Change password grant to implicit grant with Spring Security

I have a working Spring Boot 1.3.1 application with an AngularJS client using the "password" grant type with OAuth2. I know this is not very good as the client_id and client_secret are visible in the AngularJS code by everybody.

I would like to change to the "implicit" grant. My authorisation server and resource server are running in the same application.

This is my current configuration of the authorisation server:

@Configuration
    @EnableAuthorizationServer
    protected static class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {

        @Autowired
        private MyApplicationSecuritySettings securitySettings;

        @Autowired
        private AuthenticationManager authenticationManager;

        @Autowired
        private UserDetailsService userDetailsService;

        @Autowired
        private PasswordEncoder passwordEncoder;

        @Autowired
        private DataSource dataSource;

        @Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
            clients.inMemory()                       
                   .withClient(securitySettings.getAngularClientId())
                   .authorizedGrantTypes("password","refresh_token")
                   .scopes("read", "write")
                   .resourceIds(RESOURCE_ID)
                   .secret(passwordEncoder.encode(securitySettings.getAngularClientSecret()));

        }

        @Override
        public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
            endpoints.tokenStore(tokenStore())
                     .authenticationManager(authenticationManager)
                     .userDetailsService(userDetailsService);
        }

        @Override
        public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
            security.passwordEncoder(passwordEncoder);
        }

        @Bean
        @Primary
        public DefaultTokenServices tokenServices() {
            DefaultTokenServices tokenServices = new DefaultTokenServices();
            tokenServices.setSupportRefreshToken(true);
            tokenServices.setTokenStore(tokenStore());
            return tokenServices;
        }

        @Bean
        public TokenStore tokenStore() {
            return new JdbcTokenStore(dataSource) {

                // Workaround for https://github.com/spring-projects/spring-boot/issues/5071

                @Override
                protected OAuth2Authentication deserializeAuthentication(byte[] authentication) {
                    ObjectInputStream input = null;
                    try {
                        input = new ConfigurableObjectInputStream(
                                new ByteArrayInputStream(authentication),
                                Thread.currentThread().getContextClassLoader());
                        return (OAuth2Authentication) input.readObject();
                    } catch (Exception ex) {
                        throw new IllegalArgumentException(ex);
                    } finally {
                        if (input != null) {
                            try {
                                input.close();
                            } catch (IOException ex) {
                                // Continue
                            }
                        }
                    }
                }
            };
        }
    }

I also have this WebSecurityConfigurerAdapter subclass:

@Configuration
@EnableWebSecurity
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserDetailsService userDetailsService;
    @Autowired
    private PasswordEncoder passwordEncoder;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService)
            .passwordEncoder(passwordEncoder);
    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        // Disable security for bower components
        web.ignoring().antMatchers("/components/**");
    }

    @Override
    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }
}

and this is the configuration of the resource server:

@Configuration
@EnableResourceServer
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter {
    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        resources.resourceId(RESOURCE_ID);
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {

        http
                .authorizeRequests()
                .antMatchers("/admin", "/admin/", "/index.html", "/home.html", "/", "/logout",
                             "/partials/login.html"
                )
                .permitAll()                   
                .authorizeRequests()
                .antMatchers("/management/**").hasRole("ADMIN")
                .anyRequest().authenticated();
    }
}

With this configuration, a token can be requested via /oauth/token. This is implemented in AngularJS when the user visits http://localhost:8080/admin/#/login and types his username and password in that HTML form.

For the implicit grant, I am changing the ClientDetailsServiceConfigurer to:

@Override
        public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
            clients.inMemory()                       
                   .withClient(securitySettings.getAngularClientId())
                   .authorizedGrantTypes("implicit")
                   .scopes("read", "write")
                   .resourceIds(RESOURCE_ID);                       
        }

If I then try the following url: http://localhost:8080/oauth/authorize?client_id=angularClient&response_type=token

The browser redirects to http://localhost:8080/login and shows:

<oauth>
<error_description>Full authentication is required to access this resource</error_description>
<error>unauthorized</error>
</oauth>

Am I testing this implicit flow wrongly?

Do I need to change something in the configuration so that the redirect goes to http://localhost:8080/admin/#/login instead? Or does the angular app need to go from http://localhost:8080/admin/#/login to http://localhost:8080/oauth/authorize passing in the user's username and password somewhere?