Indeed it is an old thread, yet I do get the same problem. I'm sure from a different reason that the guys before me ...
I work on RC2a, successfuly get a code (after calling /authorize), but when I make the call to /token I get 401. Breakpoint in TokenEndpoint never stops (of course).
(Dave - I did a small "hack" in order to keep working even though I work with anonymous token (have raised a ticked in Jira) so I extended AuthorizationCodeResourceDetails and my isClientOnly() returns true so this way I do get the redirect to the /authorize. Can this cause my problem? I doubt...)
Where the problem can be? definitions of the oAuth provider or the client?
my XML of the oAuth provider:
>Code:<!-- Protect the /oauth/token url to allow only registered clients -->
<security:http pattern="/oauth/token" authentication-manager-ref="clientAuthenticationManager" >
<!--<intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" />-->
<security:intercept-url pattern="/oauth/token" access="ROLE_CLIENT" requires-channel="https"/>
<security:anonymous enabled="false" />
<security:http-basic />
</security:http>
<security:authentication-manager id="clientAuthenticationManager">
<security:authentication-provider user-service-ref="clientDetailsUserService" />
</security:authentication-manager>
<bean id="clientDetailsUserService" class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
<constructor-arg ref="clientDetails" />
</bean>
<bean id="clientDetails" class="org.springframework.security.oauth2.provider.JdbcClientDetailsService">
<constructor-arg ref="dataSource" />
</bean

