如何在Spring Boot 2.X中基于Okta授权服务器实现Feign Client？

1. 添加必要依赖 #

在pom.xml中引入Feign和OAuth2客户端相关依赖，对应Spring Boot 2.X版本：

<dependencies>
    <!-- Spring Cloud OpenFeign -->
    <dependency>
        <groupId>org.springframework.cloud</groupId>
        <artifactId>spring-cloud-starter-openfeign</artifactId>
        <version>Hoxton.SR12</version>
    </dependency>
    <!-- Spring Security OAuth2 Client -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-oauth2-client</artifactId>
    </dependency>
</dependencies>

2. 配置Okta OAuth2客户端信息 #

在application.yml中配置Okta的客户端参数，对应你提供的curl命令信息：

spring:
  security:
    oauth2:
      client:
        registration:
          okta-client:
            client-id: XXXXXXXXXXXXX
            client-secret: XXXXXXXXXXXXXXXXXXXXXXXXXXX
            authorization-grant-type: client_credentials
            scope: api://default/access_as_app # 替换为你的API所需scope，无特殊需求可保留默认
        provider:
          okta-client:
            token-uri: https://dev-XXXXXX.okta.com/oauth2/default/v1/token

3. 实现Feign请求拦截器（自动注入Token） #

创建拦截器，利用Spring Security内置的OAuth2客户端管理器自动获取并刷新Token，添加到请求头：

import feign.RequestInterceptor;
import feign.RequestTemplate;
import org.springframework.security.oauth2.client.OAuth2AuthorizeRequest;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
import org.springframework.stereotype.Component;

@Component
public class OktaFeignInterceptor implements RequestInterceptor {

    private final OAuth2AuthorizedClientManager authorizedClientManager;

    public OktaFeignInterceptor(OAuth2AuthorizedClientManager authorizedClientManager) {
        this.authorizedClientManager = authorizedClientManager;
    }

    @Override
    public void apply(RequestTemplate template) {
        OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("okta-client")
                .principal("feign-client")
                .build();
        OAuth2AuthorizedClient authorizedClient = authorizedClientManager.authorize(authorizeRequest);

        if (authorizedClient != null && authorizedClient.getAccessToken() != null) {
            template.header("Authorization", "Bearer " + authorizedClient.getAccessToken().getTokenValue());
        }
    }
}

4. 定义Feign Client接口 #

创建对应受保护API的Feign Client接口：

import org.springframework.cloud.openfeign.FeignClient;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;

@FeignClient(name = "protected-api-client", url = "https://your-protected-api-base-url.com")
public interface ProtectedApiClient {

    // 示例：替换为你的API实际端点和返回类型
    @GetMapping("/api/resource/{id}")
    YourResourceDto getResourceById(@PathVariable("id") Long id);
}

注意替换API的基础地址和接口方法，YourResourceDto需自行定义对应API返回结构的实体类。

5. 启用Feign Client #

在Spring Boot启动类上添加@EnableFeignClients注解：

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.cloud.openfeign.EnableFeignClients;

@SpringBootApplication
@EnableFeignClients
public class YourApplication {
    public static void main(String[] args) {
        SpringApplication.run(YourApplication.class, args);
    }
}

额外注意事项 #

• 确保配置文件中的scope与受保护API要求的权限一致，否则Token会因权限不足被拒绝。
• OAuth2AuthorizedClientManager会自动处理Token的缓存和过期刷新，无需手动维护Token生命周期。
• 若出现权限问题，可先用curl获取的Token手动调用API，排查是否为API本身的权限配置问题。

内容的提问来源于stack exchange，提问作者Arpit S