Spring Boot中Cloud Foundry Java Client /oauth/token登录失败求助

问题背景 #

Spring Boot项目对接Cloud Foundry，使用给定代码和依赖配置后，执行返回HTTP/1.1 401 Unauthorized，异常提示invalid_client: Bad credentials，但CF CLI执行登录命令可正常成功。Java库请求流程显示，向UAA的/oauth/token发送POST请求时触发未授权错误。

原代码与依赖 #

CloudFoundryController.java

package com.backend;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.context.event.ApplicationFailedEvent;
import org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration;
import org.springframework.context.ApplicationListener;

import org.cloudfoundry.operations.CloudFoundryOperations;
import org.cloudfoundry.operations.DefaultCloudFoundryOperations;
import org.cloudfoundry.reactor.DefaultConnectionContext;
import org.cloudfoundry.reactor.client.ReactorCloudFoundryClient;
import org.cloudfoundry.reactor.tokenprovider.PasswordGrantTokenProvider;

import java.net.MalformedURLException;
import java.net.URI;
import java.net.URL;

@SpringBootApplication(exclude = { SecurityAutoConfiguration.class })
public class BackendApplication implements ApplicationListener<ApplicationFailedEvent> {
    private static final Logger logger = LoggerFactory.getLogger(BackendApplication.class);

    public static void main(String[] args) {
        // Hardcoded Cloud Foundry client configuration
        String target = "thisistheurl";
        String org = "thisisthename";
        String space = "thisisthename";
        String user = "thisisthelogin";
        String password = "thisisthepass";

        try {
            // Configure and login to Cloud Foundry
            final PasswordGrantTokenProvider tokenProvider = PasswordGrantTokenProvider.builder()
                    .username(user)
                    .password(password)
                    .build();

            final DefaultConnectionContext connectionContext = DefaultConnectionContext.builder()
                    .apiHost(target)
                    .build();

            final ReactorCloudFoundryClient client = ReactorCloudFoundryClient.builder()
                    .connectionContext(connectionContext)
                    .tokenProvider(tokenProvider)
                    .build();

            final DefaultCloudFoundryOperations operations = DefaultCloudFoundryOperations.builder()
                    .cloudFoundryClient(client)
                    .organization(org)
                    .space(space)
                    .build();

            operations.applications().list().subscribe(application ->
                    System.out.printf("  %s%n", application.getName())
            );

        } catch (Exception e) {
            logger.error("Error interacting with Cloud Foundry: " + e.getMessage());
        }
    }

    private static URL getTargetURL(String target) {
        try {
            return URI.create(target).toURL();
        } catch (MalformedURLException e) {
            throw new RuntimeException("The target URL is not valid: " + e.getMessage());
        }
    }

    @Override
    public void onApplicationEvent(ApplicationFailedEvent event) {
        // 补充实现避免编译错误
    }
}

Maven依赖配置

<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>3.2.4</version>
    <relativePath/> <!-- lookup parent from repository -->
</parent>

<dependencies>
    <dependency>
        <groupId>org.cloudfoundry</groupId>
        <artifactId>cloudfoundry-operations</artifactId>
        <version>5.12.1.RELEASE</version>
    </dependency>
    <dependency>
        <groupId>org.cloudfoundry</groupId>
        <artifactId>cloudfoundry-client-reactor</artifactId>
        <version>5.12.1.RELEASE</version>
    </dependency>
</dependencies>

问题原因与修复方案 #

1. API Host格式错误 #

DefaultConnectionContext.builder().apiHost(target)要求传入不带HTTP/HTTPS协议的纯主机名（如api.yourcfdomain.com），而非带协议的完整URL。CF CLI会自动解析协议，但Java客户端无法处理带协议的主机名，导致后续UAA端点解析异常。

2. 客户端ID不匹配 #

CF CLI默认使用cf作为OAuth客户端ID，而Java的PasswordGrantTokenProvider默认客户端ID并非此值。多数Cloud Foundry部署仅允许cf客户端使用密码授权模式，需显式指定客户端ID。

修改后的核心代码片段 #

public static void main(String[] args) {
    // 确保target是不带协议的纯主机名
    String target = "api.yourcfdomain.com";
    String org = "thisisthename";
    String space = "thisisthename";
    String user = "thisisthelogin";
    String password = "thisisthepass";

    try {
        final PasswordGrantTokenProvider tokenProvider = PasswordGrantTokenProvider.builder()
                .username(user)
                .password(password)
                .clientId("cf") // 显式指定与CF CLI一致的客户端ID
                .build();

        final DefaultConnectionContext connectionContext = DefaultConnectionContext.builder()
                .apiHost(target) // 纯主机名，不要带http/https
                .build();

        final ReactorCloudFoundryClient client = ReactorCloudFoundryClient.builder()
                .connectionContext(connectionContext)
                .tokenProvider(tokenProvider)
                .build();

        final DefaultCloudFoundryOperations operations = DefaultCloudFoundryOperations.builder()
                .cloudFoundryClient(client)
                .organization(org)
                .space(space)
                .build();

        // 增加错误订阅，便于排查问题
        operations.applications().list().subscribe(
                application -> System.out.printf("  %s%n", application.getName()),
                error -> logger.error("Failed to list applications: ", error)
        );

    } catch (Exception e) {
        logger.error("Error interacting with Cloud Foundry: ", e);
    }
}

额外排查点（若仍有问题） #

• SSL证书问题：如果Cloud Foundry使用自签名证书，测试环境可临时禁用SSL验证（生产环境不建议）：

  final ReactorCloudFoundryClient client = ReactorCloudFoundryClient.builder()
          .connectionContext(connectionContext)
          .tokenProvider(tokenProvider)
          .sslCertificateValidation(false)
          .build();
  

• 用户权限验证：确认该用户有权限访问指定的组织和空间，可通过cf spaces命令验证。

内容的提问来源于stack exchange，提问作者forkintheass