如何为每个Feign Client配置不同的OAuth2 Client Registration ID？

你当前基于Spring Boot 2.7.2 + Spring Cloud 2021.0，已经完成了两个OAuth2提供商及对应客户端的注册配置，全局Feign OAuth2配置只能指定单一客户端注册ID，但需要让FeignClientA从provider-one取令牌、FeignClientB从provider-two取令牌，以下是两种可行实现方式：

方案一：配置化指定（推荐） #

Spring Cloud OpenFeign支持为单个Feign Client单独配置OAuth2属性，无需自定义拦截器。通过feign.client.config.${feign-client-name}前缀，可为指定Feign Client绑定专属的客户端注册ID：

假设你的FeignClientA注解名称为feign-client-a，FeignClientB为feign-client-b，添加如下配置：

spring:
  cloud:
    openfeign:
      oauth2:
        enabled: true # 全局开启Feign OAuth2支持
# 为每个Feign Client单独配置OAuth2客户端注册ID
feign:
  client:
    config:
      feign-client-a: # 对应@FeignClient的name/value属性值
        oauth2:
          client-registration-id: client-one
      feign-client-b:
        oauth2:
          client-registration-id: client-two

配置完成后，FeignClientA会自动使用client-one的配置从provider-one获取令牌，FeignClientB则使用client-two从provider-two获取令牌，底层复用Spring Security OAuth2的令牌缓存、刷新等逻辑。

方案二：自定义Feign拦截器（灵活扩展场景） #

如果需要额外的令牌处理逻辑，可为每个Feign Client创建专属的OAuth2拦截器，绑定对应的客户端注册信息：

1. 实现两个专属拦截器 #

import feign.RequestInterceptor;
import feign.RequestTemplate;
import org.springframework.security.oauth2.client.OAuth2AuthorizeRequest;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;

// 对应client-one的拦截器
public class FeignClientOneOAuth2Interceptor implements RequestInterceptor {

    private final OAuth2AuthorizedClientManager authorizedClientManager;

    public FeignClientOneOAuth2Interceptor(OAuth2AuthorizedClientManager authorizedClientManager) {
        this.authorizedClientManager = authorizedClientManager;
    }

    @Override
    public void apply(RequestTemplate template) {
        var authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("client-one")
                .principal("feign-client-a") // 自定义标识，不影响令牌获取逻辑
                .build();
        var authorizedClient = authorizedClientManager.authorize(authorizeRequest);
        if (authorizedClient != null) {
            template.header("Authorization", "Bearer " + authorizedClient.getAccessToken().getTokenValue());
        }
    }
}

// 对应client-two的拦截器
public class FeignClientTwoOAuth2Interceptor implements RequestInterceptor {

    private final OAuth2AuthorizedClientManager authorizedClientManager;

    public FeignClientTwoOAuth2Interceptor(OAuth2AuthorizedClientManager authorizedClientManager) {
        this.authorizedClientManager = authorizedClientManager;
    }

    @Override
    public void apply(RequestTemplate template) {
        var authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("client-two")
                .principal("feign-client-b")
                .build();
        var authorizedClient = authorizedClientManager.authorize(authorizeRequest);
        if (authorizedClient != null) {
            template.header("Authorization", "Bearer " + authorizedClient.getAccessToken().getTokenValue());
        }
    }
}

2. 绑定拦截器到对应Feign Client #

在@FeignClient注解中通过configuration属性指定专属拦截器：

import org.springframework.cloud.openfeign.FeignClient;

@FeignClient(name = "feign-client-a", url = "${feign.client-a.url}", configuration = FeignClientOneOAuth2Interceptor.class)
public interface FeignClientA {
    // 业务接口方法
}

@FeignClient(name = "feign-client-b", url = "${feign.client-b.url}", configuration = FeignClientTwoOAuth2Interceptor.class)
public interface FeignClientB {
    // 业务接口方法
}

3. 注册OAuth2授权客户端管理器到容器 #

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientProvider;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientProviderBuilder;
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
import org.springframework.security.oauth2.client.web.DefaultOAuth2AuthorizedClientManager;
import org.springframework.security.oauth2.client.web.OAuth2AuthorizedClientRepository;

@Configuration
public class OAuth2ClientConfig {

    @Bean
    public OAuth2AuthorizedClientManager authorizedClientManager(
            ClientRegistrationRepository clientRegistrationRepository,
            OAuth2AuthorizedClientRepository authorizedClientRepository) {

        OAuth2AuthorizedClientProvider authorizedClientProvider =
                OAuth2AuthorizedClientProviderBuilder.builder()
                        .clientCredentials()
                        .build();

        DefaultOAuth2AuthorizedClientManager authorizedClientManager =
                new DefaultOAuth2AuthorizedClientManager(
                        clientRegistrationRepository, authorizedClientRepository);
        authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);

        return authorizedClientManager;
    }
}

注意事项 #

• 方案一配置化方式更简洁，优先推荐，无需手动处理令牌生命周期；
• 确保@FeignClient的name属性与配置中的feign.client.config.${name}完全匹配；
• 两种方案均基于Spring Security OAuth2客户端凭据模式，令牌会自动完成缓存与刷新。

内容的提问来源于stack exchange，提问作者Mulgard