SpringSource/spring-security-oauth — pull request #66 by nfet (2013-01-16 21:56:15+00:00)
Title: Client Auth fails when scheme is set to AuthenticationScheme.header

The client_id should not be in the request body when we set the auth scheme to header. Spring Security OAuth ignores the header based client credentials and assumes it's form-based and fails with a 401.

https://github.com/nfet/spring-security-oauth/commit/83bf1a49944f4f6e73f99513c8ba5628f59ba9aa

# Example Steps:
```Java
ResourceOwnerPasswordResourceDetails resourceOwner = new ResourceOwnerPasswordResourceDetails();
resourceOwner.setAccessTokenUri(ACCESS_TOKEN_URI);
resourceOwner.setClientAuthenticationScheme(AuthenticationScheme.header);
resourceOwner.setAuthenticationScheme(AuthenticationScheme.form);
resourceOwner.setUsername(username);
resourceOwner.setPassword(password);
resourceOwner.setClientId(clientId);
resourceOwner.setClientSecret(clientSecret);

OAuth2RestTemplate oauth2RestTemplate = new OAuth2RestTemplate(resourceDetails)
HttpEntity requestEntity = createRequestEntity(); ....

ResponseEntity response = restTemplate.postForEntity(anyUri, requestEntity, String.class);

2013-01-16 13:01:42,073 DEBUG [org.springframework.web.client.RestTemplate] -
2013-01-16 13:01:42,090 WARN [org.springframework.web.client.RestTemplate] -

error="access_denied", error_description="Error requesting access token."
at org.springframework.security.oauth2.client.token.OAuth2AccessTokenSupport.retrieveToken(OAuth2AccessTokenSupport.java:110)
at org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsAccessTokenProvider.obtainAccessToken(ClientCredentialsAccessTokenProvider.java:44)
at org.springframework.security.oauth2.client.token.AccessTokenProviderChain.obtainNewAccessTokenInternal(AccessTokenProviderChain.java:142)
at org.springframework.security.oauth2.client.token.AccessTokenProviderChain.obtainAccessToken(AccessTokenProviderChain.java:118)
at org.springframework.security.oauth2.client.OAuth2RestTemplate.acquireAccessToken(OAuth2RestTemplate.java:216)
at org.springframework.security.oauth2.client.OAuth2RestTemplate.getAccessToken(OAuth2RestTemplate.java:168)
at org.springframework.security.oauth2.client.OAuth2RestTemplate.createRequest(OAuth2RestTemplate.java:89)
at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:442)
at org.springframework.security.oauth2.client.OAuth2RestTemplate.doExecute(OAuth2RestTemplate.java:123)
at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:423)
at org.springframework.web.client.RestTemplate.exchange(RestTemplate.java:399)
at
Caused by: org.springframework.web.client.HttpClientErrorException: 401 Unauthorized
at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:90)
at org.springframework.security.oauth2.client.token.OAuth2AccessTokenSupport$AccessTokenErrorHandler.handleError(OAuth2AccessTokenSupport.java:209)
at org.springframework.web.client.RestTemplate.handleResponseError(RestTemplate.java:494)
at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:451)
at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:417)
at org.springframework.security.oauth2.client.token.OAuth2AccessTokenSupport.retrieveToken(OAuth2AccessTokenSupport.java:102)
... 39 more
```