From df589b39df6d8f4523ff9b6e0d4af2d661d5e5b9 Mon Sep 17 00:00:00 2001
From: Justin Richer <jricher@mitre.org>
Date: Tue, 21 Jan 2014 20:54:01 -0500
Subject: [PATCH] added "OPTIONS" option to /token filter with no auth,
 addresses #527

---
 .../src/main/webapp/WEB-INF/application-context.xml         | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/openid-connect-server-webapp/src/main/webapp/WEB-INF/application-context.xml b/openid-connect-server-webapp/src/main/webapp/WEB-INF/application-context.xml
index b4cdc0e31..e68622716 100644
--- a/openid-connect-server-webapp/src/main/webapp/WEB-INF/application-context.xml
+++ b/openid-connect-server-webapp/src/main/webapp/WEB-INF/application-context.xml
@@ -66,9 +66,11 @@
 	<security:http pattern="/token" 
 		create-session="stateless"
 		authentication-manager-ref="clientAuthenticationManager"
-		entry-point-ref="oauthAuthenticationEntryPoint">
+		entry-point-ref="oauthAuthenticationEntryPoint"
+		user-expressions="true">
 		
-		<security:intercept-url pattern="/token" access="IS_AUTHENTICATED_FULLY" />
+		<security:intercept-url pattern="/token" access="permitAll" method="OPTIONS" /> <!-- allow OPTIONS calls without auth for CORS stuff -->
+		<security:intercept-url pattern="/token" access="isAuthenticated()" />
 		<security:anonymous enabled="false" />
 		<security:http-basic entry-point-ref="oauthAuthenticationEntryPoint" />
 		<!-- include this only if you need to authenticate clients via request parameters -->