---
title: REST Authentication using OAUTH 2.0 Resource Owner Password Flow protocol
description: REST Authentication using OAUTH 2.0 Resource Owner Password Flow protocol
image: https://blog.e-zest.com/hs-fs/file-3586009710-jpg/blog-files/resource-owner-password-flow.jpg
---

[![e-Zest logo\_An accion lab company\_Colour](https://blog.e-zest.com/hubfs/images/Logos%20with%20Tagline/Corporate/SVG/e-Zest%20logo_An%20accion%20lab%20company_Colour.svg "e-Zest logo_An accion lab company_Colour")](https://www.e-zest.com/)

- [WORK](https://www.e-zest.com/our-work)
- [SERVICES](https://www.e-zest.com/our-services) 
    - [Product Engineering](https://www.e-zest.com/digital-product-engineering-services)
    - [Enterprise Data Services](https://www.e-zest.com/enterprise-data-services)
    - [Digital Commerce](https://www.e-zest.com/digital-commerce-services)
    - [Digital Operations](https://www.e-zest.com/digital-operations)
    - [Digital Consulting](https://www.e-zest.com/digital-transformation-consulting-services)
    - [Digital Experience Design](https://www.e-zest.com/digital-experience-design)
- [INSIGHTS](https://blog.e-zest.com/)
- [CAREERS](https://www.e-zest.com/careers)
- [ENTERPRISE DATA SERVICES](https://www.e-zest.com/enterprise-data-services)
- [GENERATIVE AI](https://www.e-zest.com/generative-ai)
- [Healthcare](https://healthcare.e-zest.com)
- [Contact Us](https://www.e-zest.com/contact-us)

- ![Elevating Product Engineering with AI and ML](https://blog.e-zest.com/hubfs/Elevating%20Product%20Engineering%20with%20AI%20and%20ML.jpg)

  [BLOGS](https://blog.e-zest.com)
  
  #### Elevating Product Engineering with AI and ML

  As technology evolves and customer choices broaden, there is an increasing ...

  [Read more](https://blog.e-zest.com/elevating-product-engineering-with-ai-and-ml)
- ![e-Zest – An Accion Labs Company gets Recognition as a Contender in the ISG Provider Lens™ Study on Digital Engineering Services 2024](https://blog.e-zest.com/hubfs/e-Zest%20%E2%80%93%20An%20Accion%20Labs%20Company%20-%20Gets%20Recognition%20as%20a%20Contender%20in%20the%20ISG%20Provider%20LensTM%20Study%20on%20Digital%20Engineering%20Services%202024.jpg)

  [NEWS](https://blog.e-zest.com/news)
  
  #### e-Zest – An Accion Labs Company gets Recognition as a Contender in the ISG Provider Lens™ Study on Digital Engineering Services 2024

  We are delighted to announce that e-Zest – An Accion Labs Company has been ...

  [Read more](https://blog.e-zest.com/news/e-zest-an-accion-labs-company-gets-recognition-as-a-contender-in-the-isg-provider-lens-study-on-digital-engineering-services-2024)
- ![e-Zest Solutions supports Digital Pune Mission](https://blog.e-zest.com/hubfs/blog-files/Digital%20Literacy%20Bus%20e-Zest.png)

  [CSR](https://blog.e-zest.com/csr)
  
  #### e-Zest Solutions supports Digital Pune Mission

  **Pune, India:** e-Zest Solutions, a leading digital technology innovation ...

  [Read more](https://blog.e-zest.com/csr/e-zest-solutions-supports-digital-pune-mission)

- [Work](https://www.e-zest.com/our-work)
- [Services](https://www.e-zest.com/our-services)
- [Insights](https://blog.e-zest.com)
- [Careers](https://www.e-zest.com/careers)
- [Enterprise Data](https://www.e-zest.com/enterprise-data-services)
- [Generative AI](https://www.e-zest.com/generative-ai)
- [Innovations](https://www.e-zest.com/innovations)
- [Healthcare](https://healthcare.e-zest.com)
- [About](https://www.e-zest.com/about-us)
- [Contact](https://www.e-zest.com/contact-us)

- [Blog](https://blog.e-zest.com/)
- [News](https://blog.e-zest.com/news)
- [CSR](https://blog.e-zest.com/csr)

- [![Linkedin Icon](https://blog.e-zest.com/hubfs/icons/linkedin_icon_white.svg)](https://www.linkedin.com/company/e-zest-solutions/)
- [![Twitter Icon](https://blog.e-zest.com/hubfs/twitter-logo-silhouette%20(5).svg)](https://twitter.com/ezest)
- [![Facebook Icon](https://blog.e-zest.com/hubfs/facebook-app-logo%20(4).svg)](https://www.facebook.com/61259256638)
- [![Instagram Icon](https://blog.e-zest.com/hubfs/instagram-logo%20(4).svg)](https://www.instagram.com/ezestsolutions/)
- [![Youtube Icon](https://blog.e-zest.com/hubfs/icons/youtube_icon_white.svg)](https://www.youtube.com/user/ezestcorporate)

[![Go to top icon](https://blog.e-zest.com/hubfs/AA%20Assets/top%20button.svg)](https://blog.e-zest.com/rest-authentication-using-oauth-2-0-resource-owner-password-flow-protocol/#top)

Hit enter to search or ESC to close

Insights

e-Zest members share technology ideas to foster digital transformation.

- [Blog](https://blog.e-zest.com)
- [News](https://blog.e-zest.com/news)
- [Podcasts](https://www.e-zest.com/podcasts)
- [Healthcare](https://blog.e-zest.com/healthcare)
- [CSR](https://blog.e-zest.com/csr)
- [Whitepaper](https://blog.e-zest.com/whitepaper)
- [Playbook](https://blog.e-zest.com/playbook)
- [Media Kit](https://www.e-zest.com/media-kit)

# REST Authentication using OAUTH 2.0 Resource Owner Password Flow protocol

[Nitin Gupta](https://blog.e-zest.com/author/nitin-gupta)  Oct 08, 2013

[Spring Security](https://blog.e-zest.com/topic/spring-security) [Rest Authentication](https://blog.e-zest.com/topic/rest-authentication) [Resource Owner Password Flow protocol](https://blog.e-zest.com/topic/resource-owner-password-flow-protocol) [Oauth 2.0](https://blog.e-zest.com/topic/oauth-2-0) [Technology](https://blog.e-zest.com/topic/technology)

- <https://www.linkedin.com/shareArticle?mini=true&url=https://blog.e-zest.com/rest-authentication-using-oauth-2-0-resource-owner-password-flow-protocol/&title=&summary=&source=>
- <https://twitter.com/intent/tweet?source=https://blog.e-zest.com/rest-authentication-using-oauth-2-0-resource-owner-password-flow-protocol/&text=REST%20Authentication%20using%20OAUTH%202.0%20Resource%20Owner%20Password%20Flow%20protocol>
- <https://www.facebook.com/sharer/sharer.php?u=https://blog.e-zest.com/rest-authentication-using-oauth-2-0-resource-owner-password-flow-protocol/>
- <https://www.instagram.com/ezestsolutions/?u=https://blog.e-zest.com/rest-authentication-using-oauth-2-0-resource-owner-password-flow-protocol/>

## Introduction

In this blog we will look at how to perform authentication for an application exposing its functionalities as Rest Services. All requests made to access protected resource of such an application needs to be accessible only to Authenticated Users.

We will use Spring Security with OAuth 2.0 to authenticate Users and provide access to protected resources.

## What is Oauth 2.0?

Oauth 2.0 is an open protocol to allow secure authorization in a simple and standard method from web, mobile and desktop applications. It is a simple way to publish and interact with protected data. It's also a safer and more secure way for server to give access to its protected resources. OAuth protocol enables a user to access protected resources from trusted client through an API.

## How it works?

We will use the OAuth - Resource Owner Password Flow protocol to provide access to a protected resource on the server.

**Obtain the Access Token**

[![Resource Owner Password Flow](https://blog.e-zest.com/hs-fs/file-3586009710-jpg/blog-files/resource-owner-password-flow.jpg?width=280&height=200&name=resource-owner-password-flow.jpg)](https://blog.e-zest.com/wp-content/uploads/2013/10/Resource-Owner-Password-Flow.jpg)

Fig: Resource Owner Password Flow

- Client requests the Server for an AccessToken by providing client credentials (client\_id & client\_secret) & user credentials (username & password)
- If credentials are valid, Client will get an Access Token in response

The access Token is a string denoting a specific scope, lifetime, and other access attributes

**Accessing Protected Resource**

[![Accessing protected resource](https://blog.e-zest.com/hs-fs/file-3586009720-jpg/blog-files/accessing-protected-resource.jpg?width=280&height=200&name=accessing-protected-resource.jpg)](https://blog.e-zest.com/wp-content/uploads/2013/10/Accessing-protected-resource.jpg)

Fig: Accessing protected resource

- Client needs to provide the access token retrieved in the above steps along with the request to access the protected resource. Access token will be sent as an authorization parameter in the request header
- Server will authenticate the request based on the token
- If token is valid then client will get an access to protected resource otherwise access is denied

The benefit of OAuth is that the API does not require users to disclose their credentials every time they access a protected resource. User provides the access token obtained during login, for all subsequent requests to access the protected resources.

## Implementation

Below are some important configurations that need to be done in the spring-servlet.xml file to configure Oauth 2.0

```
<http pattern="/oauth/token" create-session="stateless"
		authentication-manager-ref="authenticationManager"
		xmlns="http://www.springframework.org/schema/security" >
<intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" />
	<anonymous enabled="false" />
	<http-basic entry-point-ref="clientAuthenticationEntryPoint"/>
	<custom-filter ref="clientCredentialsTokenEndpointFilter" 		before="BASIC_AUTH_FILTER" />
	<access-denied-handler ref="oauthAccessDeniedHandler" />
</http>

<bean id="clientCredentialsTokenEndpointFilter"
class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
<property name="authenticationManager" ref="authenticationManager" />
</bean>

<authentication-manager alias="authenticationManager"
		xmlns="http://www.springframework.org/schema/security">
<authentication-provider user-service-ref="clientDetailsUserService" />
</authentication-manager>
<bean id="clientDetailsUserService"
class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
<constructor-arg ref="clientDetails" />
</bean>
<bean id="clientDetails" class="demo.oauth2.authentication.security.ClientDetailsServiceImpl"></bean>
<bean id="clientAuthenticationEntryPoint"
class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
<property name="realmName" value="springsec/client" />
<property name="typeName" value="Basic" />
</bean>
<bean id="oauthAccessDeniedHandler"
class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler"/>
```

\<http\> configuration:

This tag is defined to process request for authentication.

1. For Authenticating a User the Client application will send request to the URL *"/oauth/token".* This request will contain the clientId, client password, userName and user password details
2. The *clientCredentialsTokenEndpointFilter* filter will extracts client credentials from request & create authentication object in security context
3. Then authentication manager extracts the Authentication Object set in the SecurityContext and passes it to the *clientDetailsUserService*
4. The clientDetailsUserService holds reference to an instance of a custom bean clientDetails. The ClientDetailsServiceImpl class implements the ClientDetailsService interface and implements the method loadClientByClientId. The clientDetailsUserService bean calls this method from to authenticate the client
5. If the Client Credentials are valid then authentication manager will update authentication object in the application security context and set the authenticated flag to true
6. The request is then forwarded to the Oauth server for retrieving the access token
7. If the authentication fails the request is forwarded to the clientAuthenticationEntryPoint which displays the appropriate error to the User

```
<oauth:authorization-server
client-details-service-ref="clientDetails" token-services-ref="tokenServices">
<oauth:authorization-code />
	<oauth:implicit/>
	<oauth:refresh-token/>
	<oauth:client-credentials />
	<oauth:password authentication-manager-ref="userAuthenticationManager"/>
</oauth:authorization-server>

<authentication-manager id="userAuthenticationManager"
	xmlns="http://www.springframework.org/schema/security">
	<authentication-provider  ref="customUserAuthenticationProvider">
	</authentication-provider>
</authentication-manager>

<bean id="customUserAuthenticationProvider"
class="demo.oauth2.authentication.security.CustomUserAuthenticationProvider">
</bean>

<bean id="tokenServices"
class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
<property name="tokenStore" ref="tokenStore" />
<property name="supportRefreshToken" value="true" />
<property name="accessTokenValiditySeconds" value="900000000"></property>
<property name="clientDetailsService" ref="clientDetails" />
</bean>

<bean id="tokenStore"
class="org.springframework.security.oauth2.provider.token.InMemoryTokenStore" />

<bean id="oauthAuthenticationEntryPoint"
class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
</bean>
```

\<oauth:authorization-server\>

This tag is defined to configure authorization-server of oauth. Server serves requests based on grant type.

1. The Oauth Server receives the request once the client is authenticated using above steps
2. Since the Grant type of request is a password, client and user needs to be authenticated by the Oauth server
3. Since the Client is already authenticated in process mentioned above the Oauth server now checks for the User authentication using the userAuthenticationManager
4. Then *userAuthenticationManager* extracts the Authentication Object set in the SecurityContext and passes it to the *customUserAuthenticationProvider*
5. The *CustomUserAuthenticationProvider* class implements the AuthenticationProvider interface and implements the method authenticate to authenticate the user
6. If the User Credentials are valid then authentication manager will update authentication object in the application security context and set the authenticated flag to true
7. Then *tokenServices* will then generate the access token using *tokenStore*
8. The *tokenStore* uses *InMemoryTokenStore* to create access token and wraps authentication from SecurityContext into token
9. Authorization-server will send the access token in response to user request
10. If authentication fails, the request is forwarded to the *oauthAuthenticationEntryPoint* which displays the appropriate error to the User

```
<http pattern="/resources/**" create-session="never"
		entry-point-ref="oauthAuthenticationEntryPoint"
		xmlns="http://www.springframework.org/schema/security">
		<anonymous enabled="false" />
		<intercept-url pattern="/resources/**"	method="GET" />
		<custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
		<access-denied-handler ref="oauthAccessDeniedHandler" />
</http>
<oauth:resource-server id="resourceServerFilter"
resource-id="springsec" token-services-ref="tokenServices" />
```

\<http\> configuration:

This tag is defined to process request to access protected resource.

1. For accessing the protected resource Client application will send request to the URL *"/resources/\*\*"*.This request will contain the access token in request header
2. The *resourceServerFilter* indicates that requested resources is oauth 2 protected
3. Then Oauth-authorization-server will retrieve the access token and authenticate the request
4. If the token is valid user will be redirected to protected resource otherwise the request is forwarded to the *oauthAuthenticationEntryPoint* which displays the appropriate error to the User

```
<http pattern="/logout" create-session="never" entry-point-ref="oauthAuthenticationEntryPoint" access-decision-manager-ref="accessDecisionManager" xmlns="http://www.springframework.org/schema/security">
	<anonymous enabled="false" />
	<intercept-url pattern="/logout" access="ROLE_CLIENT" method="GET" />
<sec:logout invalidate-session="true" logout-url="/logout" success-handler-                                             ref="logoutSuccessHandler"/>
	<custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
	<access-denied-handler ref="oauthAccessDeniedHandler" />
</http>

<bean id="logoutSuccessHandler"
		class="demo.oauth2.authentication.security.LogoutImpl" >
<property name="tokenstore" ref="tokenStore"></property>
</bean>
```

This tag is defined to process request to logout the user from application.

1. For logout Client application will send request to the URL *"/logout"*.This request will contain the access token in request header
2. This request will be authenticated similar to request of accessing protected resource using *resourceServerFilter* and *accessDecisionManager*
3. Then session of the user is invalidated and the request is forwarded to the *logoutSuccessHandler*
4. The *LogoutImpl* class implements LogoutSuccessHandler interface and implements onLogoutSuccess method to remove access token of the user from *tokenStore*
5. The client is successfully logged out

Find the source code in attached ZIP file.

**STEPS TO RUN THE APPLICATION:**

1. Import downloaded source [**demo.rest.springsecurity.oauth2.0.authentication**](https://blog.e-zest.com/hubfs/Blog_Files/demo.rest.springsecurity.oauth2.0.authentication.rar) as maven project in eclipse IDE
2. Start the application in Tomcat
3. Then use [CURL](http://curl.haxx.se/download.html)(command line utility) to run HTTP requests using following commands

- Request To authenticate:

```
curl –X -v –d "username=user1&amp;password=user1&amp;client_id=client1&amp;client_secret=client1&amp;grant_type=password"   -X POST"http://localhost:8044/demo.rest.springsecurity.oauth2.0.authentication/oauth/token"
```

- Response after above request :

```
{"access_token":"6fd0f4b7-ca03-49ff-ae46-eea5e6929325","token_type":"bearer","re fresh_token":"49bdb713-1827-4d83-83dc-59fe225f4726","expires_in":299999}
```

Here access token from this response need to be use in every subsequent request to access protected resource as follows.

- Request To access protected resource getMyInfo :

```
curl -H "Authorization:Bearer 6fd0f4b7-ca03-49ff-ae46-eea5e6929325"  "http://localhost:8044/demo.rest.springsecurity.oauth2.0.authentication/getMyInfo”
```

- Request To logout :

```
curl -H "Authorization:Bearer 6fd0f4b7-ca03-49ff-ae46-eea5e6929325"  "http://localhost:8044/demo.rest.springsecurity.oauth2.0.authentication/logout”
```

- <https://twitter.com/intent/tweet?source=https://blog.e-zest.com/rest-authentication-using-oauth-2-0-resource-owner-password-flow-protocol/&text=REST%20Authentication%20using%20OAUTH%202.0%20Resource%20Owner%20Password%20Flow%20protocol>
- <https://www.facebook.com/sharer/sharer.php?u=https://blog.e-zest.com/rest-authentication-using-oauth-2-0-resource-owner-password-flow-protocol/>
- <https://www.linkedin.com/shareArticle?mini=true&url=https://blog.e-zest.com/rest-authentication-using-oauth-2-0-resource-owner-password-flow-protocol/&title=&summary=&source=>

### Similar Blog

[![Export Data from SQL Server to Azure Based Snowflake](https://blog.e-zest.com/hubfs/blog-files/Export%20data%20from%20SQL%20server%20to%20Azure%20based%20Snowflake-181220.png) Export Data from SQL Server to Azure Based Snowflake The data export process can broadly be divided into 2 steps: Step 1: Export the data from SQL Server to Azure BlobStep 2: Bulk ... By Nitin Gupta Dec 11, 2018](https://blog.e-zest.com/export-data-from-sql-server-to-azure-based-snowflake)

<https://blog.e-zest.com/ahead-of-time-compilation-for-javafx-2-0-applications/>

[Ahead of Time Compilation for JavaFX 2.0 applications](https://blog.e-zest.com/ahead-of-time-compilation-for-javafx-2-0-applications/)

[We at e-Zest are working on](https://blog.e-zest.com/ahead-of-time-compilation-for-javafx-2-0-applications/)[JavaFX](https://blog.e-zest.com/javafx/) 2.0 for more than a year and are amongst the few early adopters of the technology. Based on ...

By Nitin Gupta May 07, 2012

[JavaFX 2.0 Resizing of UI Controls **Resizing of the Root** By Nitin Gupta Feb 15, 2012](https://blog.e-zest.com/javafx-20-resizing-of-ui-controls/)

<https://blog.e-zest.com/osgi-in-practice-part-2-spring-dm-server-2/>

[OSGi in Practice - Part 2 (Spring DM Server )](https://blog.e-zest.com/osgi-in-practice-part-2-spring-dm-server-2/)

[This Blog is in continuation of my](https://blog.e-zest.com/osgi-in-practice-part-2-spring-dm-server-2/)[first blog on OSGi](https://blog.e-zest.com/Blog/post/OSGi-Java-architects-musings-practice-part1.aspx).

By Nitin Gupta Sep 20, 2010

## Helping Organizations Thrive in the Digital Age

[Contact Us](https://www.e-zest.com/contact-us)

- [About](https://www.e-zest.com/about-us)
- [Services](https://www.e-zest.com/our-services)
- [Work](https://www.e-zest.com/our-work)
- [Insights](https://blog.e-zest.com/)
- [Healthcare](https://healthcare.e-zest.com/)
- [Accion Labs](https://www.accionlabs.com/)

- <https://www.linkedin.com/company/e-zest-solutions/>
- <https://twitter.com/ezest>
- <https://www.facebook.com/eZest/>
- <https://www.instagram.com/ezestsolutions/>
- <https://www.youtube.com/user/ezestcorporate>

- Dallas
- Detroit
- Hannover
- Vienna
- London
- Pune

 © 2025 e-Zest Solutions

- [Privacy Policy](https://www.e-zest.com/privacypolicy)
- [Cookie Policy](https://www.e-zest.com/cookie-policy)

 Contact us

 Contact us

e-Zest is a leading digital innovation partner for enterprises and technology companies that utilizes emerging technologies for creating engaging customers experiences. Being a customer-focused and technology-driven company, it always helps clients in crafting holistic business value for their software development efforts. It offers software development and consulting services for cloud computing, enterprise mobility, big data and analytics, user experience and digital commerce.