基于org.springframework.security.oauth2替代Apache Oltu获取OAuth2令牌方案咨询

以下是替代Apache Oltu、基于org.springframework.security.oauth2的客户端凭证模式获取OAuth2访问令牌的实现方案，适配不同版本的Spring Security：

方案1：Spring Security OAuth2.x 实现（使用OAuth2RestTemplate） #

这种方式适用于Spring Security OAuth2.x版本，与原Oltu逻辑最接近：

import org.springframework.security.oauth2.client.OAuth2RestTemplate;
import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsResourceDetails;
import org.springframework.security.oauth2.common.OAuth2AccessToken;

// 配置客户端凭证及令牌端点
ClientCredentialsResourceDetails resourceDetails = new ClientCredentialsResourceDetails();
resourceDetails.setAccessTokenUri("your-token-endpoint-url"); // 替换为实际令牌地址
resourceDetails.setClientId("CLIENT_ID"); // 替换为实际客户端ID
resourceDetails.setClientSecret("CLIENT_SECRET"); // 替换为实际客户端密钥

// 创建RestTemplate并获取访问令牌
OAuth2RestTemplate oAuth2RestTemplate = new OAuth2RestTemplate(resourceDetails);
OAuth2AccessToken accessToken = oAuth2RestTemplate.getAccessToken();

// 获取令牌值用于后续请求
String token = accessToken.getValue();

方案2：Spring Security 5+ 推荐实现（使用OAuth2AuthorizedClientManager） #

对于Spring Security 5及以上版本，推荐使用OAuth2AuthorizedClientManager，它内置令牌缓存、自动刷新等特性，更适合生产环境：

import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientProvider;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientProviderBuilder;
import org.springframework.security.oauth2.client.registration.ClientRegistration;
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
import org.springframework.security.oauth2.client.registration.InMemoryClientRegistrationRepository;
import org.springframework.security.oauth2.core.AuthorizationGrantType;
import org.springframework.security.oauth2.client.OAuth2AuthorizeRequest;

// 注册客户端信息
ClientRegistration clientRegistration = ClientRegistration.withRegistrationId("bank-client")
        .tokenUri("your-token-endpoint-url")
        .clientId("CLIENT_ID")
        .clientSecret("CLIENT_SECRET")
        .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
        .build();

// 初始化客户端注册仓库
ClientRegistrationRepository clientRegistrationRepository = new InMemoryClientRegistrationRepository(clientRegistration);

// 构建客户端凭证授权提供者
OAuth2AuthorizedClientProvider authorizedClientProvider = OAuth2AuthorizedClientProviderBuilder.builder()
        .clientCredentials()
        .build();

// 创建授权客户端管理器
OAuth2AuthorizedClientManager authorizedClientManager = context -> {
    String registrationId = context.getClientRegistrationId();
    ClientRegistration registration = clientRegistrationRepository.findByRegistrationId(registrationId);
    if (registration == null) {
        throw new IllegalArgumentException("Unknown client registration ID: " + registrationId);
    }
    return authorizedClientProvider.authorize(context);
};

// 获取包含令牌的授权客户端
OAuth2AuthorizedClient authorizedClient = authorizedClientManager.authorize(
        OAuth2AuthorizeRequest.withClientRegistrationId("bank-client").build());

if (authorizedClient != null) {
    String token = authorizedClient.getAccessToken().getTokenValue();
    // 使用令牌发起后续业务请求
}

注意事项 #

• 请将代码中的your-token-endpoint-url、CLIENT_ID、CLIENT_SECRET替换为实际的业务配置
• 若需要自定义HTTP客户端（如配置超时、代理、SSL证书等），可以通过注入自定义RestOperations实现来扩展
• 方案2的OAuth2AuthorizedClientManager会自动处理令牌缓存与过期刷新，无需手动维护令牌生命周期

内容的提问来源于stack exchange，提问作者GEETHU FRANCIS