Spring Boot批处理应用遇invalid_clientId错误，已配置仍未解决

错误信息 #

reactor.core.Exceptions$ErrorCallbackNotImplemented: org.springframework.security.oauth2.client.ClientAuthorizationException: [invalid_clientId] client_id should be sent
Caused by: org.springframework.security.oauth2.client.ClientAuthorizationException: [invalid_clientId] client_id should be sent

配置文件（application.yml） #

security:
    oauth2:
      client:
        registration:
          myserver:
            authorization-grant-type: client_credentials
            client-id: **************
            client-secret: **************
        provider:
          myserver:
            token-uri: "************"

WebClient配置类 #

@Slf4j
@Configuration
public class WebClientConfiguration {

    @Value("${rest.client.base-url}")
    private String baseUrl;

    @Bean
    WebClient webClient(@Qualifier("authorizedClientManager") final ReactiveOAuth2AuthorizedClientManager manager) {

        final ServerOAuth2AuthorizedClientExchangeFilterFunction clientExchangeFilterFunction = new ServerOAuth2AuthorizedClientExchangeFilterFunction(manager);
        clientExchangeFilterFunction.setDefaultClientRegistrationId("******");
        return WebClient.builder()
                .baseUrl(this.baseUrl)
                .filter(clientExchangeFilterFunction)
                .build();
    }

    @Bean
    public ReactiveOAuth2AuthorizedClientManager authorizedClientManager(ReactiveClientRegistrationRepository clientRegistrationRepository,
                                                                         ReactiveOAuth2AuthorizedClientService authorizedClientService) {
        ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
                .clientCredentials()
                .build();

        final AuthorizedClientServiceReactiveOAuth2AuthorizedClientManager authorizedClientManager =
                new AuthorizedClientServiceReactiveOAuth2AuthorizedClientManager(clientRegistrationRepository, authorizedClientService);
        authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);
        return authorizedClientManager;
    }
 
}

解决方法 #

• 检查DefaultClientRegistrationId匹配性
  WebClient配置中clientExchangeFilterFunction.setDefaultClientRegistrationId("******")的参数必须与application.yml里security.oauth2.client.registration下的ID完全一致（即myserver）。如果ID不匹配，Spring无法找到对应的client-id和client-secret配置，导致请求token时未携带client_id参数。

• 适配服务端的参数传递要求
  部分OAuth2服务要求client_id和client_secret以表单参数形式传递，而非默认的Basic Auth方式。可以修改授权客户端提供者的配置，强制使用表单参数：

  @Bean
  public ReactiveOAuth2AuthorizedClientManager authorizedClientManager(ReactiveClientRegistrationRepository clientRegistrationRepository,
                                                                       ReactiveOAuth2AuthorizedClientService authorizedClientService) {
      // 配置表单参数传递client凭证
      DefaultClientCredentialsReactiveOAuth2AccessTokenResponseClient tokenResponseClient =
              new DefaultClientCredentialsReactiveOAuth2AccessTokenResponseClient();
      tokenResponseClient.setParametersConverter(new FormHttpMessageConverter());
  
      ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
              .clientCredentials(configurer -> configurer.accessTokenResponseClient(tokenResponseClient))
              .build();
  
      final AuthorizedClientServiceReactiveOAuth2AuthorizedClientManager authorizedClientManager =
              new AuthorizedClientServiceReactiveOAuth2AuthorizedClientManager(clientRegistrationRepository, authorizedClientService);
      authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);
      return authorizedClientManager;
  }
  

• 验证配置文件语法正确性
  YAML对缩进敏感，确保client-id和client-secret正确缩进在myserver节点下，没有语法错误导致配置未被加载。可以通过Spring Boot启动日志确认配置是否正常读取。

• 启用调试日志定位问题
  添加日志配置，查看OAuth2请求的详细参数：

  logging:
    level:
      org.springframework.security: DEBUG
      org.springframework.web.reactive.function.client: DEBUG
  

  通过日志可以确认请求token时是否携带了client_id参数，以及请求格式是否符合服务端要求。

内容的提问来源于stack exchange，提问作者dzeep