Spring Security OAuth2问题：配置多外部授权服务器时，单个连接失败导致Spring Boot应用无法启动

Great question! The core issue here is that Spring Boot's auto-configuration for OAuth2 clients tries to resolve all configured client registrations at startup—including fetching the OIDC metadata from each issuer URI. If any of these calls fail (like your SSL certificate issue with Azure AD), the entire clientRegistrationRepository bean fails to create, bringing down the app.

Luckily, there's a straightforward fix by taking control of how ClientRegistrationRepository is created, so you can skip failed registrations and keep the app running. Here's how to do it:

1. Disable the Auto-Configured Client Registration Repository #

First, turn off Spring's default auto-configuration that forces validation of all registrations at startup. Add this exclusion to your main application class:

@SpringBootApplication(exclude = OAuth2ClientRegistrationRepositoryConfiguration.class)
public class YourAppApplication {
    public static void main(String[] args) {
        SpringApplication.run(YourAppApplication.class, args);
    }
}

This prevents the problematic auto-configured bean from being created, so we can replace it with our own fault-tolerant version.

2. Manually Create ClientRegistrationRepository with Error Handling #

Next, create a custom configuration class that builds client registrations one by one, catching exceptions for any failed issuers. This ensures only valid registrations are added to the repository:

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.oauth2.client.registration.ClientRegistration;
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
import org.springframework.security.oauth2.client.registration.ClientRegistrations;
import org.springframework.security.oauth2.client.registration.InMemoryClientRegistrationRepository;
import org.springframework.security.oauth2.core.AuthorizationGrantType;
import org.springframework.security.oauth2.core.ClientAuthenticationMethod;
import org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientProperties;

import java.util.ArrayList;
import java.util.List;

@Configuration
public class FaultTolerantOAuth2Config {

    private static final Logger log = LoggerFactory.getLogger(FaultTolerantOAuth2Config.class);

    @Autowired
    private OAuth2ClientProperties oAuth2ClientProperties;

    @Bean
    public ClientRegistrationRepository clientRegistrationRepository() {
        List<ClientRegistration> validRegistrations = new ArrayList<>();

        // Iterate through all configured client registrations from application.properties
        oAuth2ClientProperties.getRegistration().forEach((registrationId, registrationProps) -> {
            try {
                ClientRegistration.Builder builder;
                // Handle issuer-based providers (like Okta/Azure AD)
                if (registrationProps.getProvider() != null) {
                    OAuth2ClientProperties.Provider providerProps = oAuth2ClientProperties.getProvider().get(registrationProps.getProvider());
                    if (providerProps.getIssuerUri() != null) {
                        // Attempt to build from issuer URI (this is where the original failure occurred)
                        builder = ClientRegistrations.fromIssuerLocation(providerProps.getIssuerUri());
                    } else {
                        // Build manually if no issuer URI is configured
                        builder = ClientRegistration.withRegistrationId(registrationId)
                                .clientId(registrationProps.getClientId())
                                .clientSecret(registrationProps.getClientSecret())
                                .authorizationUri(providerProps.getAuthorizationUri())
                                .tokenUri(providerProps.getTokenUri())
                                .userInfoUri(providerProps.getUserInfoUri())
                                .userNameAttributeName(providerProps.getUserNameAttributeName())
                                .jwkSetUri(providerProps.getJwkSetUri());
                    }
                } else {
                    // Build manually for registrations without a linked provider
                    builder = ClientRegistration.withRegistrationId(registrationId)
                            .clientId(registrationProps.getClientId())
                            .clientSecret(registrationProps.getClientSecret())
                            .authorizationUri(registrationProps.getAuthorizationUri())
                            .tokenUri(registrationProps.getTokenUri())
                            .userInfoUri(registrationProps.getUserInfoUri())
                            .userNameAttributeName(registrationProps.getUserNameAttributeName())
                            .jwkSetUri(registrationProps.getJwkSetUri());
                }

                // Set common properties from your configuration
                builder.clientName(registrationProps.getClientName())
                        .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
                        .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
                        .redirectUri(registrationProps.getRedirectUri());

                validRegistrations.add(builder.build());
                log.info("Successfully initialized OAuth2 client registration: {}", registrationId);
            } catch (Exception e) {
                // Log the failure but don't halt application startup
                log.error("Failed to initialize OAuth2 client registration: {}. Skipping this client.", registrationId, e);
            }
        });

        return new InMemoryClientRegistrationRepository(validRegistrations);
    }
}

How This Works #

• We loop through every client registration defined in your application.properties.
• For each registration, we attempt to build the ClientRegistration (including fetching OIDC metadata from the issuer URI).
• If any registration fails (like your Azure AD SSL error), we catch the exception, log details, and skip adding that client to the repository.
• The app starts successfully with only valid registrations (like your Okta one) available for use.

Bonus: Dynamic Reload of Failed Registrations #

If you want to retry failed registrations after startup (e.g., once you fix the SSL certificate issue), you can:

• Add a scheduled task that periodically re-runs the registration logic for failed clients.
• Create a REST endpoint that triggers a manual reload of registrations.

This lets you add the fixed client without restarting the app.

内容的提问来源于stack exchange，提问作者Mohamad Assaad