Java中调用Okta/OIDC保护的第三方API的最简实现方案

针对你的场景——无需Spring Boot，需要调用受Okta OIDC保护的第三方API，以下是两个轻量可行的方案：

方案1：使用OpenID4Java（成熟轻量OIDC客户端库） #

OpenID4Java是一款独立于Spring的老牌OIDC客户端实现，完整支持授权码流程，适合快速集成且无需额外框架依赖。

步骤与代码示例 #

1. 引入Maven依赖

<dependency>
    <groupId>org.openid4java</groupId>
    <artifactId>openid4java</artifactId>
    <version>1.0.0</version>
</dependency>

2. 核心客户端实现

import org.openid4java.consumer.ConsumerManager;
import org.openid4java.discovery.DiscoveryInformation;
import org.openid4java.message.AuthRequest;
import org.openid4java.message.ParameterList;
import org.openid4java.message.token.TokenResponse;

import java.util.List;

public class OktaOidcClient {
    private final ConsumerManager manager;
    private final String clientId;
    private final String clientSecret;
    private final String redirectUri;
    private DiscoveryInformation discoveryInfo;

    // 初始化客户端，传入Okta配置
    public OktaOidcClient(String oktaIssuer, String clientId, String clientSecret, String redirectUri) throws Exception {
        this.clientId = clientId;
        this.clientSecret = clientSecret;
        this.redirectUri = redirectUri;
        this.manager = new ConsumerManager();
        
        // 自动发现Okta的OIDC端点配置
        List<DiscoveryInformation> discoveries = manager.discover(oktaIssuer + "/.well-known/openid-configuration");
        this.discoveryInfo = manager.associate(discoveries);
    }

    // 生成用户跳转的授权URL
    public String getAuthorizationUrl() throws Exception {
        AuthRequest authReq = manager.createAuthRequest(discoveryInfo, clientId, redirectUri, "code", null);
        return authReq.getDestinationUrl(true);
    }

    // 处理回调，用授权码交换Access Token
    public String exchangeAccessToken(String callbackUrl) throws Exception {
        ParameterList responseParams = new ParameterList(new java.net.URL(callbackUrl).getQuery());
        TokenResponse tokenResp = manager.authResponse(discoveryInfo, responseParams, clientId, clientSecret, redirectUri);
        return tokenResp.getAccessToken();
    }

    // 调用受保护的第三方API
    public void callProtectedApi(String apiUrl, String accessToken) throws Exception {
        java.net.HttpURLConnection conn = (java.net.HttpURLConnection) new java.net.URL(apiUrl).openConnection();
        conn.setRequestProperty("Authorization", "Bearer " + accessToken);
        // 此处添加响应读取、错误处理逻辑
    }
}

方案2：手动实现OIDC授权码流程（极致轻量化） #

如果不想引入任何第三方OIDC库，可以基于Java原生HttpURLConnection实现核心流程，仅需一个轻量JSON解析库辅助处理响应。

步骤与代码示例 #

1. 可选：引入JSON解析库（用于解析Token响应）

<dependency>
    <groupId>org.json</groupId>
    <artifactId>json</artifactId>
    <version>20240303</version>
</dependency>

2. 核心实现代码

import org.json.JSONObject;

import java.io.BufferedReader;
import java.io.InputStreamReader;
import java.io.OutputStream;
import java.net.HttpURLConnection;
import java.net.URL;
import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;

public class ManualOktaOidcClient {
    // 替换为你的Okta配置
    private static final String OKTA_ISSUER = "https://your-okta-domain.com/oauth2/default";
    private static final String CLIENT_ID = "your-client-id";
    private static final String CLIENT_SECRET = "your-client-secret";
    private static final String REDIRECT_URI = "https://your-app.com/callback";

    // 生成授权跳转URL
    public static String buildAuthorizationUrl() throws Exception {
        String params = String.format(
            "client_id=%s&redirect_uri=%s&response_type=code&scope=openid",
            URLEncoder.encode(CLIENT_ID, StandardCharsets.UTF_8),
            URLEncoder.encode(REDIRECT_URI, StandardCharsets.UTF_8)
        );
        return OKTA_ISSUER + "/v1/authorize?" + params;
    }

    // 用授权码交换Access Token
    public static String exchangeToken(String code) throws Exception {
        URL tokenUrl = new URL(OKTA_ISSUER + "/v1/token");
        HttpURLConnection conn = (HttpURLConnection) tokenUrl.openConnection();
        conn.setRequestMethod("POST");
        conn.setDoOutput(true);
        conn.setRequestProperty("Content-Type", "application/x-www-form-urlencoded");

        String postData = String.format(
            "grant_type=authorization_code&code=%s&redirect_uri=%s&client_id=%s&client_secret=%s",
            URLEncoder.encode(code, StandardCharsets.UTF_8),
            URLEncoder.encode(REDIRECT_URI, StandardCharsets.UTF_8),
            URLEncoder.encode(CLIENT_ID, StandardCharsets.UTF_8),
            URLEncoder.encode(CLIENT_SECRET, StandardCharsets.UTF_8)
        );

        try (OutputStream os = conn.getOutputStream()) {
            byte[] input = postData.getBytes(StandardCharsets.UTF_8);
            os.write(input, 0, input.length);
        }

        // 解析Token响应
        try (BufferedReader br = new BufferedReader(new InputStreamReader(conn.getInputStream(), StandardCharsets.UTF_8))) {
            StringBuilder response = new StringBuilder();
            String line;
            while ((line = br.readLine()) != null) {
                response.append(line);
            }
            JSONObject tokenJson = new JSONObject(response.toString());
            return tokenJson.getString("access_token");
        }
    }

    // 调用受保护API
    public static String callProtectedApi(String apiUrl, String accessToken) throws Exception {
        URL url = new URL(apiUrl);
        HttpURLConnection conn = (HttpURLConnection) url.openConnection();
        conn.setRequestProperty("Authorization", "Bearer " + accessToken);
        conn.setRequestMethod("GET");

        try (BufferedReader br = new BufferedReader(new InputStreamReader(conn.getInputStream(), StandardCharsets.UTF_8))) {
            StringBuilder response = new StringBuilder();
            String line;
            while ((line = br.readLine()) != null) {
                response.append(line);
            }
            return response.toString();
        }
    }
}

方案选择建议 #

• 若需要完整的OIDC特性支持（如Token刷新、ID Token验证），优先选择OpenID4Java
• 若追求最小依赖、代码完全可控，选择手动实现方案

内容的提问来源于stack exchange，提问作者Jeffrey Nims