求助：Spring Boot集成Okta公私钥认证获取AccessToken

1. 准备密钥对与Okta配置 #

• 生成RSA密钥对（推荐2048位及以上），使用OpenSSL命令：

  # 生成PKCS#8格式私钥（Spring原生支持）
  openssl genrsa -out private-key.pem 2048
  openssl pkcs8 -topk8 -inform PEM -outform PEM -in private-key.pem -out private-key-pkcs8.pem -nocrypt
  # 生成对应公钥
  openssl rsa -in private-key.pem -pubout -out public-key.pem
  

• 登录Okta控制台，找到你的M2M应用，在客户端认证设置中确认已选择“公钥/私钥”，点击添加公钥，上传生成的public-key.pem文件后保存配置。

2. 添加Spring Boot依赖 #

Maven项目在pom.xml中添加：

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-oauth2-client</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId> <!-- 按需添加，非必需 -->
    </dependency>
</dependencies>

Gradle项目在build.gradle中添加：

dependencies {
    implementation 'org.springframework.boot:spring-boot-starter-oauth2-client'
    implementation 'org.springframework.boot:spring-boot-starter-web' // 按需添加
}

3. 配置应用参数 #

在application.yml中添加Okta与密钥相关配置：

spring:
  security:
    oauth2:
      client:
        registration:
          okta-m2m:
            provider: okta
            client-id: <你的Okta应用Client ID>
            authorization-grant-type: client_credentials
            scope: <你的API权限范围，例如api://default/access>
        provider:
          okta:
            issuer-uri: https://<你的Okta域名>/oauth2/v1
        client:
          okta-m2m:
            client-authentication-method: private_key_jwt
            jwk-set-uri: classpath:private-key-pkcs8.pem # 私钥文件路径，也可填绝对路径

生产环境不建议直接在配置中写私钥内容，推荐使用密钥管理服务托管私钥。

4. 编写Token获取逻辑 #

方式一：直接获取AccessToken的工具类 #

import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientProvider;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientProviderBuilder;
import org.springframework.security.oauth2.client.registration.ClientRegistration;
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
import org.springframework.stereotype.Component;

@Component
public class OktaTokenProvider {

    private final OAuth2AuthorizedClientManager authorizedClientManager;

    public OktaTokenProvider(ClientRegistrationRepository clientRegistrationRepository) {
        OAuth2AuthorizedClientProvider provider =
                OAuth2AuthorizedClientProviderBuilder.builder()
                        .clientCredentials()
                        .build();

        this.authorizedClientManager = (clientRegistrationId, principal) -> {
            ClientRegistration clientReg = clientRegistrationRepository.findByRegistrationId(clientRegistrationId);
            OAuth2AuthorizedClient authorizedClient = new OAuth2AuthorizedClient(clientReg, principal.getName(), null);
            return provider.authorize(authorizedClient);
        };
    }

    public String getAccessToken() {
        OAuth2AuthorizedClient client = authorizedClientManager.authorize("okta-m2m", null);
        return client.getAccessToken().getTokenValue();
    }
}

方式二：集成WebClient自动携带Token（适合API调用场景） #

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientProviderBuilder;
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
import org.springframework.security.oauth2.client.web.DefaultOAuth2AuthorizedClientManager;
import org.springframework.security.oauth2.client.web.OAuth2AuthorizedClientRepository;
import org.springframework.web.reactive.function.client.WebClient;

@Configuration
public class WebClientConfig {

    @Bean
    public WebClient oktaWebClient(OAuth2AuthorizedClientManager authorizedClientManager) {
        return WebClient.builder()
                .filter((request, next) -> {
                    OAuth2AuthorizedClient client = authorizedClientManager.authorize("okta-m2m", null);
                    return next.exchange(request.headers(headers ->
                            headers.setBearerAuth(client.getAccessToken().getTokenValue())));
                })
                .build();
    }

    @Bean
    public OAuth2AuthorizedClientManager authorizedClientManager(
            ClientRegistrationRepository clientRegistrationRepository,
            OAuth2AuthorizedClientRepository authorizedClientRepository) {

        OAuth2AuthorizedClientProvider provider = OAuth2AuthorizedClientProviderBuilder.builder()
                .clientCredentials()
                .build();

        DefaultOAuth2AuthorizedClientManager manager = new DefaultOAuth2AuthorizedClientManager(
                clientRegistrationRepository, authorizedClientRepository);
        manager.setAuthorizedClientProvider(provider);
        return manager;
    }
}

5. 测试验证 #

编写简单Controller测试Token获取：

import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class TokenController {

    private final OktaTokenProvider tokenProvider;

    public TokenController(OktaTokenProvider tokenProvider) {
        this.tokenProvider = tokenProvider;
    }

    @GetMapping("/token")
    public String getToken() {
        return tokenProvider.getAccessToken();
    }
}

启动应用后访问/token接口，即可获取Okta颁发的AccessToken。

内容的提问来源于stack exchange，提问作者Ashok Kumar