manager alias="authenticationManager" xmlns="http://www.springframework.org/schema/security"&gt;
      &lt;authentication-provider&gt;
          &lt;user-service&gt;
              &lt;user name="test" password="test" authorities="ROLE_USER" /&gt;
          &lt;/user-service&gt;
      &lt;/authentication-provider&gt;
  &lt;/authentication-manager&gt;
  
  &lt;bean id="clientDetailsUserService" class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService"&gt;
      &lt;constructor-arg ref="clientDetails" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="tokenStore" class="org.springframework.security.oauth2.provider.token.InMemoryTokenStore" /&gt;
  
  &lt;bean id="tokenServices" class="org.springframework.security.oauth2.provider.token.DefaultTokenServices"&gt;
      &lt;property name="tokenStore" ref="tokenStore" /&gt;
      &lt;property name="supportRefreshToken" value="true" /&gt;
      &lt;property name="clientDetailsService" ref="clientDetails"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="userApprovalHandler" class="org.o2server.security.O2ServerUserApprovalHandler"&gt;
      &lt;property name="tokenServices" ref="tokenServices" /&gt;
  &lt;/bean&gt;
  
  &lt;oauth:authorization-server client-details-service-ref="clientDetails" token-services-ref="tokenServices" user-approval-handler-ref="userApprovalHandler"&gt;
      &lt;oauth:authorization-code /&gt;
      &lt;oauth:implicit /&gt;
      &lt;oauth:refresh-token /&gt;
      &lt;oauth:client-credentials /&gt;
      &lt;oauth:password /&gt;
  &lt;/oauth:authorization-server&gt;
  
  &lt;oauth:resource-server id="resourceServerFilter" resource-id="O2Server" token-services-ref="tokenServices" /&gt;
  
  &lt;oauth:client-details-service id="clientDetails"&gt;
      &lt;oauth:client client-id="O2Client" resource-ids="O2Server" authorized-grant-types="authorization_code,refresh_token,implicit"
          authorities="ROLE_CLIENT" scope="read,write" secret="secret" /&gt;
  &lt;/oauth:client-details-service&gt;
  
  &lt;oauth:web-expression-handler id="oauthWebExpressionHandler" /&gt;
  </code></pre>
  
  <p>This is the log from the server:</p>
  
  <pre><code>11:58:30.366 [DEBUG] FilterSecurityInterceptor - Secure object: FilterInvocation: URL: /api/user/; Attributes: [ROLE_CLIENT, SCOPE_READ]
  11:58:30.366 [DEBUG] FilterSecurityInterceptor - Previously Authenticated: org.springframework.security.oauth2.provider.OAuth2Authentication@48a94464: Principal: org.springframework.security.core.userdetails.User@346448: Username: paul; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_USER; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationDetails@43794494; Granted Authorities: ROLE_USER
  11:58:30.366 [DEBUG] UnanimousBased - Voter: org.springframework.security.oauth2.provider.vote.ScopeVoter@4e857327, returned: 0
  11:58:30.366 [DEBUG] UnanimousBased - Voter: org.springframework.security.access.vote.RoleVoter@1b4b2db7, returned: -1
  11:58:30.367 [DEBUG] ExceptionTranslationFilter - Access is denied (user is not anonymous); delegating to AccessDeniedHandler &lt;org.springframework.security.access.AccessDeniedException: Access is denied&gt;org.springframework.security.access.AccessDeniedException: Access is denied
      at org.springframework.security.access.vote.UnanimousBased.decide(UnanimousBased.java:90)
  </code></pre>
  
  <p>Please, could you give me some advice?</p>
  
  <p>Thank you in advance.</p>