如何为spring-security-oauth2-autoconfigure配置多个ClientRegistrationRepository

Spring Security OAuth2 完全支持多客户端注册配置，你遇到的原有登录流程被覆盖的问题，并非多客户端不兼容，而是默认安全过滤链优先级、全局客户端装配逻辑共同导致的。

问题根因 #

Spring Security OAuth2 自动装配的默认ClientRegistrationRepository本身会加载所有配置在application.properties中的spring.security.oauth2.client.registration.*条目，不会主动覆盖原有配置，触发问题的核心原因是两个配置遗漏：

• 你自定义的WebClient相关OAuth2配置没有绑定专属的隔离配置，和原有面向用户登录的安全过滤链共用了全局配置
• 新增的配置类如果没有显式指定过滤链匹配规则，优先级高于原有登录过滤链时，会直接接管所有请求的认证逻辑

修复步骤 #

1. 拆分两套独立安全过滤链 #

显式定义两个SecurityFilterChain Bean，分别处理用户登录请求和客户端凭证调用场景，通过order指定优先级，用户登录的过滤链优先级更高：

@Configuration
public class SecurityConfig {
    // 处理用户登录的过滤链，优先级更高
    @Bean
    @Order(1)
    public SecurityFilterChain userLoginSecurityFilterChain(HttpSecurity http) throws Exception {
        http
            .securityMatcher("/login/**", "/oauth2/**", "/**")
            .authorizeHttpRequests(auth -> auth
                .anyRequest().authenticated()
            )
            // 绑定原有Azure登录专属的客户端仓库，排除externalApp配置
            .oauth2Login(oauth2Login -> oauth2Login
                .clientRegistrationRepository(azureClientRegistrationRepository())
            );
        return http.build();
    }

    // 处理客户端凭证调用的过滤链，优先级更低，仅匹配内部接口路径
    @Bean
    @Order(2)
    public SecurityFilterChain clientCredentialsSecurityFilterChain(HttpSecurity http) throws Exception {
        http
            .securityMatcher("/internal/call-external/**")
            .authorizeHttpRequests(auth -> auth
                .anyRequest().authenticated()
            )
            .oauth2Client();
        return http.build();
    }
}

2. 为externalApp构建独立的客户端配置 #

不要使用全局自动装配的ClientRegistrationRepository，单独构建仅包含externalApp配置的实例，和原有登录配置完全隔离：

@Configuration
public class ExternalAppClientConfig {
    // 仅加载externalApp的客户端配置
    @Bean
    public ClientRegistrationRepository externalAppClientRegistrationRepository(OAuth2ClientProperties properties) {
        ClientRegistration externalAppReg = OAuth2ClientPropertiesRegistrationAdapter
            .getClientRegistrations(properties)
            .get("externalApp");
        return new InMemoryClientRegistrationRepository(externalAppReg);
    }

    @Bean
    public OAuth2AuthorizedClientService externalAppAuthorizedClientService(
        ClientRegistrationRepository externalAppClientRegistrationRepository
    ) {
        return new InMemoryOAuth2AuthorizedClientService(externalAppClientRegistrationRepository);
    }

    @Bean
    public OAuth2AuthorizedClientManager externalAppAuthorizedClientManager(
        ClientRegistrationRepository externalAppClientRegistrationRepository,
        OAuth2AuthorizedClientService externalAppAuthorizedClientService
    ) {
        AuthorizedClientServiceOAuth2AuthorizedClientManager manager =
            new AuthorizedClientServiceOAuth2AuthorizedClientManager(
                externalAppClientRegistrationRepository,
                externalAppAuthorizedClientService
            );
        manager.setAuthorizedClientProvider(new ClientCredentialsOAuth2AuthorizedClientProvider());
        return manager;
    }

    // 绑定独立配置生成WebClient
    @Bean
    public WebClient externalAppClient(OAuth2AuthorizedClientManager externalAppAuthorizedClientManager) {
        ServletOAuth2AuthorizedClientExchangeFilterFunction oauth2Filter =
            new ServletOAuth2AuthorizedClientExchangeFilterFunction(externalAppAuthorizedClientManager);
        oauth2Filter.setDefaultClientRegistrationId("externalApp");
        return WebClient.builder()
            .apply(oauth2Filter.oauth2Configuration())
            .build();
    }
}

3. 检查配置项正确性 #

确认application.properties中两个客户端的registrationId拼写正确，无冲突：

# 原有Azure登录配置
spring.security.oauth2.client.registration.azure.client-id=xxx
spring.security.oauth2.client.registration.azure.client-secret=xxx
# 其余Azure相关配置保持不变

# 新增externalApp客户端凭证配置
spring.security.oauth2.client.registration.externalApp.client-id=xxx
spring.security.oauth2.client.registration.externalApp.client-secret=xxx
spring.security.oauth2.client.registration.externalApp.authorization-grant-type=client_credentials
# 其余externalApp相关配置

做完以上调整后，两套客户端配置完全隔离，原有登录流程和externalApp的WebClient调用不会互相干扰。

内容的提问来源于stack exchange，提问作者PalBo