Spring Security OAuth2中TokenExchangeOAuth2AuthorizedClientProvider类找不到错误

开发基于Spring Boot 3.x的应用时，使用Spring Security OAuth2做身份认证，遇到authorizedClientManagerRegistrar Bean创建失败的问题，错误堆栈如下：

org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'authorizedClientManagerRegistrar' defined in class path resource [org/springframework/security/config/annotation/web/configuration/OAuth2ClientConfiguration$OAuth2AuthorizedClientManagerConfiguration.class]: Failed to instantiate [org.springframework.security.config.annotation.web.configuration.OAuth2ClientConfiguration$OAuth2AuthorizedClientManagerRegistrar]: Factory method 'authorizedClientManagerRegistrar' threw exception with message: org/springframework/security/oauth2/client/TokenExchangeOAuth2AuthorizedClientProvider
Caused by: java.lang.NoClassDefFoundError: org/springframework/security/oauth2/client/TokenExchangeOAuth2AuthorizedClientProvider
    at org.springframework.security.config.annotation.web.configuration.OAuth2ClientConfiguration$OAuth2AuthorizedClientManagerRegistrar.<clinit>(OAuth2ClientConfiguration.java:183)
    at org.springframework.security.config.annotation.web.configuration.OAuth2ClientConfiguration$OAuth2AuthorizedClientManagerConfiguration.authorizedClientManagerRegistrar(OAuth2ClientConfiguration.java:113)
    ... [other lines omitted for brevity]

已尝试添加以下依赖：

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-oauth2-client</artifactId>
    <version>6.3.3</version>
</dependency>

相关版本：Spring Boot 3.x、Spring Security 6.3.3、JDK 21.0.0

问题原因与解决方案 #

原因分析

TokenExchangeOAuth2AuthorizedClientProvider类属于spring-security-oauth2-client 6.x版本，但出现NoClassDefFoundError通常是依赖版本冲突或依赖未正确引入导致的。手动指定版本可能和Spring Boot parent管理的版本不一致，引发依赖树混乱。

解决步骤

1. 使用Spring Boot Starter依赖，自动管理版本
   替换手动添加的依赖为Spring Boot OAuth2 Client Starter，Spring Boot会自动匹配兼容的Spring Security版本，避免版本冲突：

   <dependency>
       <groupId>org.springframework.boot</groupId>
       <artifactId>spring-boot-starter-oauth2-client</artifactId>
   </dependency>
   

2. 清理依赖缓存并重新构建
   执行Maven命令清理本地缓存，重新拉取正确版本的依赖：

   mvn clean install -U
   

3. 检查依赖树，排查版本冲突
   运行以下命令查看Spring Security相关依赖的版本，确认是否有冲突：

   mvn dependency:tree | grep spring-security
   

   如果发现不同版本的Spring Security依赖，需要排除冲突的依赖项。

内容的提问来源于stack exchange，提问作者Ankit