There is no client authentication. Try adding an appropriate authentication filter
//You should check WebSecurityConfigurerAdapter method like this:
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("/webjars/**", "/oauth/**");
}
//remove "/oauth/**" path. otherwise
//.postAccessToken(Principal principal, @RequestParam Map<String, String> parameters)
//principal will be null.