RequestMapping(value = "/oauth/authorize")

     public ModelAndView authorize(Map<String, Object> model, @RequestParam Map<String, String> parameters,

             SessionStatus sessionStatus, Principal principal) {

         // Pull out the authorization request first, using the OAuth2RequestFactory. All further logic should

         // query off of the authorization request instead of referring back to the parameters map. The contents of the

         // parameters map will be stored without change in the AuthorizationRequest object once it is created.

         AuthorizationRequest authorizationRequest = getOAuth2RequestFactory().createAuthorizationRequest(parameters);

         Set<String> responseTypes = authorizationRequest.getResponseTypes();

         if (!responseTypes.contains("token") && !responseTypes.contains("code")) {

             throw new UnsupportedResponseTypeException("Unsupported response types: " + responseTypes);

         }

         if (authorizationRequest.getClientId() == null) {

             throw new InvalidClientException("A client id must be provided");

         }

         try {

             if (!(principal instanceof Authentication) || !((Authentication) principal).isAuthenticated()) {

                 throw new InsufficientAuthenticationException(

                         "User must be authenticated with Spring Security before authorization can be completed.");

             }

             ClientDetails client = getClientDetailsService().loadClientByClientId(authorizationRequest.getClientId());

             // The resolved redirect URI is either the redirect_uri from the parameters or the one from

             // clientDetails. Either way we need to store it on the AuthorizationRequest.

             String redirectUriParameter = authorizationRequest.getRequestParameters().get(OAuth2Utils.REDIRECT_URI);

             String resolvedRedirect = redirectResolver.resolveRedirect(redirectUriParameter, client);

             if (!StringUtils.hasText(resolvedRedirect)) {

                 throw new RedirectMismatchException(

                         "A redirectUri must be either supplied or preconfigured in the ClientDetails");

             }

             authorizationRequest.setRedirectUri(resolvedRedirect);

             // We intentionally only validate the parameters requested by the client (ignoring any data that may have

             // been added to the request by the manager).

             oauth2RequestValidator.validateScope(authorizationRequest, client);

             // Some systems may allow for approval decisions to be remembered or approved by default. Check for

             // such logic here, and set the approved flag on the authorization request accordingly.

             authorizationRequest = userApprovalHandler.checkForPreApproval(authorizationRequest,

                     (Authentication) principal);

             // TODO: is this call necessary?

             boolean approved = userApprovalHandler.isApproved(authorizationRequest, (Authentication) principal);

             authorizationRequest.setApproved(approved);

             // Validation is all done, so we can check for auto approval...

             if (authorizationRequest.isApproved()) {

                 if (responseTypes.contains("token")) {

                     return getImplicitGrantResponse(authorizationRequest);

                 }

                 if (responseTypes.contains("code")) {

                     return new ModelAndView(getAuthorizationCodeResponse(authorizationRequest,

                             (Authentication) principal));

                 }

             }

             // Place auth request into the model so that it is stored in the session

             // for approveOrDeny to use. That way we make sure that auth request comes from the session,

             // so any auth request parameters passed to approveOrDeny will be ignored and retrieved from the session.

             model.put("authorizationRequest", authorizationRequest);

             return getUserApprovalPageResponse(model, authorizationRequest, (Authentication) principal);

         }

         catch (RuntimeException e) {

             sessionStatus.setComplete();

             throw e;

         }

     }

   @Override

   public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {

     endpoints

         .tokenStore(tokenStore)

         .authenticationManager(authenticationManager)

         .userDetailsService(authUserDetailService)

         .authorizationCodeServices(new JdbcAuthorizationCodeServices(dataSource))

         .reuseRefreshTokens(false)

         .userApprovalHandler(new AuthApprovalHandler())

         .exceptionTranslator(customWebResponseExceptionTranslator)

     ;

   }

curl -X POST http://localhost:8421/oauth/authorize -H 'Authorization: Bearer b7c2d63f-edff-4790-add9-0b69df7321b5' -d 'response_type=code&client_id=external&redirect_uri=http://www.baidu.com&state=123'

curl -X POST http://localhost:8421/oauth/token -d 'grant_type=authorization_code&client_id=external&client_secret=D524C1A0811DA49592F841085CC0063EB62B3001252A94542795D1CA9824A941&redirect_uri=http://www.baidu.com&code=4TCYkV'

curl -X POST https://wuxi.test.brightcns.cn/api/v2/user/external/info -H 'Authorization: Bearer e86d752e-8d72-4a33-aa98-8e158ac5b50b'

{"success":true,"msg":"success","code":"SUCCESS","data":{"userId":,"phone":,"nickname":"","avatar":"http://wxcardoss.oss-cn-shanghai.aliyuncs.com/null","realName":null,"extendParam":null}}