diff --git a/gateway-service-knoxtoken/src/main/java/org/apache/knox/gateway/service/knoxtoken/OAuthResource.java b/gateway-service-knoxtoken/src/main/java/org/apache/knox/gateway/service/knoxtoken/OAuthResource.java
new file mode 100644
index 0000000..71cf28b
--- /dev/null
+++ b/gateway-service-knoxtoken/src/main/java/org/apache/knox/gateway/service/knoxtoken/OAuthResource.java
@@ -0,0 +1,133 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.service.knoxtoken;
+
+import org.apache.knox.gateway.i18n.messages.MessagesFactory;
+import org.apache.knox.gateway.util.JsonUtils;
+
+import javax.inject.Singleton;
+import javax.ws.rs.GET;
+import javax.ws.rs.POST;
+import javax.ws.rs.Path;
+import javax.ws.rs.Produces;
+import javax.ws.rs.core.Response;
+
+import java.time.Duration;
+import java.time.format.DateTimeParseException;
+import java.util.HashMap;
+
+import static javax.ws.rs.core.MediaType.APPLICATION_JSON;
+import static javax.ws.rs.core.MediaType.APPLICATION_XML;
+
+@Singleton
+@Path(OAuthResource.RESOURCE_PATH)
+public class OAuthResource extends TokenResource {
+    private static TokenServiceMessages log = MessagesFactory.get(TokenServiceMessages.class);
+    static final String RESOURCE_PATH = "/{serviceName:.*}/v1/{oauthSegment:(oauth|token)}{path:(/tokens)?}";
+    public static final String ISSUED_TOKEN_TYPE = "issued_token_type";
+    public static final String REFRESH_TOKEN = "refresh_token";
+    public static final String ISSUED_TOKEN_TYPE_ACCESS_TOKEN_VALUE = "urn:ietf:params:oauth:token-type:access_token";
+
+    @Override
+    @GET
+    @Produces({ APPLICATION_JSON, APPLICATION_XML })
+    public Response doGet() {
+        return super.doGet();
+    }
+
+    @Override
+    @POST
+    @Produces({ APPLICATION_JSON, APPLICATION_XML })
+    public Response doPost() {
+        return super.doPost();
+    }
+
+    @Override
+    public Response getAuthenticationToken() {
+
+        Response response = enforceClientCertIfRequired();
+        if (response != null) { return response; }
+
+        response = onlyAllowGroupsToBeAddedWhenEnabled();
+        if (response != null) { return response; }
+
+        UserContext context = buildUserContext(request);
+
+        response = enforceTokenLimitsAsRequired(context.userName);
+        if (response != null) { return response; }
+
+        TokenResponseContext resp = getTokenResponse(context);
+        // if the responseMap isn't null then the knoxtoken request was successful
+        // if not then there may have been an error and the underlying response
+        // builder will communicate those details
+        if (resp.responseMap != null) {
+            // let's get the subset of the KnoxToken Response needed for OAuth
+            String accessToken = resp.responseMap.accessToken;
+            String passcode = resp.responseMap.passcode;
+            long expires = (long) resp.responseMap.map.get(EXPIRES_IN);
+            String tokenType = (String) resp.responseMap.map.get(TOKEN_TYPE);
+
+            // build and return the expected OAuth response
+            final HashMap<String, Object> map = new HashMap<>();
+            map.put(ACCESS_TOKEN, accessToken);
+            map.put(TOKEN_TYPE, tokenType);
+            map.put(EXPIRES_IN, expires);
+            map.put(ISSUED_TOKEN_TYPE, ISSUED_TOKEN_TYPE_ACCESS_TOKEN_VALUE);
+            // let's use the passcode as the refresh token
+            map.put(REFRESH_TOKEN, passcode);
+            String jsonResponse = JsonUtils.renderAsJsonString(map);
+            return resp.responseBuilder.entity(jsonResponse).build();
+        }
+        // there was an error if we got here - let's surface it appropriately
+        // TODO: LJM we may need to translate certain errors into OAuth error messages
+        if (resp.responseStr != null) {
+            return resp.responseBuilder.entity(resp.responseStr).build();
+        }
+        else {
+            return resp.responseBuilder.build();
+        }
+    }
+
+    @Override
+    protected long getExpiry() {
+        long secs = tokenTTL/1000;
+
+        String lifetimeStr = request.getParameter(LIFESPAN);
+        if (lifetimeStr == null || lifetimeStr.isEmpty()) {
+            if (tokenTTL == -1) {
+                return -1;
+            }
+        }
+        else {
+            try {
+                long lifetime = Duration.parse(lifetimeStr).toMillis()/1000;
+                if (tokenTTL == -1) {
+                    // if TTL is set to -1 the topology owner grants unlimited lifetime therefore no additional check is needed on lifespan
+                    secs = lifetime;
+                } else if (lifetime <= tokenTTL/1000) {
+                    //this is expected due to security reasons: the configured TTL acts as an upper limit regardless of the supplied lifespan
+                    secs = lifetime;
+                }
+            }
+            catch (DateTimeParseException e) {
+                log.invalidLifetimeValue(lifetimeStr);
+            }
+        }
+        return secs;
+    }
+}
diff --git a/gateway-service-knoxtoken/src/main/java/org/apache/knox/gateway/service/knoxtoken/TokenResource.java b/gateway-service-knoxtoken/src/main/java/org/apache/knox/gateway/service/knoxtoken/TokenResource.java
index 8698ce8..b5703ae 100644
--- a/gateway-service-knoxtoken/src/main/java/org/apache/knox/gateway/service/knoxtoken/TokenResource.java
+++ b/gateway-service-knoxtoken/src/main/java/org/apache/knox/gateway/service/knoxtoken/TokenResource.java
@@ -108,15 +108,15 @@
 public class TokenResource {
   static final String LIFESPAN = "lifespan";
   static final String COMMENT = "comment";
-  private static final String EXPIRES_IN = "expires_in";
-  private static final String TOKEN_TYPE = "token_type";
-  private static final String ACCESS_TOKEN = "access_token";
-  private static final String TOKEN_ID = "token_id";
+  protected static final String EXPIRES_IN = "expires_in";
+  protected static final String TOKEN_TYPE = "token_type";
+  protected static final String ACCESS_TOKEN = "access_token";
+  protected static final String TOKEN_ID = "token_id";
   static final String PASSCODE = "passcode";
-  private static final String MANAGED_TOKEN = "managed";
+  protected static final String MANAGED_TOKEN = "managed";
   private static final String TARGET_URL = "target_url";
   private static final String ENDPOINT_PUBLIC_CERT = "endpoint_public_cert";
-  private static final String BEARER = "Bearer";
+  protected static final String BEARER = "Bearer";
   private static final String TOKEN_PARAM_PREFIX = "knox.token.";
   private static final String TOKEN_TTL_PARAM = TOKEN_PARAM_PREFIX + "ttl";
   private static final String TOKEN_TYPE_PARAM = TOKEN_PARAM_PREFIX + "type";
@@ -160,7 +160,7 @@
   public static final String KNOX_TOKEN_ISSUER = TOKEN_PARAM_PREFIX + "issuer";
   private static TokenServiceMessages log = MessagesFactory.get(TokenServiceMessages.class);
   private static final Gson GSON = new Gson();
-  private long tokenTTL = TOKEN_TTL_DEFAULT;
+  protected long tokenTTL = TOKEN_TTL_DEFAULT;
   private String tokenType;
   private String tokenTTLAsText;
   private List<String> targetAudiences = new ArrayList<>();
@@ -172,7 +172,7 @@
   private String endpointPublicCert;
 
   // Optional token store service
-  private TokenStateService tokenStateService;
+  protected TokenStateService tokenStateService;
   private TokenMAC tokenMAC;
   private final Map<String, String> tokenStateServiceStatusMap = new HashMap<>();
 
@@ -185,6 +185,7 @@
   private String tokenIssuer;
 
   enum UserLimitExceededAction {REMOVE_OLDEST, RETURN_ERROR};
+
   private UserLimitExceededAction userLimitExceededAction = UserLimitExceededAction.RETURN_ERROR;
 
   private List<String> allowedRenewers;
@@ -362,7 +363,7 @@
       final GatewayConfig config = (GatewayConfig) request.getServletContext().getAttribute(GatewayConfig.GATEWAY_CONFIG_ATTRIBUTE);
       final String configuredTokenStateServiceImpl = config.getServiceParameter(ServiceType.TOKEN_STATE_SERVICE.getShortName(), "impl");
       final String configuredTokenServiceName = StringUtils.isBlank(configuredTokenStateServiceImpl) ? ""
-          : configuredTokenStateServiceImpl.substring(configuredTokenStateServiceImpl.lastIndexOf('.') + 1);
+              : configuredTokenStateServiceImpl.substring(configuredTokenStateServiceImpl.lastIndexOf('.') + 1);
       final String actualTokenStateServiceImpl = tokenStateService.getClass().getCanonicalName();
       final String actualTokenServiceName = actualTokenStateServiceImpl.substring(actualTokenStateServiceImpl.lastIndexOf('.') + 1);
       tokenStateServiceStatusMap.put(TSS_STATUS_CONFIFURED_BACKEND, configuredTokenServiceName);
@@ -483,7 +484,7 @@
         tokens.addAll(userTokens);
       } else {
         userTokens.forEach(knoxToken -> {
-          for (Map.Entry<String,  List<String>> entry : metadataMap.entrySet()) {
+          for (Map.Entry<String, List<String>> entry : metadataMap.entrySet()) {
             if (entry.getValue().contains("*")) {
               // we should only filter tokens by metadata name
               if (knoxToken.hasMetadata(entry.getKey())) {
@@ -504,15 +505,15 @@
 
   @GET
   @Path(GET_TSS_STATUS_PATH)
-  @Produces({ APPLICATION_JSON })
+  @Produces({APPLICATION_JSON})
   public Response getTokenStateServiceStatus() {
     return Response.status(Response.Status.OK).entity(JsonUtils.renderAsJsonString(tokenStateServiceStatusMap)).build();
   }
 
   /**
    * @deprecated This method is no longer acceptable for token renewal. Please
-   *             use the '/knoxtoken/v2/api/token/renew' path; instead which is a
-   *             PUT HTTP request.
+   * use the '/knoxtoken/v2/api/token/renew' path; instead which is a
+   * PUT HTTP request.
    */
   @POST
   @Path(RENEW_PATH)
@@ -523,8 +524,8 @@
 
     long expiration = 0;
 
-    String          error       = "";
-    ErrorCode       errorCode   = ErrorCode.UNKNOWN;
+    String error = "";
+    ErrorCode errorCode = ErrorCode.UNKNOWN;
     Response.Status errorStatus = Response.Status.BAD_REQUEST;
 
     if (tokenStateService == null) {
@@ -532,8 +533,8 @@
       try {
         JWTToken jwt = new JWTToken(token);
         log.renewalDisabled(getTopologyName(),
-                            Tokens.getTokenDisplayText(token),
-                            Tokens.getTokenIDDisplayText(TokenUtils.getTokenId(jwt)));
+                Tokens.getTokenDisplayText(token),
+                Tokens.getTokenIDDisplayText(TokenUtils.getTokenId(jwt)));
         expiration = Long.parseLong(jwt.getExpires());
       } catch (ParseException e) {
         log.invalidToken(getTopologyName(), Tokens.getTokenDisplayText(token), e);
@@ -571,15 +572,15 @@
       }
     }
 
-    if(error.isEmpty()) {
-      resp =  Response.status(Response.Status.OK)
-                      .entity("{\n  \"renewed\": \"true\",\n  \"expires\": \"" + expiration + "\"\n}\n")
-                      .build();
+    if (error.isEmpty()) {
+      resp = Response.status(Response.Status.OK)
+              .entity("{\n  \"renewed\": \"true\",\n  \"expires\": \"" + expiration + "\"\n}\n")
+              .build();
     } else {
       log.badRenewalRequest(getTopologyName(), Tokens.getTokenDisplayText(token), error);
       resp = Response.status(errorStatus)
-                     .entity("{\n  \"renewed\": \"false\",\n  \"error\": \"" + error + "\",\n  \"code\": " + errorCode.toInt() + "\n}\n")
-                     .build();
+              .entity("{\n  \"renewed\": \"false\",\n  \"error\": \"" + error + "\",\n  \"code\": " + errorCode.toInt() + "\n}\n")
+              .build();
     }
 
     return resp;
@@ -603,8 +604,8 @@
 
   /**
    * @deprecated This method is no longer acceptable for token revocation. Please
-   *             use the '/knoxtoken/v2/api/token/revoke' path; instead which is a
-   *             DELETE HTTP request.
+   * use the '/knoxtoken/v2/api/token/revoke' path; instead which is a
+   * DELETE HTTP request.
    */
   @POST
   @Path(REVOKE_PATH)
@@ -613,8 +614,8 @@
   public Response revoke(String token) {
     Response resp;
 
-    String          error       = "";
-    ErrorCode       errorCode   = ErrorCode.UNKNOWN;
+    String error = "";
+    ErrorCode errorCode = ErrorCode.UNKNOWN;
     Response.Status errorStatus = Response.Status.BAD_REQUEST;
 
     if (tokenStateService == null) {
@@ -626,14 +627,14 @@
         final String tokenId = getTokenId(token);
         if (isKnoxSsoCookie(tokenId)) {
           errorStatus = Response.Status.FORBIDDEN;
-          error = "SSO cookie (" + Tokens.getTokenIDDisplayText(tokenId) + ") cannot not be revoked." ;
+          error = "SSO cookie (" + Tokens.getTokenIDDisplayText(tokenId) + ") cannot not be revoked.";
           errorCode = ErrorCode.UNAUTHORIZED;
         } else if (triesToRevokeOwnToken(tokenId, revoker) || allowedRenewers.contains(revoker)) {
           tokenStateService.revokeToken(tokenId);
           log.revokedToken(getTopologyName(),
-              Tokens.getTokenDisplayText(token),
-              Tokens.getTokenIDDisplayText(tokenId),
-              revoker);
+                  Tokens.getTokenDisplayText(token),
+                  Tokens.getTokenIDDisplayText(tokenId),
+                  revoker);
         } else {
           errorStatus = Response.Status.FORBIDDEN;
           error = "Caller (" + revoker + ") not authorized to revoke tokens.";
@@ -650,14 +651,14 @@
     }
 
     if (error.isEmpty()) {
-      resp =  Response.status(Response.Status.OK)
-                      .entity("{\n  \"revoked\": \"true\"\n}\n")
-                      .build();
+      resp = Response.status(Response.Status.OK)
+              .entity("{\n  \"revoked\": \"true\"\n}\n")
+              .build();
     } else {
       log.badRevocationRequest(getTopologyName(), Tokens.getTokenDisplayText(token), error);
       resp = Response.status(errorStatus)
-                     .entity("{\n  \"revoked\": \"false\",\n  \"error\": \"" + error + "\",\n  \"code\": " + errorCode.toInt() + "\n}\n")
-                     .build();
+              .entity("{\n  \"revoked\": \"false\",\n  \"error\": \"" + error + "\",\n  \"code\": " + errorCode.toInt() + "\n}\n")
+              .build();
     }
 
     return resp;
@@ -671,7 +672,7 @@
   private boolean triesToRevokeOwnToken(String tokenId, String revoker) throws UnknownTokenException {
     final TokenMetadata metadata = tokenStateService.getTokenMetadata(tokenId);
     final String tokenUserName = metadata == null ? "" : metadata.getUserName();
-    final String tokenCreatedBy =  metadata == null ? "" : metadata.getCreatedBy();
+    final String tokenCreatedBy = metadata == null ? "" : metadata.getCreatedBy();
     return StringUtils.isNotBlank(revoker) && (revoker.equals(tokenUserName) || revoker.equals(tokenCreatedBy));
   }
 
@@ -693,30 +694,30 @@
 
   @PUT
   @Path(ENABLE_PATH)
-  @Produces({ APPLICATION_JSON })
+  @Produces({APPLICATION_JSON})
   public Response enable(String tokenId) {
     return setTokenEnabledFlag(tokenId, true, false);
   }
 
   @PUT
   @Path(BATCH_ENABLE_PATH)
-  @Consumes({ APPLICATION_JSON })
-  @Produces({ APPLICATION_JSON })
+  @Consumes({APPLICATION_JSON})
+  @Produces({APPLICATION_JSON})
   public Response enableTokens(String tokenIds) {
     return setTokenEnabledFlags(tokenIds, true);
   }
 
   @PUT
   @Path(DISABLE_PATH)
-  @Produces({ APPLICATION_JSON })
+  @Produces({APPLICATION_JSON})
   public Response disable(String tokenId) {
     return setTokenEnabledFlag(tokenId, false, false);
   }
 
   @PUT
   @Path(BATCH_DISABLE_PATH)
-  @Consumes({ APPLICATION_JSON })
-  @Produces({ APPLICATION_JSON })
+  @Consumes({APPLICATION_JSON})
+  @Produces({APPLICATION_JSON})
   public Response disableTokens(String tokenIds) {
     return setTokenEnabledFlags(tokenIds, false);
   }
@@ -780,26 +781,97 @@
     return null;
   }
 
-  private Response getAuthenticationToken() {
-    if (clientCertRequired) {
-      X509Certificate cert = extractCertificate(request);
-      if (cert != null) {
-        if (!allowedDNs.contains(cert.getSubjectDN().getName().replaceAll("\\s+", ""))) {
-          return Response.status(Response.Status.FORBIDDEN)
-                         .entity("{ \"Unable to get token - untrusted client cert.\" }")
-                         .build();
-        }
+  protected Response getAuthenticationToken() {
+    Response response = enforceClientCertIfRequired();
+    if (response != null) { return response; }
+
+    response = onlyAllowGroupsToBeAddedWhenEnabled();
+    if (response != null) { return response; }
+
+    UserContext context = buildUserContext(request);
+
+    response = enforceTokenLimitsAsRequired(context.userName);
+    if (response != null) { return response; }
+
+    TokenResponseContext resp = getTokenResponse(context);
+    return resp.build();
+  }
+
+  protected TokenResponseContext getTokenResponse(UserContext context) {
+    TokenResponseContext response = null;
+    long expires = getExpiry();
+    setupPublicCertPEM();
+    String jku = getJku();
+    try
+    {
+      JWT token = getJWT(context.userName, expires, jku);
+      if (token != null) {
+        ResponseMap result = buildResponseMap(token, expires);
+        String jsonResponse = JsonUtils.renderAsJsonString(result.map);
+        persistTokenDetails(result, expires, context.userName, context.createdBy);
+
+        response = new TokenResponseContext(result, jsonResponse, Response.ok());
       } else {
-        return Response.status(Response.Status.FORBIDDEN)
-                       .entity("{ \"Unable to get token - client cert required.\" }")
-                       .build();
+        response = new TokenResponseContext(null, null, Response.serverError());
       }
+    } catch (TokenServiceException e) {
+      log.unableToIssueToken(e);
+      response = new TokenResponseContext(null
+              , "{ \"Unable to acquire token.\" }"
+              , Response.serverError());
     }
-    GatewayServices services = (GatewayServices) request.getServletContext()
+    return response;
+  }
+
+  protected static class TokenResponseContext {
+    public ResponseMap responseMap;
+    public String responseStr;
+    public Response.ResponseBuilder responseBuilder;
+
+    public TokenResponseContext(ResponseMap respMap, String resp, Response.ResponseBuilder builder) {
+      responseMap = respMap;
+      responseStr = resp;
+      responseBuilder = builder;
+    }
+
+    public Response build() {
+      Response response = null;
+      if (responseStr != null) {
+        response = responseBuilder.entity(responseStr).build();
+      } else {
+        response = responseBuilder.build();
+      }
+      return response;
+    }
+  }
+
+  protected GatewayServices getGatewayServices() {
+      return (GatewayServices) request.getServletContext()
         .getAttribute(GatewayServices.GATEWAY_SERVICES_ATTRIBUTE);
+  }
 
-    JWTokenAuthority ts = services.getService(ServiceType.TOKEN_SERVICE);
+  protected String getJku() {
+    String jku = null;
+    /* remove .../token and replace it with ..../jwks.json */
+    final int idx = request.getRequestURL().lastIndexOf("/");
+    if(idx > 1) {
+      jku = request.getRequestURL().substring(0, idx) + JWKSResource.JWKS_PATH;
+    }
+    return jku;
+  }
 
+  protected Response onlyAllowGroupsToBeAddedWhenEnabled() {
+    Response response = null;
+    if (shouldIncludeGroups() && !includeGroupsInTokenAllowed) {
+      response = Response
+              .status(Response.Status.BAD_REQUEST)
+              .entity("{\n  \"error\": \"Including group information in tokens is disabled\"\n}\n")
+              .build();
+    }
+    return response;
+  }
+
+  protected UserContext buildUserContext(HttpServletRequest request) {
     String userName = request.getUserPrincipal().getName();
     String createdBy = null;
     // checking the doAs user only makes sense if tokens are managed (this is where we store the userName/createdBy information)
@@ -816,9 +888,52 @@
         }
       }
     }
+    return new UserContext(userName, createdBy);
+  }
 
-    long expires = getExpiry();
+  protected static class UserContext {
+    public final String userName;
+    public final String createdBy;
 
+    public UserContext(String userName, String createdBy) {
+      this.userName = userName;
+      this.createdBy = createdBy;
+    }
+  }
+
+  protected Response enforceTokenLimitsAsRequired(String userName) {
+    Response response = null;
+    if (tokenStateService != null) {
+      if (tokenLimitPerUser != -1) { // if -1 => unlimited tokens for all users
+        final Collection<KnoxToken> allUserTokens = tokenStateService.getTokens(userName);
+        final Collection<KnoxToken> userTokens = new LinkedList<>();
+        allUserTokens.stream().forEach(token -> {
+          if(!token.getMetadata().isKnoxSsoCookie()) {
+            userTokens.add(token);
+          }
+        });
+        if (userTokens.size() >= tokenLimitPerUser) {
+          log.tokenLimitExceeded(userName);
+          if (UserLimitExceededAction.RETURN_ERROR == userLimitExceededAction) {
+            response = Response.status(Response.Status.FORBIDDEN).entity("{ \"Unable to get token - token limit exceeded.\" }").build();
+          } else {
+            // userTokens is an ordered collection (by issue time) -> the first element is the oldest one
+            final String oldestTokenId = userTokens.iterator().next().getTokenId();
+            log.generalInfoMessage(String.format(Locale.getDefault(), "Revoking %s's oldest token %s ...", userName, Tokens.getTokenIDDisplayText(oldestTokenId)));
+            final Response revocationResponse = revoke(oldestTokenId);
+            if (Response.Status.OK.getStatusCode() != revocationResponse.getStatus()) {
+              response = Response.status(Response.Status.fromStatusCode(revocationResponse.getStatus()))
+                  .entity("{\n  \"error\": \"An error occurred during the oldest token revocation of " + userName + " \"\n}\n").build();
+            }
+           }
+        }
+      }
+    }
+    return response;
+  }
+
+  protected void setupPublicCertPEM() {
+    GatewayServices services = getGatewayServices();
     if (endpointPublicCert == null) {
       // acquire PEM for gateway identity of this gateway instance
       KeystoreService ks = services.getService(ServiceType.KEYSTORE_SERVICE);
@@ -833,125 +948,115 @@
         }
       }
     }
+  }
 
-    String jku = null;
-    /* remove .../token and replace it with ..../jwks.json */
-    final int idx = request.getRequestURL().lastIndexOf("/");
-    if(idx > 1) {
-      jku = request.getRequestURL().substring(0, idx) + JWKSResource.JWKS_PATH;
-    }
-
-    if (tokenStateService != null) {
-      if (tokenLimitPerUser != -1) { // if -1 => unlimited tokens for all users
-        final Collection<KnoxToken> allUserTokens = tokenStateService.getTokens(userName);
-        final Collection<KnoxToken> userTokens = new LinkedList<>();
-        allUserTokens.stream().forEach(token -> {
-          if(!token.getMetadata().isKnoxSsoCookie()) {
-            userTokens.add(token);
-          }
-        });
-        if (userTokens.size() >= tokenLimitPerUser) {
-          log.tokenLimitExceeded(userName);
-          if (UserLimitExceededAction.RETURN_ERROR == userLimitExceededAction) {
-            return Response.status(Response.Status.FORBIDDEN).entity("{ \"Unable to get token - token limit exceeded.\" }").build();
-          } else {
-            // userTokens is an ordered collection (by issue time) -> the first element is the oldest one
-            final String oldestTokenId = userTokens.iterator().next().getTokenId();
-            log.generalInfoMessage(String.format(Locale.getDefault(), "Revoking %s's oldest token %s ...", userName, Tokens.getTokenIDDisplayText(oldestTokenId)));
-            final Response revocationResponse = revoke(oldestTokenId);
-            if (Response.Status.OK.getStatusCode() != revocationResponse.getStatus()) {
-              return Response.status(Response.Status.fromStatusCode(revocationResponse.getStatus()))
-                  .entity("{\n  \"error\": \"An error occurred during the oldest token revocation of " + userName + " \"\n}\n").build();
-            }
-           }
+  protected Response enforceClientCertIfRequired() {
+    Response response = null;
+    if (clientCertRequired) {
+      X509Certificate cert = extractCertificate(request);
+      if (cert != null) {
+        if (!allowedDNs.contains(cert.getSubjectDN().getName().replaceAll("\\s+", ""))) {
+          response = Response.status(Response.Status.FORBIDDEN)
+                         .entity("{ \"Unable to get token - untrusted client cert.\" }")
+                         .build();
         }
-      }
-    }
-
-    try {
-      final boolean managedToken = tokenStateService != null;
-      JWT token;
-      JWTokenAttributes jwtAttributes;
-      final JWTokenAttributesBuilder jwtAttributesBuilder = new JWTokenAttributesBuilder();
-      jwtAttributesBuilder
-          .setIssuer(tokenIssuer)
-          .setUserName(userName)
-          .setAlgorithm(signatureAlgorithm)
-          .setExpires(expires)
-          .setManaged(managedToken)
-          .setJku(jku)
-          .setType(tokenType);
-      if (!targetAudiences.isEmpty()) {
-        jwtAttributesBuilder.setAudiences(targetAudiences);
-      }
-      if (shouldIncludeGroups()) {
-        if (includeGroupsInTokenAllowed) {
-          jwtAttributesBuilder.setGroups(groups());
-        } else {
-          return Response
-                  .status(Response.Status.BAD_REQUEST)
-                  .entity("{\n  \"error\": \"Including group information in tokens is disabled\"\n}\n")
-                  .build();
-        }
-      }
-
-      jwtAttributes = jwtAttributesBuilder.build();
-      token = ts.issueToken(jwtAttributes);
-
-      if (token != null) {
-        String accessToken = token.toString();
-        String tokenId = TokenUtils.getTokenId(token);
-        log.issuedToken(getTopologyName(), Tokens.getTokenDisplayText(accessToken), Tokens.getTokenIDDisplayText(tokenId));
-
-        final HashMap<String, Object> map = new HashMap<>();
-        map.put(ACCESS_TOKEN, accessToken);
-        map.put(TOKEN_ID, tokenId);
-        map.put(MANAGED_TOKEN, String.valueOf(managedToken));
-        map.put(TOKEN_TYPE, BEARER);
-        map.put(EXPIRES_IN, expires);
-        if (tokenTargetUrl != null) {
-          map.put(TARGET_URL, tokenTargetUrl);
-        }
-        if (tokenClientDataMap != null) {
-          map.putAll(tokenClientDataMap);
-        }
-        if (endpointPublicCert != null) {
-          map.put(ENDPOINT_PUBLIC_CERT, endpointPublicCert);
-        }
-
-        final String passcode = UUID.randomUUID().toString();
-        if (tokenStateService != null && tokenStateService instanceof PersistentTokenStateService) {
-          map.put(PASSCODE, generatePasscodeField(tokenId, passcode));
-        }
-
-        String jsonResponse = JsonUtils.renderAsJsonString(map);
-
-        // Optional token store service persistence
-        if (tokenStateService != null) {
-          final long issueTime = System.currentTimeMillis();
-          tokenStateService.addToken(tokenId,
-                                     issueTime,
-                                     expires,
-                                     maxTokenLifetime.orElse(tokenStateService.getDefaultMaxLifetimeDuration()));
-          final String comment = request.getParameter(COMMENT);
-          final TokenMetadata tokenMetadata = new TokenMetadata(userName, StringUtils.isBlank(comment) ? null : comment);
-          tokenMetadata.setPasscode(tokenMAC.hash(tokenId, issueTime, userName, passcode));
-          addArbitraryTokenMetadata(tokenMetadata);
-          if (createdBy != null) {
-            tokenMetadata.setCreatedBy(createdBy);
-          }
-          tokenStateService.addMetadata(tokenId, tokenMetadata);
-          log.storedToken(getTopologyName(), Tokens.getTokenDisplayText(accessToken), Tokens.getTokenIDDisplayText(tokenId));
-        }
-
-        return Response.ok().entity(jsonResponse).build();
       } else {
-        return Response.serverError().build();
+        response = Response.status(Response.Status.FORBIDDEN)
+                       .entity("{ \"Unable to get token - client cert required.\" }")
+                       .build();
       }
-    } catch (TokenServiceException e) {
-      log.unableToIssueToken(e);
     }
-    return Response.ok().entity("{ \"Unable to acquire token.\" }").build();
+    return response;
+  }
+
+  protected void persistTokenDetails(ResponseMap result, long expires, String userName, String createdBy) {
+    // Optional token store service persistence
+    if (tokenStateService != null) {
+      final long issueTime = System.currentTimeMillis();
+      tokenStateService.addToken(result.tokenId,
+                                 issueTime,
+              expires,
+                                 maxTokenLifetime.orElse(tokenStateService.getDefaultMaxLifetimeDuration()));
+      final String comment = request.getParameter(COMMENT);
+      final TokenMetadata tokenMetadata = new TokenMetadata(userName, StringUtils.isBlank(comment) ? null : comment);
+      tokenMetadata.setPasscode(tokenMAC.hash(result.tokenId, issueTime, userName, result.passcode));
+      addArbitraryTokenMetadata(tokenMetadata);
+      if (createdBy != null) {
+        tokenMetadata.setCreatedBy(createdBy);
+      }
+      tokenStateService.addMetadata(result.tokenId, tokenMetadata);
+      log.storedToken(getTopologyName(), Tokens.getTokenDisplayText(result.accessToken), Tokens.getTokenIDDisplayText(result.tokenId));
+    }
+  }
+
+  protected ResponseMap buildResponseMap(JWT token, long expires) {
+    String accessToken = token.toString();
+    String tokenId = TokenUtils.getTokenId(token);
+    final boolean managedToken = tokenStateService != null;
+
+    log.issuedToken(getTopologyName(), Tokens.getTokenDisplayText(accessToken), Tokens.getTokenIDDisplayText(tokenId));
+
+    final Map<String, Object> map = new HashMap<>();
+    map.put(ACCESS_TOKEN, accessToken);
+    map.put(TOKEN_ID, tokenId);
+    map.put(MANAGED_TOKEN, String.valueOf(managedToken));
+    map.put(TOKEN_TYPE, BEARER);
+    map.put(EXPIRES_IN, expires);
+    if (tokenTargetUrl != null) {
+      map.put(TARGET_URL, tokenTargetUrl);
+    }
+    if (tokenClientDataMap != null) {
+      map.putAll(tokenClientDataMap);
+    }
+    if (endpointPublicCert != null) {
+      map.put(ENDPOINT_PUBLIC_CERT, endpointPublicCert);
+    }
+
+    final String passcode = UUID.randomUUID().toString();
+    if (tokenStateService != null && tokenStateService instanceof PersistentTokenStateService) {
+      map.put(PASSCODE, generatePasscodeField(tokenId, passcode));
+    }
+    return new ResponseMap(accessToken, tokenId, map, passcode);
+  }
+
+  protected static class ResponseMap {
+    public final String accessToken;
+    public final String tokenId;
+    public final Map<String, Object> map;
+    public final String passcode;
+
+    public ResponseMap(String accessToken, String tokenId, Map<String, Object> map, String passcode) {
+      this.accessToken = accessToken;
+      this.tokenId = tokenId;
+      this.map = map;
+      this.passcode = passcode;
+    }
+  }
+
+  protected JWT getJWT(String userName, long expires, String jku) throws TokenServiceException {
+    JWTokenAttributes jwtAttributes;
+    JWT token;
+    JWTokenAuthority ts = getGatewayServices().getService(ServiceType.TOKEN_SERVICE);
+    final boolean managedToken = tokenStateService != null;
+    final JWTokenAttributesBuilder jwtAttributesBuilder = new JWTokenAttributesBuilder();
+    jwtAttributesBuilder
+        .setIssuer(tokenIssuer)
+        .setUserName(userName)
+        .setAlgorithm(signatureAlgorithm)
+        .setExpires(expires)
+        .setManaged(managedToken)
+        .setJku(jku)
+        .setType(tokenType);
+    if (!targetAudiences.isEmpty()) {
+      jwtAttributesBuilder.setAudiences(targetAudiences);
+    }
+    if (shouldIncludeGroups()) {
+      jwtAttributesBuilder.setGroups(groups());
+    }
+
+    jwtAttributes = jwtAttributesBuilder.build();
+    token = ts.issueToken(jwtAttributes);
+    return token;
   }
 
   private boolean shouldIncludeGroups() {
@@ -995,7 +1100,7 @@
     }
   }
 
-  private long getExpiry() {
+  protected long getExpiry() {
     long expiry = 0L;
     long millis = tokenTTL;
 
@@ -1004,8 +1109,7 @@
       if (tokenTTL == -1) {
         return -1;
       }
-    }
-    else {
+    } else {
       try {
         long lifetime = Duration.parse(lifetimeStr).toMillis();
         if (tokenTTL == -1) {
diff --git a/gateway-service-knoxtoken/src/main/java/org/apache/knox/gateway/service/knoxtoken/deploy/TokenServiceDeploymentContributor.java b/gateway-service-knoxtoken/src/main/java/org/apache/knox/gateway/service/knoxtoken/deploy/TokenServiceDeploymentContributor.java
index b46ddeb..e80db1d 100644
--- a/gateway-service-knoxtoken/src/main/java/org/apache/knox/gateway/service/knoxtoken/deploy/TokenServiceDeploymentContributor.java
+++ b/gateway-service-knoxtoken/src/main/java/org/apache/knox/gateway/service/knoxtoken/deploy/TokenServiceDeploymentContributor.java
@@ -40,6 +40,6 @@
 
   @Override
   protected String[] getPatterns() {
-    return new String[]{ "knoxtoken/api/**?**" };
+    return new String[]{ "knoxtoken/api/**?**", "/oauth/v1/token/", "/**/v1/oauth/tokens/" };
   }
 }
diff --git a/gateway-service-knoxtoken/src/test/java/org/apache/knox/gateway/service/knoxtoken/TokenServiceResourceTest.java b/gateway-service-knoxtoken/src/test/java/org/apache/knox/gateway/service/knoxtoken/TokenServiceResourceTest.java
index 169650e..b072b8d 100644
--- a/gateway-service-knoxtoken/src/test/java/org/apache/knox/gateway/service/knoxtoken/TokenServiceResourceTest.java
+++ b/gateway-service-knoxtoken/src/test/java/org/apache/knox/gateway/service/knoxtoken/TokenServiceResourceTest.java
@@ -1346,6 +1346,45 @@
     }
   }
 
+  @Test
+  public void testOAuthTokenResponse() throws Exception {
+    Map<String, String> contextExpectations = new HashMap<>();
+    configureCommonExpectations(contextExpectations, Boolean.TRUE);
+
+    OAuthResource or = new OAuthResource();
+    or.request = request;
+    or.context = context;
+    or.init();
+
+    Response response = or.doPost();
+    assertEquals(200, response.getStatus());
+
+    String accessToken = getTagValue(response.getEntity().toString(), TokenResource.ACCESS_TOKEN);
+    assertNotNull(accessToken);
+    String expiresIn = getTagValue(response.getEntity().toString(), TokenResource.EXPIRES_IN);
+    // default value for TTL for KNOXTOKEN is 30 secs - OAuth response has this in secs
+    assertEquals("30", expiresIn);
+    // there is no passcode or token_id in OAuth responses
+    String passcode = getTagValue(response.getEntity().toString(), TokenResource.PASSCODE);
+    assertNull(passcode);
+    String tokenId = getTagValue(response.getEntity().toString(), TokenResource.TOKEN_ID);
+    assertNull(tokenId);
+    String tokenType = getTagValue(response.getEntity().toString(), TokenResource.TOKEN_TYPE);
+    assertEquals(TokenResource.BEARER, tokenType);
+    // oauth requires issued token type so we are hardcoding this
+    String issuedTokenType = getTagValue(response.getEntity().toString(), OAuthResource.ISSUED_TOKEN_TYPE);
+    assertEquals(OAuthResource.ISSUED_TOKEN_TYPE_ACCESS_TOKEN_VALUE, issuedTokenType);
+    // oauth credentials flow sometimes requires a refresh token even though they can just get a
+    // new access_token with the client_id and client_secret. Since this token service can't actually
+    // assume the credentials flow is being used even though it is most likely, we will include the
+    // passcode as the refresh token
+    String refreshToken = getTagValue(response.getEntity().toString(), OAuthResource.REFRESH_TOKEN);
+    assertNotNull(refreshToken);
+
+    Map<String, Object> payload = parseJSONResponse(JWTToken.parseToken(accessToken).getPayload());
+    assertFalse(payload.containsKey(KNOX_GROUPS_CLAIM));
+  }
+
   /**
    *
    * @param isTokenStateServerManaged true, if server-side token state management should be enabled; Otherwise, false or null.
@@ -1621,7 +1660,7 @@
     if (!token.contains(tagName)) {
       return null;
     }
-    String searchString = tagName + "\":";
+    String searchString = "\"" + tagName + "\":";
     String value = token.substring(token.indexOf(searchString) + searchString.length());
     if (value.startsWith("\"")) {
       value = value.substring(1);