如何为Spring Authorization Server中的OAuth2ClientAuthenticationToken设置提供者

错误原因 #

该错误是由于Spring Authorization Server的OAuth2ClientAuthenticationToken对应的AuthenticationProvider未被正确注册到Spring Security认证管理器中。在0.3.1版本的Spring Authorization Server中，默认处理客户端认证的提供者是OAuth2ClientAuthenticationProvider，需要手动配置或通过官方配置类引入。

解决步骤 #

1. 注册OAuth2ClientAuthenticationProvider #

在Spring Security配置类中，将OAuth2ClientAuthenticationProvider注入并添加到认证管理器的提供者列表中，同时确保RegisteredClientRepository Bean已配置（用于获取客户端信息）。

示例代码：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.ProviderManager;
import org.springframework.security.oauth2.server.authorization.authentication.OAuth2ClientAuthenticationProvider;
import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;

@Configuration
public class SecurityConfig {

    private final RegisteredClientRepository registeredClientRepository;

    public SecurityConfig(RegisteredClientRepository registeredClientRepository) {
        this.registeredClientRepository = registeredClientRepository;
    }

    @Bean
    public AuthenticationManager authenticationManager() {
        OAuth2ClientAuthenticationProvider clientAuthenticationProvider = 
            new OAuth2ClientAuthenticationProvider(registeredClientRepository);
        return new ProviderManager(clientAuthenticationProvider);
    }
}

2. 关联授权服务器配置 #

如果使用OAuth2AuthorizationServerConfiguration配置授权服务器，需要将上述认证管理器关联到客户端认证配置中：

import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.oauth2.server.authorization.config.annotation.web.configurers.OAuth2AuthorizationServerConfigurer;

@EnableWebSecurity
public class AuthorizationServerSecurityConfig {

    private final AuthenticationManager authenticationManager;

    public AuthorizationServerSecurityConfig(AuthenticationManager authenticationManager) {
        this.authenticationManager = authenticationManager;
    }

    @Bean
    public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
        OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
        http.getConfigurer(OAuth2AuthorizationServerConfigurer.class)
            .clientAuthentication(clientAuth -> 
                clientAuth.authenticationManager(authenticationManager));
        
        http.authorizeHttpRequests(auth -> auth.anyRequest().authenticated());
        return http.build();
    }
}

3. 正确配置客户端信息 #

通过RegisteredClientRepository注册客户端信息，示例如下（以内存实现为例，生产环境建议使用数据库存储）：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.oauth2.server.authorization.client.InMemoryRegisteredClientRepository;
import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
import org.springframework.security.oauth2.server.authorization.settings.ClientSettings;
import java.util.UUID;

@Configuration
public class ClientConfig {

    @Bean
    public RegisteredClientRepository registeredClientRepository() {
        RegisteredClient demoClient = RegisteredClient.withId(UUID.randomUUID().toString())
            .clientId("demo-client")
            .clientSecret("{noop}demo-secret") // 生产环境需使用密码编码器加密
            .clientAuthenticationMethod(org.springframework.security.oauth2.core.ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
            .authorizationGrantType(org.springframework.security.oauth2.core.AuthorizationGrantType.AUTHORIZATION_CODE)
            .redirectUri("http://localhost:8080/login/oauth2/code/demo-client")
            .scope("read")
            .clientSettings(ClientSettings.builder().requireAuthorizationConsent(true).build())
            .build();

        return new InMemoryRegisteredClientRepository(demoClient);
    }
}

关键说明 #

• OAuth2ClientAuthenticationProvider是Spring Authorization Server专门处理客户端身份认证的核心类，负责验证客户端的client_id、client_secret等信息。
• Spring Authorization Server 0.3.x版本需手动关联认证提供者，后续版本部分配置会自动完成，因此需确保认证管理器包含该提供者。

内容的提问来源于stack exchange，提问作者francissoria