如何配置Spring Boot的WebClient使用无Client-ID的OAuth2密码授权

1. 添加依赖 #

首先引入Spring Security OAuth2客户端依赖，用于自动处理Token的获取与管理：

Maven（pom.xml） #

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-oauth2-client</artifactId>
</dependency>

Gradle（build.gradle） #

implementation 'org.springframework.boot:spring-boot-starter-oauth2-client'

2. 配置OAuth2客户端 #

在application.yml或application.properties中配置密码授权类型的客户端，针对无Client-ID/Secret的场景，直接设置空值即可：

application.yml #

spring:
  security:
    oauth2:
      client:
        registration:
          custom-api:
            client-id: ""
            client-secret: ""
            authorization-grant-type: password
            scope: []  # 按目标API要求设置，无特殊需求留空
        provider:
          custom-api:
            token-uri: "https://目标API的Token端点URL"  # 替换为实际地址

application.properties #

spring.security.oauth2.client.registration.custom-api.client-id=
spring.security.oauth2.client.registration.custom-api.client-secret=
spring.security.oauth2.client.registration.custom-api.authorization-grant-type=password
spring.security.oauth2.client.registration.custom-api.scope=
spring.security.oauth2.client.provider.custom-api.token-uri=https://目标API的Token端点URL

3. 编写API调用逻辑 #

利用Spring提供的OAuth2AuthorizedClientManager自动处理Token的获取、缓存，以及携带Token调用API：

import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
import org.springframework.security.oauth2.client.context.OAuth2AuthorizationContext;
import org.springframework.stereotype.Service;
import org.springframework.web.client.RestTemplate;

@Service
public class ApiClientService {

    private final RestTemplate restTemplate;
    private final OAuth2AuthorizedClientManager authorizedClientManager;

    public ApiClientService(RestTemplate restTemplate,
                            ClientRegistrationRepository clientRegistrationRepository,
                            OAuth2AuthorizedClientService authorizedClientService) {
        this.restTemplate = restTemplate;
        this.authorizedClientManager = OAuth2AuthorizedClientManager.createDefault(
                clientRegistrationRepository, authorizedClientService);
    }

    public String callProtectedApi(String username, String password) {
        // 构建授权上下文，传入用户名密码
        OAuth2AuthorizationContext context = OAuth2AuthorizationContext.withRegistrationId("custom-api")
                .attributes(attrs -> {
                    attrs.put(OAuth2AuthorizationContext.USERNAME_ATTRIBUTE_NAME, username);
                    attrs.put(OAuth2AuthorizationContext.PASSWORD_ATTRIBUTE_NAME, password);
                })
                .build();

        // 自动获取并缓存Token
        OAuth2AuthorizedClient authorizedClient = authorizedClientManager.authorize(context);
        if (authorizedClient == null) {
            throw new RuntimeException("获取Token失败");
        }

        // 携带Bearer Token调用目标API
        String apiUrl = "https://目标API的资源端点URL";
        return restTemplate.getForObject(apiUrl, String.class,
                request -> request.getHeaders().setBearerAuth(authorizedClient.getAccessToken().getTokenValue()));
    }
}

4. 关键注意点 #

• 目标API的Token端点需支持grant_type=password请求，且请求体需符合标准格式（键名需加双引号）：

  {
    "grant_type": "password",
    "username": "your-username",
    "password": "your-password"
  }
  

• Spring OAuth2客户端默认会以表单编码格式发送请求，适配大多数API的要求；若有特殊编码需求，可自定义OAuth2AccessTokenResponseClient调整请求格式。
• 默认Token缓存基于内存，生产环境可替换为Redis等分布式缓存实现，避免重启服务后Token丢失。

内容的提问来源于stack exchange，提问作者pooya72