Spring Security OAuth2密码模式授权客户端返回空问题求助

一、修复OAuth2AuthorizedClientProvider缺失Password类型的问题 #

核心问题是默认的DelegatingOAuth2AuthorizedClientProvider未包含PasswordOAuth2AuthorizedClientProvider，导致密码授权流程无法触发，需手动配置包含该Provider的Bean：

1. 定义包含密码授权的OAuth2AuthorizedClientProvider

@Bean
public OAuth2AuthorizedClientProvider authorizedClientProvider() {
    // 初始化密码授权Provider
    PasswordOAuth2AuthorizedClientProvider passwordProvider = new PasswordOAuth2AuthorizedClientProvider();
    // 可选：添加刷新令牌支持
    RefreshTokenOAuth2AuthorizedClientProvider refreshTokenProvider = new RefreshTokenOAuth2AuthorizedClientProvider();

    // 组合多个Provider
    DelegatingOAuth2AuthorizedClientProvider provider = new DelegatingOAuth2AuthorizedClientProvider(
            passwordProvider, refreshTokenProvider);
    return provider;
}

2. 将Provider注入到OAuth2AuthorizedClientManager

@Bean
public OAuth2AuthorizedClientManager authorizedClientManager(
        ClientRegistrationRepository clientRegistrationRepository,
        OAuth2AuthorizedClientService authorizedClientService,
        OAuth2AuthorizedClientProvider authorizedClientProvider) {
    OAuth2AuthorizedClientServiceAuthorizedClientManager manager =
            new OAuth2AuthorizedClientServiceAuthorizedClientManager(
                    clientRegistrationRepository, authorizedClientService);
    // 关联自定义的Provider
    manager.setAuthorizedClientProvider(authorizedClientProvider);
    return manager;
}

二、解决用户名/密码属性不支持的问题 #

完成Provider配置后，调整OAuth2AuthorizeRequest的构建逻辑，确保属性能被正确识别：

1. 简化属性传递（无需手动设置Content-Type，密码授权默认使用application/x-www-form-urlencoded）

OAuth2AuthorizeRequest oAuth2AuthorizeRequest = OAuth2AuthorizeRequest
        .withClientRegistrationId(clientRegistration.getRegistrationId())
        .principal(principal)
        .attributes(attrs -> {
            attrs.put(OAuth2AuthorizationContext.USERNAME_ATTRIBUTE_NAME, username);
            attrs.put(OAuth2AuthorizationContext.PASSWORD_ATTRIBUTE_NAME, password);
        })
        .build();

2. 验证Principal的有效性
   确保传入的principal不为空，若无需特定权限上下文，可使用匿名身份：

Authentication principal = new AnonymousAuthenticationToken("anonymous", "anonymous", Collections.emptyList());

3. 检查配置文件完整性
   确保application.properties/yaml中客户端注册信息完整：

spring.security.oauth2.client.registration.keycloak.client-id=你的客户端ID
spring.security.oauth2.client.registration.keycloak.client-secret=你的客户端密钥
spring.security.oauth2.client.registration.keycloak.authorization-grant-type=password
spring.security.oauth2.client.provider.keycloak.token-uri=你的认证服务器Token端点地址

验证逻辑 #

完成配置后，调用manager.authorize(oAuth2AuthorizeRequest)时，DelegatingOAuth2AuthorizedClientProvider会自动匹配密码授权类型，从上下文属性中读取用户名和密码，向认证服务器发起Token请求。

内容的提问来源于stack exchange，提问作者Maria