loopback-component-oauth2 not working

grant.client_credentials.js

/* /server/test/grant.client_credentials.js */
'use strict';

/* jshint camelcase: false */
var chai = require('chai');
chai.should();

var loopback = require('loopback');
var app = require('../server/server');
var request = require('supertest')('https://localhost:3000');

var TOKEN_ENDPOINT = '/oauth/token';
var CLIENT_ID = '456';
var CLIENT_SECRET = 'secret';

describe('Granting with client_credentials grant type', function() {
  before(require('./start-server'));

  // Create a permission
  before(function(done) {
    var permissionModel = loopback.getModel('OAuthPermission');
    permissionModel.destroyAll(function(err) {
      if (err) {
        return done(err);
      }
      permissionModel.create({
        appId: '456',
        userId: 1,
        issuedAt: new Date(),
      }, done);
    });
  });

  after(function(done) {
    app.close(done);
  });

  function requestAccessToken(payload, done) {
    request
    .post(TOKEN_ENDPOINT)
    .set('Content-Type', 'application/x-www-form-urlencoded')
    .send(payload)
    .auth(CLIENT_ID, CLIENT_SECRET)
    .expect(200, /"access_token":/i, function(err, res) {
      if (err) {
        return done(err);
      }
      res.body.access_token.should.be.a('string');
      res.body.access_token.should.have.length(32);
      res.body.token_type.should.equal('Bearer');
      res.body.expires_in.should.equal(1209600);
      done();
    });
  }

  it('should generate access token', function(done) {
    requestAccessToken({
      grant_type: 'client_credentials',
      scope: 'demo',
    }, done);
  });
});

middleware.json

  "auth": {
    "loopback-component-oauth2#authenticate": []
  },

model-config.json

{
  "_meta": {
    "sources": [
      "loopback/common/models",
      "loopback/server/models",
      "../common/models",
      "./models"
    ],
    "mixins": [
      "loopback/common/mixins",
      "loopback/server/mixins",
      "../common/mixins",
      "./mixins"
    ]
  },
  "User": {
    "dataSource": "db",
    "public": false
  },
  "Application": {
    "dataSource": "db",
    "public": false
  },
  "AccessToken": {
    "dataSource": "db",
    "public": false
  },
  "ACL": {
    "dataSource": "db",
    "public": false
  },
  "RoleMapping": {
    "dataSource": "db",
    "public": false
  },
  "Role": {
    "dataSource": "db",
    "public": false
  }
}

oauth.js

/* /server/boot/oauth.js */
'use strict';

var oauth2 = require('loopback-component-oauth2');

module.exports = function(server) {
  console.log('------------------------------------------------');
  console.log('[oAuth]: Initialized');

  var options = {
    dataSource: server.datasources.db, // Data source for oAuth2 metadata persistence
    authorizationServer: true,
    resourceServer: true,
  };

  oauth2.oAuth2Provider(
    server, // The app instance
    options // The options
  );
};

sample-data.json

{
  "users": [
    {
      "username": "bob",
      "password": "secret",
      "email": "[email protected]"
    }
  ],
  "applications": [
    {
      "id": 456,
      "clientSecret": "secret",
      "name": "test-app"
    },
  ]
}

adding dump of in-memory db data

{
  "ids": {
    "User": 2,
    "Application": 457,
    "AccessToken": 1,
    "ACL": 1,
    "RoleMapping": 1,
    "Role": 1
  },
  "models": {
    "User": {
      "1": "{\"username\":\"bob\",\"password\":\"$2a$10$3pN4bN9Ztx2AWBiQtdsVlewtclGVXE3DNJ2Nw6dlVszN0bLAk3s/m\",\"email\":\"[email protected]\",\"id\":1}"
    },
    "Application": {
      "456": "{\"id\":\"456\",\"name\":\"test-app\",\"clientKey\":\"b3b358c7dcffb4e020134465db4d52a0e74780ba\",\"javaScriptKey\":\"ee443a1248109f148d47e9cc25347bb3c0a96979\",\"restApiKey\":\"secret\",\"windowsKey\":\"4363cf452d3052548411eda1524354a36bb164a5\",\"masterKey\":\"e50858c86d1544189ed5bb62bc399ead6d04e8eb\",\"authenticationEnabled\":true,\"anonymousAllowed\":true,\"status\":\"sandbox\",\"created\":\"2017-01-16T22:54:00.052Z\",\"modified\":\"2017-01-16T22:54:00.052Z\",\"clientSecret\":\"secret\"}"
    },
    "AccessToken": {},
    "ACL": {},
    "RoleMapping": {},
    "Role": {}
  }
}