如何配置Spring Cloud Azure AD与Spring Boot OAuth2并解决客户端覆盖问题

方案1：禁用Azure自动配置的ClientRegistrationRepository，统一使用Spring Security标准配置 #

1. 修改配置文件，禁用Azure的ClientRegistrationRepository自动创建 #

在application.properties中添加以下配置，阻止Azure Starter单独生成仅包含自身的客户端注册仓库：

spring.cloud.azure.active-directory.client-registration-repository.enabled=false

2. 将Azure AD配置迁移到Spring Security OAuth2标准节点 #

把原Azure专属配置移到spring.security.oauth2.client下，与GitHub、Google配置统一管理，完整配置示例：

spring:
  security:
    oauth2:
      client:
        registration:
          github:
            client-id: ##REDACTED##
            client-secret: ##REDACTED##
            redirect-uri: "{baseUrl}/oauth2/callback/{registrationId}"
          google:
            client-id: ##REDACTED##
            client-secret: ##REDACTED##
            redirect-uri: "{baseUrl}/oauth2/callback/{registrationId}"
          azure:
            client-id: ##REDACTED##
            client-secret: ##REDACTED##
            redirect-uri: "{baseUrl}/oauth2/callback/azure"
            provider: azure
        provider:
          azure:
            authorization-uri: https://login.microsoftonline.com/common/oauth2/v2.0/authorize
            token-uri: https://login.microsoftonline.com/common/oauth2/v2.0/token
            user-info-uri: https://graph.microsoft.com/oidc/userinfo
            jwk-set-uri: https://login.microsoftonline.com/common/discovery/v2.0/keys
            user-name-attribute: name

方案2：自定义ClientRegistrationRepository，合并所有客户端配置 #

如果需要保留Azure原有配置结构，可手动编写配置类合并所有客户端注册信息：

@Configuration
public class OAuth2ClientConfig {

    @Autowired(required = false)
    private ClientRegistrationRepository defaultClientRegistrationRepository;

    @Autowired
    private AzureADClientRegistration azureADClientRegistration;

    @Bean
    public ClientRegistrationRepository clientRegistrationRepository() {
        List<ClientRegistration> registrations = new ArrayList<>();

        // 加入Spring Security自动加载的GitHub、Google客户端
        if (defaultClientRegistrationRepository != null) {
            defaultClientRegistrationRepository.findByRegistrationId("github").ifPresent(registrations::add);
            defaultClientRegistrationRepository.findByRegistrationId("google").ifPresent(registrations::add);
        }

        // 加入Azure AD客户端
        registrations.add(azureADClientRegistration.getClientRegistration());

        return new InMemoryClientRegistrationRepository(registrations);
    }
}

问题原因 #

spring-cloud-azure-starter-active-directory默认会自动生成一个仅包含Azure AD客户端的ClientRegistrationRepository Bean，其优先级高于Spring Security自动配置的Bean（后者会加载spring.security.oauth2.client.registration下的所有客户端）。这直接导致GitHub、Google的客户端注册被覆盖，无法被识别，从而抛出InvalidClientRegistrationIdException。

两种方案分别通过统一配置管理或手动合并注册信息，均可实现多OAuth2客户端共存。

内容的提问来源于stack exchange，提问作者Jakub