Spring Boot中基于OAuth2 Client实现多交换服务器资源管理及跨服务器Bearer认证令牌配置问询

Let's break down the issues in your current code and implement the correct setup to secure your server-to-server calls with OAuth2 Bearer tokens.

Key Issues in Your Current Implementation #

• Mismatched Authorization Grant Type: You're using authorization_code (designed for user-facing login flows) for server-to-server communication—this should typically use client_credentials unless you explicitly need to act on behalf of a logged-in user.
• Manual Token Handling: Trying to manually build the Authorization header defeats Spring OAuth2 Client's auto-management capabilities; the framework can handle token acquisition, injection, and renewal automatically.
• Broken WebClient Usage: Your getUserAll method mixes up the WebClient call chain and doesn't leverage the OAuth2 filter you configured earlier.
• Invalid URI Placeholder: The {$spring.security.oauth2.client.provider.idsvr.issuer-uri} syntax isn't valid for WebClient's uri() method—you should inject external URLs via @Value instead.

Step 1: Adjust OAuth2 Configuration #

First, update your application.properties to use the appropriate grant type for server-to-server interactions. If you need user context later, you can switch back to authorization_code, but client_credentials is standard for service-to-service:

# Client Registration
spring.security.oauth2.client.registration.idsvr.client-name=client
spring.security.oauth2.client.registration.idsvr.client-id=KEY
spring.security.oauth2.client.registration.idsvr.client-secret=SKEY
spring.security.oauth2.client.registration.idsvr.authorization-grant-type=client_credentials
spring.security.oauth2.client.registration.idsvr.scope=openid

# Provider Configuration
spring.security.oauth2.client.provider.idsvr.issuer-uri=XXX/idserver
spring.security.oauth2.client.provider.idsvr.token-uri=XXX/idserver/connect/token
spring.security.oauth2.client.provider.idsvr.jwk-set-uri=XXX/idserver/.well-known/jwks

# Add external service base URL for convenience
external.service.base-url=PUT_YOUR_SECOND_SERVER_BASE_URL_HERE

Step 2: Correct WebClient Configuration #

Your WebClient bean setup is almost right—let's clean it up to ensure it properly integrates with Spring's OAuth2 client:

@Configuration
public class OAuth2SecurityConfigClient {

    @Bean
    WebClient webClient(ReactiveClientRegistrationRepository clientRegistrations,
                        @Value("${external.service.base-url}") String externalServiceBaseUrl) {
        ServerOAuth2AuthorizedClientExchangeFilterFunction oauthFilter = 
            new ServerOAuth2AuthorizedClientExchangeFilterFunction(
                clientRegistrations,
                new UnAuthenticatedServerOAuth2AuthorizedClientRepository()
            );
        
        // Set default client registration to use for all requests with this WebClient
        oauthFilter.setDefaultClientRegistrationId("idsvr");
        
        return WebClient.builder()
            .baseUrl(externalServiceBaseUrl) // Set base URL for the second server
            .filter(oauthFilter) // Attach the OAuth2 filter to auto-inject tokens
            .build();
    }
}

Step 3: Use WebClient to Call Protected Resources #

Now, use the configured WebClient in your service—no manual header handling needed. The filter will automatically fetch and attach the Bearer token to every request:

@Service
public class ExternalApiClient {

    private final WebClient webClient;
    private static final Duration REQUEST_TIMEOUT = Duration.ofSeconds(10);

    // Inject the pre-configured WebClient
    public ExternalApiClient(WebClient webClient) {
        this.webClient = webClient;
    }

    public String[] getUserAll() {
        return webClient.get()
            .uri("/users") // Relative URI (base URL is already set in WebClient)
            .retrieve()
            // Add error handling for failed requests
            .onStatus(HttpStatus::isError, response -> 
                Mono.error(new RuntimeException("Failed to fetch users: " + response.statusCode()))
            )
            .bodyToMono(String[].class)
            .block(REQUEST_TIMEOUT);
    }

    // Optional: Test method to verify token flow
    public void logProtectedEndpointResponse() {
        webClient.get()
            .uri("/some-protected-endpoint") // Replace with a valid endpoint on the second server
            .retrieve()
            .bodyToMono(String.class)
            .map(response -> "Response from protected endpoint: " + response)
            .subscribe(logger::info);
    }
}

How It Works #

The ServerOAuth2AuthorizedClientExchangeFilterFunction handles all heavy lifting:

1. Automatically requests an access token from your OAuth2 provider using client credentials.
2. Adds the Authorization: Bearer <token> header to every outgoing request.
3. Renews tokens automatically when they expire, so you don't have to manage token lifecycle.

If You Need User Context (authorization_code Flow) #

If you're making calls on behalf of a logged-in user instead of server-to-server:

1. Keep authorization-grant-type=authorization_code in your properties.
2. Use AuthenticatedServerOAuth2AuthorizedClientRepository instead of the unauthenticated variant.
3. Enable OAuth2 login in your app with @EnableReactiveOAuth2Login (for WebFlux) or @EnableOAuth2Login (for Servlet).

内容的提问来源于stack exchange，提问作者Jack Boch