Spring Boot集成Apple登录遇OAuth2AuthenticationException: [invalid_client]问题

问题描述 #

配置Spring Boot应用的Apple登录时，遇到OAuth2AuthenticationException: [invalid_client]错误。现有配置及代码如下：

Spring Boot配置 #

spring:
  security:
    oauth2:
      client:
        registration:
          apple:
            client-id: *hidden*
            client-secret: *jwt*
            client-name: Apple
            client-authentication-method: client_secret_post
            authorization-grant-type: authorization_code
            redirect-uri: '{baseUrl}/login/oauth2/code/{registrationId}'
            scope:
              - openid
              - name
              - email
        provider:
          apple:
            authorization-uri: https://appleid.apple.com/auth/authorize?response_mode=form_post
            token-uri: https://appleid.apple.com/auth/token
            jwk-set-uri: https://appleid.apple.com/auth/keys

JWT密钥生成脚本 #

import jwt
import datetime
from pathlib import Path

key_file_path = Path('.../key_file.p8')
private_key   = key_file_path.read_text()

team_id       = *hidden*
client_id     = *hidden*
key_id        = *hidden*

issued_at = datetime.datetime.utcnow()
expiration_time = issued_at + datetime.timedelta(days = 3600)

token = jwt.encode(
    {
        'iss': team_id,
        'iat': issued_at,
        'exp': expiration_time,
        'aud': 'https://appleid.apple.com',
        'sub': client_id,
    },
    private_key,
    algorithm = 'ES256',
    headers = {'kid': key_id}
)

print('Generated Client Secret:', token)

异常信息 #

org.springframework.security.oauth2.core.OAuth2AuthenticationException: [invalid_client]
        at org.springframework.security.oauth2.client.oidc.authentication.OidcAuthorizationCodeAuthenticationProvider.getResponse(OidcAuthorizationCodeAuthenticationProvider.java:178) ~[spring-security-oauth2-client-6.2.4.jar!/:6.2.4]
        ...（省略中间栈信息）
Caused by: org.springframework.security.oauth2.core.OAuth2AuthorizationException: [invalid_client]
        at org.springframework.security.oauth2.client.http.OAuth2ErrorResponseErrorHandler.handleError(OAuth2ErrorResponseErrorHandler.java:66) ~[spring-security-oauth2-client-6.2.4.jar!/:6.2.4]
        ...（省略中间栈信息）

核心疑问：

1. 哪里配置出错导致invalid_client？
2. Spring Boot中需配置哪些组件，才能同时支持Apple的JWT方式登录和Google的常规client_secret登录？

解决方案 #

一、排查invalid_client错误的关键点 #

1. JWT客户端秘钥的有效性问题

• 过期时间错误：脚本中设置的3600天有效期远超Apple限制的最大180天，Apple会直接拒绝该JWT。将有效期改为datetime.timedelta(days=180)以内。
• JWT字段校验：确认以下字段完全匹配Apple要求：
  • iss：必须是Apple开发者账户的Team ID，无大小写错误和多余空格
  • sub：必须与Spring配置中的client-id完全一致（服务端应用需使用服务端类型的Client ID，而非移动端的）
  • aud：固定为https://appleid.apple.com，不能写错
  • kid：必须与Apple开发者后台生成的密钥ID一致，且对应正确的.p8私钥
• 签名与私钥格式：确保使用ES256算法，且.p8私钥完整包含-----BEGIN PRIVATE KEY-----和-----END PRIVATE KEY-----头部尾部，读取时未丢失格式。

2. Spring配置的细节问题

• 重定向URI一致性：Spring配置的redirect-uri必须与Apple开发者后台配置的地址完全一致，包括HTTP/HTTPS、域名、路径，不能有任何差异（比如本地测试用http://localhost:8080/login/oauth2/code/apple，需在Apple后台配置完全相同的地址）
• 授权URI参数：response_mode=form_post是正确的，但可尝试去掉该参数测试是否影响认证流程。

3. Apple开发者后台配置检查

• 密钥关联：确认生成的.p8密钥已关联到目标应用ID，且已启用"Sign in with Apple"服务。
• 服务生效时间：新配置的Apple登录服务通常几分钟内生效，无需等待48小时，若刚完成配置可等待1小时后重试。

二、同时支持Apple JWT和Google常规登录的配置 #

Spring Security OAuth2 Client原生支持多客户端配置，无需额外组件，只需保证每个客户端配置独立且正确：

1. Google登录配置（保持常规client_secret方式）

spring:
  security:
    oauth2:
      client:
        registration:
          google:
            client-id: *your-google-client-id*
            client-secret: *your-google-client-secret*
            client-name: Google
            authorization-grant-type: authorization_code
            redirect-uri: '{baseUrl}/login/oauth2/code/{registrationId}'
            scope:
              - openid
              - email
              - profile
        provider:
          google:
            authorization-uri: https://accounts.google.com/o/oauth2/v2/auth
            token-uri: https://oauth2.googleapis.com/token
            jwk-set-uri: https://www.googleapis.com/oauth2/v3/certs
            user-info-uri: https://www.googleapis.com/oauth2/v3/userinfo
            user-name-attribute: sub

2. 修正后的Apple登录配置

确保JWT秘钥有效期在180天内，Spring配置无需大幅修改：

spring:
  security:
    oauth2:
      client:
        registration:
          apple:
            client-id: *your-apple-client-id*
            client-secret: *valid-jwt-token*
            client-name: Apple
            client-authentication-method: client_secret_post
            authorization-grant-type: authorization_code
            redirect-uri: '{baseUrl}/login/oauth2/code/{registrationId}'
            scope:
              - openid
              - name
              - email
        provider:
          apple:
            authorization-uri: https://appleid.apple.com/auth/authorize
            token-uri: https://appleid.apple.com/auth/token
            jwk-set-uri: https://appleid.apple.com/auth/keys

3. 自动刷新Apple JWT秘钥（可选）

为避免手动更新JWT的麻烦，可自定义ClientSecretResolver自动生成有效JWT：

import org.springframework.security.oauth2.client.registration.ClientRegistration;
import org.springframework.security.oauth2.client.registration.ClientSecretResolver;
import org.springframework.stereotype.Component;
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.jose.JWSHeader;
import com.nimbusds.jose.JWSSigner;
import com.nimbusds.jose.crypto.ECDSASigner;
import com.nimbusds.jwt.JWTClaimsSet;
import com.nimbusds.jwt.SignedJWT;
import java.security.KeyFactory;
import java.security.PrivateKey;
import java.security.spec.PKCS8EncodedKeySpec;
import java.util.Base64;
import java.util.Date;

@Component
public class AppleClientSecretResolver implements ClientSecretResolver {

    private final String teamId = "your-team-id";
    private final String keyId = "your-key-id";
    private final String privateKeyP8 = "your-p8-private-key";

    @Override
    public String resolveClientSecret(ClientRegistration clientRegistration) {
        if (!"apple".equals(clientRegistration.getRegistrationId())) {
            return clientRegistration.getClientSecret();
        }
        try {
            // 加载.p8私钥
            String privateKeyContent = privateKeyP8.replace("-----BEGIN PRIVATE KEY-----", "")
                    .replace("-----END PRIVATE KEY-----", "")
                    .replaceAll("\\s", "");
            byte[] keyBytes = Base64.getDecoder().decode(privateKeyContent);
            PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(keyBytes);
            KeyFactory kf = KeyFactory.getInstance("EC");
            PrivateKey privateKey = kf.generatePrivate(spec);

            // 构建JWT
            Date now = new Date();
            JWTClaimsSet claimsSet = new JWTClaimsSet.Builder()
                    .issuer(teamId)
                    .issueTime(now)
                    .expirationTime(new Date(now.getTime() + 180 * 24 * 60 * 60 * 1000)) // 180天有效期
                    .audience("https://appleid.apple.com")
                    .subject(clientRegistration.getClientId())
                    .build();

            // 签名JWT
            JWSSigner signer = new ECDSASigner(privateKey);
            SignedJWT signedJWT = new SignedJWT(new JWSHeader.Builder(JWSAlgorithm.ES256).keyID(keyId).build(), claimsSet);
            signedJWT.sign(signer);

            return signedJWT.serialize();
        } catch (Exception e) {
            throw new RuntimeException("Failed to generate Apple client secret", e);
        }
    }
}

使用该Resolver后，Spring会自动为Apple客户端生成有效JWT，无需手动更新配置文件中的client-secret。

内容的提问来源于stack exchange，提问作者ulxanxv