Spring Boot 3.0.5+Retrofit的OAuth2客户端令牌获取与资源调用问题咨询

1. 确认OAuth2客户端基础配置正确性 #

确保你的application.yml或application.properties中的OAuth2客户端配置与Postman使用的参数完全一致，比如客户端ID、密钥、令牌地址、授权类型等。以客户端凭证模式为例：

spring:
  security:
    oauth2:
      client:
        registration:
          my-oauth-client:
            client-id: YOUR_CLIENT_ID
            client-secret: YOUR_CLIENT_SECRET
            authorization-grant-type: client_credentials
            scope: read,write
        provider:
          my-oauth-client:
            token-uri: https://your-auth-server-domain/oauth2/token

注意：如果使用密码模式，需在registration节点额外配置username和password，并将授权类型改为password

2. 利用Spring OAuth2客户端管理器获取令牌 #

Spring Boot 3内置了OAuth2AuthorizedClientManager，可自动处理令牌的获取、刷新逻辑。直接注入该类即可获取有效访问令牌：

@Autowired
private OAuth2AuthorizedClientManager authorizedClientManager;

private String getValidAccessToken() {
    // 客户端凭证模式下，使用匿名身份即可
    OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest
            .withClientRegistrationId("my-oauth-client")
            .principal(new AnonymousAuthenticationToken("anon", "anon-user", Collections.emptyList()))
            .build();
    
    OAuth2AuthorizedClient authorizedClient = authorizedClientManager.authorize(authorizeRequest);
    if (authorizedClient == null || authorizedClient.getAccessToken() == null) {
        throw new IllegalStateException("Failed to obtain valid access token");
    }
    return authorizedClient.getAccessToken().getTokenValue();
}

3. 给Retrofit添加OAuth2请求拦截器 #

自定义Retrofit拦截器，在每次请求时自动将令牌附加到Authorization请求头：

public class OAuth2TokenInterceptor implements Interceptor {
    private final OAuth2AuthorizedClientManager clientManager;
    private final String clientRegistrationId;

    public OAuth2TokenInterceptor(OAuth2AuthorizedClientManager clientManager, String clientRegistrationId) {
        this.clientManager = clientManager;
        this.clientRegistrationId = clientRegistrationId;
    }

    @Override
    public Response intercept(Chain chain) throws IOException {
        String accessToken = getValidAccessToken();
        Request modifiedRequest = chain.request().newBuilder()
                .header("Authorization", "Bearer " + accessToken)
                .build();
        return chain.proceed(modifiedRequest);
    }

    private String getValidAccessToken() throws IOException {
        OAuth2AuthorizeRequest request = OAuth2AuthorizeRequest
                .withClientRegistrationId(clientRegistrationId)
                .principal(new AnonymousAuthenticationToken("anon", "anon-user", Collections.emptyList()))
                .build();
        
        OAuth2AuthorizedClient client = clientManager.authorize(request);
        if (client == null || client.getAccessToken() == null) {
            throw new IOException("Failed to retrieve access token from auth server");
        }
        return client.getAccessToken().getTokenValue();
    }
}

4. 配置带拦截器的Retrofit实例 #

通过@Bean创建Retrofit对象时，将上述拦截器添加到OkHttpClient中：

@Bean
public Retrofit resourceServerRetrofit(OAuth2AuthorizedClientManager clientManager) {
    OkHttpClient okHttpClient = new OkHttpClient.Builder()
            .addInterceptor(new OAuth2TokenInterceptor(clientManager, "my-oauth-client"))
            .build();

    return new Retrofit.Builder()
            .baseUrl("https://your-resource-server-domain/api/")
            .client(okHttpClient)
            .addConverterFactory(GsonConverterFactory.create())
            .build();
}

5. 常见问题排查 #

• 确认已引入正确的依赖：spring-boot-starter-oauth2-client（Spring Boot 3无需额外引入其他OAuth2相关依赖）
• 开启Spring Security debug日志（logging.level.org.springframework.security=DEBUG），查看令牌请求过程中的错误信息（如401、400状态码）
• 检查令牌地址token-uri是否与Postman完全一致，注意HTTP/HTTPS、路径拼写
• 若客户端密钥包含特殊字符，需在配置文件中用引号包裹避免解析错误

内容的提问来源于stack exchange，提问作者Sergio B.