private MultiValueMap<String, String> getParametersForTokenRequest(
      AuthorizationCodeResourceDetails resource, OAuth2SecurityContext context) {

    MultiValueMap<String, String> form = new LinkedMultiValueMap<String, String>();
    form.add("grant_type", "authorization_code");
    form.add("code", context.getAuthorizationCode());

    String redirectUri = resource.getPreEstablishedRedirectUri();
    if (context != null && redirectUri == null) {
      // no pre-established redirect uri: use the preserved state
      // TODO: treat redirect URI as a special kind of state (this is a historical mini hack)
      redirectUri = String.valueOf(context.getPreservedState());
    } else {
      // TODO: the state key is what should be sent, not the value
      form.add("state", String.valueOf(context.getPreservedState()));
    }

    if (redirectUri == null) {
      // still no redirect uri? just try the one for the current context...
      redirectUri = context == null ? null : context.getUserAuthorizationRedirectUri();
    }

    form.add("redirect_uri", redirectUri);

    return form;
  }
  public OAuth2AccessToken obtainNewAccessToken(OAuth2ProtectedResourceDetails details)
      throws UserRedirectRequiredException, AccessDeniedException {

    AuthorizationCodeResourceDetails resource = (AuthorizationCodeResourceDetails) details;
    OAuth2SecurityContext context = OAuth2SecurityContextHolder.getContext();

    if (context != null && context.getErrorParameters() != null) {

      // there was an oauth error...
      throw getSerializationService().deserializeError(context.getErrorParameters());

    } else if (context == null || context.getAuthorizationCode() == null) {

      throw getRedirectForAuthorization(resource, context);

    } else {

      return retrieveToken(getParametersForTokenRequest(resource, context), resource);
    }
  }
  private UserRedirectRequiredException getRedirectForAuthorization(
      AuthorizationCodeResourceDetails resource, OAuth2SecurityContext context) {

    // we don't have an authorization code yet. So first get that.
    TreeMap<String, String> requestParameters = new TreeMap<String, String>();
    requestParameters.put("response_type", "code"); // oauth2 spec, section 3
    requestParameters.put("client_id", resource.getClientId());
    // Client secret is not required in the initial authorization request

    String redirectUri = resource.getPreEstablishedRedirectUri();
    if (redirectUri == null) {

      if (context == null) {
        throw new IllegalStateException(
            "No OAuth 2 security context has been established: unable to determine the redirect URI for the current context.");
      }
      redirectUri = context.getUserAuthorizationRedirectUri();
      if (redirectUri == null) {
        throw new IllegalStateException(
            "No redirect URI has been established for the current OAuth 2 security context.");
      }
      requestParameters.put("redirect_uri", redirectUri);

    } else {

      redirectUri = null;
    }

    if (resource.isScoped()) {

      StringBuilder builder = new StringBuilder();
      List<String> scope = resource.getScope();

      if (scope != null) {
        Iterator<String> scopeIt = scope.iterator();
        while (scopeIt.hasNext()) {
          builder.append(scopeIt.next());
          if (scopeIt.hasNext()) {
            builder.append(' ');
          }
        }
      }

      requestParameters.put("scope", builder.toString());
    }

    String stateKey = resource.getState();
    if (stateKey != null) {
      requestParameters.put("state", stateKey);
    }

    UserRedirectRequiredException redirectException =
        new UserRedirectRequiredException(resource.getUserAuthorizationUri(), requestParameters);

    if (redirectUri != null) {
      redirectException.setStateKey(resource.getState());
      redirectException.setStateToPreserve(redirectUri);
    }

    return redirectException;
  }