title: Spring OAuth2 Implicit Flow - Auth server not processing the POST /oauth/authorize request
body: <p>I have an authorization server (<a href="http://localhost:8082" rel="nofollow noreferrer">http://localhost:8082</a>), resource server and implicit client (<a href="http://localhost:8080" rel="nofollow noreferrer">http://localhost:8080</a>) project. The problem is that when the client asks for the authorization (token), the auth server shows the login screen but after the successful login it redirects to GET <a href="http://localhost:8082/" rel="nofollow noreferrer">http://localhost:8082/</a> instead of to <a href="http://localhost:8082/authorize?client_id=" rel="nofollow noreferrer">http://localhost:8082/authorize?client_id=</a>... (as requested by the client)</p>
  
  <p>I am seeing this log:</p>
  
  <p><strong>Implicit client:</strong></p>
  
  <pre><code>.s.o.c.t.g.i.ImplicitAccessTokenProvider : Retrieving token from http://localhost:8082/oauth/authorize
  o.s.web.client.RestTemplate              : Created POST request for "http://localhost:8082/oauth/authorize"
  .s.o.c.t.g.i.ImplicitAccessTokenProvider : Encoding and sending form: {response_type=[token], client_id=[themostuntrustedclientid], scope=[read_users write_users], redirect_uri=[http://localhost:8080/api/accessTokenExtractor]}
  o.s.web.client.RestTemplate              : POST request for "http://localhost:8082/oauth/authorize" resulted in 302 (null)
  o.s.s.web.DefaultRedirectStrategy        : Redirecting to 'http://localhost:8082/login?client_id=themostuntrustedclientid&amp;response_type=token&amp;redirect_uri=http://localhost:8080/api/accessTokenExtractor'
  </code></pre>
  
  <p><strong>Auth Server:</strong></p>
  
  <pre><code>o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'POST /oauth/authorize' doesn't match 'GET /**
  o.s.s.w.util.matcher.AndRequestMatcher   : Did not match
  o.s.s.w.s.HttpSessionRequestCache        : Request not saved as configured RequestMatcher did not match
  o.s.s.w.a.ExceptionTranslationFilter     : Calling Authentication entry point.
  o.s.s.web.DefaultRedirectStrategy        : Redirecting to 'http://localhost:8082/login'
  </code></pre>
  
  <p>The implicit client is POSTing for /oauth/authorize, instead of GETting it, and the authserver doesn't store POST requests. The auth server returns a redirect 302 and the implicit client redirects the browser to this url: <code>http://localhost:8082/login?client_id=themostuntrustedclientid&amp;response_type=token&amp;redirect_uri=http://localhost:8080/api/accessTokenExtractor</code></p>
  
  <p>After successful login the auth server doesn't have a target url so it shows <a href="http://localhost:8082/" rel="nofollow noreferrer">http://localhost:8082/</a> so it doesn't process any /oauth/authorize request... Where is the problem?</p>
  
  <p><strong>AUTH SERVER CONFIG:</strong></p>
  
  <pre><code>@Configuration
  class OAuth2Config extends AuthorizationServerConfigurerAdapter{
  
      @Autowired
      private AuthenticationManager authenticationManager
  
      @Bean
      public TokenStore tokenStore() {
          return new InMemoryTokenStore();
      }
  
      @Override
      public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
          clients.inMemory()
              .withClient("themostuntrustedclientid")
              .secret("themostuntrustedclientsecret")
              .authorizedGrantTypes("implicit")
              .authorities("ROLE_USER")
              .scopes("read_users", "write_users")
              .accessTokenValiditySeconds(60)     
      }
  
      @Override
      public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
          endpoints.authenticationManager(this.authenticationManager);
      }
  
      @Override
      public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
          //security.checkTokenAccess('hasRole("ROLE_RESOURCE_PROVIDER")')
          security.checkTokenAccess('isAuthenticated()')
      }
  
  }
  
  @Configuration
  @EnableWebSecurity
  class SecurityConfig extends WebSecurityConfigurerAdapter{
  
      @Autowired
      public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception {
          auth.inMemoryAuthentication().withUser("jose").password("mypassword").roles('USER').and()
                                       .withUser("themostuntrustedclientid").password("themostuntrustedclientsecret").roles('USER')
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
          .csrf()
              //
              //XXX Si se usa implicit descomentar
              .ignoringAntMatchers("/oauth/authorize")
              .and()
          .authorizeRequests()
              .anyRequest().authenticated()
              .and()
          //.httpBasic()
          .formLogin()
              .loginPage("/login").permitAll()
      }
  
  }
  </code></pre>
  
  <p><strong>IMPLICIT CLIENT CONFIG:</strong></p>
  
  <pre><code>@Configuration
  class OAuth2Config {
  
      @Value('${oauth.authorize:http://localhost:8082/oauth/authorize}')
      private String authorizeUrl
  
      @Value('${oauth.token:http://localhost:8082/oauth/token}')
      private String tokenUrl
  
      @Autowired
      private OAuth2ClientContext oauth2Context
  
      @Bean
      OAuth2ProtectedResourceDetails resource() {
          ImplicitResourceDetails resource = new ImplicitResourceDetails()
          resource.setAuthenticationScheme(AuthenticationScheme.header)
          resource.setAccessTokenUri(authorizeUrl)
          resource.setUserAuthorizationUri(authorizeUrl);
          resource.setClientId("themostuntrustedclientid")
          resource.setClientSecret("themostuntrustedclientsecret")
          resource.setScope(['read_users', 'write_users'])
          resource
      }
  
      @Bean
      OAuth2RestTemplate restTemplate() {
          OAuth2RestTemplate restTemplate = new OAuth2RestTemplate(resource(), oauth2Context)
          //restTemplate.setAuthenticator(new ApiConnectOAuth2RequestAuthenticator())
          restTemplate
      }
  
  @Configuration
  class SecurityConfig extends WebSecurityConfigurerAdapter{
  
      @Autowired
      public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception {
          auth.eraseCredentials(false)
              .inMemoryAuthentication().withUser("jose").password("mypassword").roles('USER')
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
          .csrf()
              .ignoringAntMatchers("/accessTokenExtractor")
          .and()
          .authorizeRequests()
          .anyRequest().hasRole('USER')
          .and()
          .formLogin()
              .loginPage("/login").permitAll()
      }
  
  }
  </code></pre>