Spring Boot3+Java17升级后测试阶段SecurityFilterChain创建失败

项目环境 #

• Spring Boot 3.0.2
• Java 17
• Spring Cloud 2022.0.0-M3

build.gradle 配置 #

ext {
    springBootVersion = '3.0.2'
    springCloudVersion = '2022.0.0-M3'
}

implementation ('com.okta.spring:okta-spring-boot-starter:2.1.6'){
    exclude group: 'com.nimbusds', module:'oauth2-oidc-sdk'
    exclude group: 'org.springframework', module:'spring-web'
    exclude group: 'org.springframework.security', module:'spring-security-oauth2-client'
    exclude group: 'org.springframework.security', module: 'spring-security-oauth2-core'
    exclude group: 'org.springframework.security', module: 'spring-security-web'
}

implementation ('org.springframework.security:spring-security-oauth2-client:5.8.1'){
    exclude group: 'org.springframework.security', module: 'spring-security-oauth2-core'
    exclude group: 'org.springframework.security', module: 'spring-security-web'
    exclude group:  'org.json', module: 'json'
}
implementation 'org.springframework.security:spring-security-oauth2-core:6.0.0'
implementation group: 'com.google.auth', name: 'google-auth-library-oauth2-http', version: '1.3.0'
implementation group: 'com.google.auth', name: 'google-auth-library-oauth2-http', version: '0.25.5'
implementation group: 'com.google.oauth-client', name: 'google-oauth-client', version: '1.33.3'
runtimeOnly 'com.nimbusds:oauth2-oidc-sdk:10.3'

implementation 'org.springframework.security:spring-security-oauth2-core:6.0.0'
implementation 'org.springframework.security:spring-security-web:6.0.0'

本地安全配置类 #

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Profile;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@Profile({"local", "default", "test"})
public class WebSecurityConfigurationLocal {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception{
        http.csrf().disable().authorizeRequests()
                .anyRequest().permitAll();
        return http.build();
    }
}

异常情况 #

执行构建命令 ./gradlew clean build -x test 可成功，但运行单元/集成测试时抛出以下异常：

Caused by: org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'filterChain' defined in class path resource [com/max/network/student/configuration/WebSecurityConfigurationLocal.class]: Unsatisfied dependency expressed through method 'filterChain' parameter 0: Error creating bean with name 'org.springframework.security.config.annotation.web.configuration.HttpSecurityConfiguration': Unsatisfied dependency expressed through method 'setContentNegotiationStrategy' parameter 0: Error creating bean with name 'org.springframework.boot.autoconfigure.web.servlet.WebMvcAutoConfiguration$EnableWebMvcConfiguration': Unsatisfied dependency expressed through method 'setConfigurers' parameter 0: Error creating bean with name 'org.springframework.security.config.annotation.web.configuration.OAuth2ClientConfiguration$OAuth2ClientWebMvcSecurityConfiguration': Unsatisfied dependency expressed through method 'setAuthorizedClientRepository' parameter 0: Error creating bean with name 'authorizedClientRepository' defined in class path resource [org/springframework/boot/autoconfigure/security/oauth2/client/servlet/OAuth2WebSecurityConfiguration.class]: Unsatisfied dependency expressed through method 'authorizedClientRepository' parameter 0: Error creating bean with name 'authorizedClientService' defined in class path resource [org/springframework/boot/autoconfigure/security/oauth2/client/servlet/OAuth2WebSecurityConfiguration.class]: Unsatisfied dependency expressed through method 'authorizedClientService' parameter 0: Error creating bean with name 'clientRegistrationRepository' defined in class path resource [org/springframework/boot/autoconfigure/security/oauth2/client/servlet/OAuth2ClientRegistrationRepositoryConfiguration.class]: Failed to instantiate [org.springframework.security.oauth2.client.registration.InMemoryClientRegistrationRepository]: Factory method 'clientRegistrationRepository' threw exception with message: Could not initialize class org.springframework.security.oauth2.client.registration.ClientRegistration$Builder

原因分析 #

1. 版本冲突：Spring Boot 3.x 依赖 Spring Security 6.x，但配置中引入了 Spring Security OAuth2 Client 5.8.1，与 6.x 的 spring-security-oauth2-core、spring-security-web 不兼容。ClientRegistration$Builder 在 6.x 中存在类结构/依赖变更，5.x 版本无法适配。
2. Okta Starter 版本不匹配：Okta Spring Boot Starter 2.1.6 是为 Spring Boot 2.x 设计的，无法兼容 Spring Boot 3.x 的自动配置逻辑。
3. 重复依赖：google-auth-library-oauth2-http 同时声明了 1.3.0 和 0.25.5 两个版本，spring-security-oauth2-core 重复声明两次，会导致类加载冲突或版本不一致。
4. 过度依赖排除：对 Okta Starter 排除了大量 Spring Security 核心依赖，破坏了 Spring Boot 自动配置的依赖链，导致 OAuth2 相关 Bean 初始化失败。

解决办法 #

1. 统一依赖版本并升级Okta Starter #

修改 build.gradle，使用适配 Spring Boot 3.x 的 Okta Starter，移除手动指定的冲突 Spring Security 版本，利用 Spring Boot 依赖管理统一版本：

ext {
    springBootVersion = '3.0.2'
    springCloudVersion = '2022.0.0-M3'
}

// 使用适配Spring Boot 3的Okta版本
implementation 'com.okta.spring:okta-spring-boot-starter:3.0.3'

// 移除冲突的Spring Security OAuth2 Client 5.8.1，改用Spring Boot管理的6.x版本
// 移除重复的spring-security-oauth2-core声明
implementation group: 'com.google.auth', name: 'google-auth-library-oauth2-http', version: '1.3.0'
implementation group: 'com.google.oauth-client', name: 'google-oauth-client', version: '1.33.3'
// 移除重复的google-auth-library-oauth2-http 0.25.5
runtimeOnly 'com.nimbusds:oauth2-oidc-sdk:10.3'

2. 适配Spring Security 6.x API #

Spring Security 6.x 中 authorizeRequests() 已被废弃，替换为 authorizeHttpRequests()，修改本地安全配置类：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Profile;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@Profile({"local", "default", "test"})
public class WebSecurityConfigurationLocal {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception{
        http.csrf().disable()
            .authorizeHttpRequests(auth -> auth.anyRequest().permitAll());
        return http.build();
    }
}

3. 测试环境禁用OAuth2自动配置（可选） #

如果测试环境不需要OAuth2功能，可以在测试类或配置类中排除相关自动配置，避免不必要的Bean初始化：

// 在测试类的@SpringBootApplication或@Configuration中添加
@EnableAutoConfiguration(exclude = {OAuth2ClientAutoConfiguration.class, OAuth2ResourceServerAutoConfiguration.class})

或者在测试类中模拟OAuth2相关Bean：

@MockBean
private ClientRegistrationRepository clientRegistrationRepository;

@MockBean
private AuthorizedClientService authorizedClientService;

内容的提问来源于stack exchange，提问作者MA-Dev