为何OAuth2AuthorizedClientService自动装配需依赖spring-boot-starter-web？

为什么OAuth2AuthorizedClientService需要spring-boot-starter-web才能自动装配？ #

Spring Boot的OAuth2客户端自动配置逻辑中，InMemoryOAuth2AuthorizedClientService（OAuth2AuthorizedClientService的默认实现）的注册是和Servlet Web环境绑定的。对应的自动配置类OAuth2ClientAutoConfiguration里，相关Bean的创建条件依赖Servlet上下文的存在——只有引入spring-boot-starter-web时，Spring Boot才会初始化ServletWebApplicationContext，触发这些Bean的自动注册。如果没有Web容器依赖，应用默认使用普通的ApplicationContext，自动配置不会触发，因此找不到对应的Bean。

无Web容器下的解决方案：手动配置核心Bean #

不需要引入spring-boot-starter-web，只需手动配置OAuth2客户端所需的核心Bean，即可实现令牌获取与资源服务器调用功能。

步骤1：保留必要依赖 #

仅需spring-boot-starter-oauth2-client依赖：

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-oauth2-client</artifactId>
</dependency>

步骤2：手动配置ClientRegistrationRepository #

配置OAuth2客户端的注册信息，示例使用内存实现：

import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.oauth2.client.registration.ClientRegistration;
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
import org.springframework.security.oauth2.client.registration.InMemoryClientRegistrationRepository;
import org.springframework.security.oauth2.core.AuthorizationGrantType;
import org.springframework.security.oauth2.core.ClientAuthenticationMethod;

@Configuration
public class OAuth2ClientConfig {

    @Value("${spring.security.oauth2.client.registration.my-client.client-id}")
    private String clientId;

    @Value("${spring.security.oauth2.client.registration.my-client.client-secret}")
    private String clientSecret;

    @Value("${spring.security.oauth2.client.registration.my-client.scope}")
    private String scope;

    @Value("${spring.security.oauth2.client.provider.my-provider.token-uri}")
    private String tokenUri;

    @Bean
    public ClientRegistrationRepository clientRegistrationRepository() {
        return new InMemoryClientRegistrationRepository(myClientRegistration());
    }

    private ClientRegistration myClientRegistration() {
        return ClientRegistration.withRegistrationId("my-client")
                .clientId(clientId)
                .clientSecret(clientSecret)
                .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
                .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS) // 根据实际授权类型调整，比如authorization_code
                .scope(scope.split(","))
                .tokenUri(tokenUri)
                .build();
    }
}

步骤3：配置OAuth2AuthorizedClientService #

手动创建内存实现的授权客户端服务：

@Bean
public OAuth2AuthorizedClientService authorizedClientService(ClientRegistrationRepository clientRegistrationRepository) {
    return new InMemoryOAuth2AuthorizedClientService(clientRegistrationRepository);
}

步骤4：配置令牌管理器（简化令牌获取） #

配置OAuth2AuthorizedClientManager来自动处理令牌的获取与刷新：

@Bean
public OAuth2AuthorizedClientManager authorizedClientManager(
        ClientRegistrationRepository clientRegistrationRepository,
        OAuth2AuthorizedClientService authorizedClientService) {

    OAuth2AuthorizedClientProvider authorizedClientProvider = OAuth2AuthorizedClientProviderBuilder.builder()
            .clientCredentials() // 对应授权类型，如用authorization_code则替换为authorizationCode()
            .build();

    DefaultOAuth2AuthorizedClientManager authorizedClientManager = new DefaultOAuth2AuthorizedClientManager(
            clientRegistrationRepository, authorizedClientService);
    authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);

    return authorizedClientManager;
}

步骤5：使用令牌调用资源服务器 #

通过令牌管理器获取令牌，添加到请求头后调用接口：

import org.springframework.security.oauth2.client.OAuth2AuthorizeRequest;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
import org.springframework.stereotype.Component;
import org.springframework.web.client.RestTemplate;

@Component
public class ResourceServerClient {

    private final OAuth2AuthorizedClientManager authorizedClientManager;
    private final RestTemplate restTemplate;

    public ResourceServerClient(OAuth2AuthorizedClientManager authorizedClientManager) {
        this.authorizedClientManager = authorizedClientManager;
        this.restTemplate = new RestTemplate();
    }

    public String callResourceServer() {
        OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("my-client")
                .principal("client-principal") // client_credentials模式下可随意填写标识
                .build();

        OAuth2AuthorizedClient authorizedClient = authorizedClientManager.authorize(authorizeRequest);
        String accessToken = authorizedClient.getAccessToken().getTokenValue();

        return restTemplate.getForObject("https://your-resource-server/api/endpoint", String.class,
                request -> request.getHeaders().setBearerAuth(accessToken));
    }
}

关键说明 #

• 需根据实际授权类型（如client_credentials、authorization_code）调整AuthorizationGrantType和OAuth2AuthorizedClientProvider的配置。
• 若使用authorization_code模式，命令行应用需额外处理用户授权流程（比如手动获取授权码并输入到应用），这种场景下优先选择client_credentials模式更适合无Web容器的后台应用。

内容的提问来源于stack exchange，提问作者jmsjr