此版本仍在开发中，尚不被认为是稳定的。对于最新的稳定版本，请使用 Spring Security 6.5.3！spring-doc.cadn.net.cn

OAuth2 WebFlux

Spring Security 提供全面的 OAuth 2.0 支持。本节讨论如何将 OAuth 2.0 集成到响应式应用程序中。spring-doc.cadn.net.cn

概述

Spring Security 的 OAuth 2.0 支持由两个主要功能集组成：spring-doc.cadn.net.cn

OAuth2 登录是一个非常强大的 OAuth2 客户端功能，值得在参考文档中单独列出一节。但是，它不作为独立功能存在，需要 OAuth2 客户端才能运行。spring-doc.cadn.net.cn

这些功能集涵盖了 OAuth 2.0 授权框架中定义的资源服务器和客户端角色，而授权服务器角色则由 Spring Authorization Server 覆盖，Spring Authorization Server 是一个基于 Spring Security 构建的单独项目。spring-doc.cadn.net.cn

OAuth2 中的资源服务器和客户端角色通常由一个或多个服务器端应用程序表示。此外，授权服务器角色可以由一个或多个第三方表示（就像在组织内集中身份管理和/或身份验证时一样），或者它可以由应用程序表示（就像 Spring Authorization Server 的情况一样）。spring-doc.cadn.net.cn

例如，典型的基于 OAuth2 的微服务架构可能由单个面向用户的客户端应用程序、多个提供 REST API 的后端资源服务器以及用于管理用户和身份验证问题的第三方授权服务器组成。通常，单个应用程序仅代表这些角色之一，并且需要与提供其他角色的一个或多个第三方集成。spring-doc.cadn.net.cn

Spring Security 处理这些场景以及更多场景。以下部分介绍了 Spring Security 提供的角色，并包含常见场景的示例。spring-doc.cadn.net.cn

OAuth2 资源服务器

本节包含 OAuth2 资源服务器功能及其示例的摘要。有关完整的参考文档，请参阅 OAuth 2.0 资源服务器。spring-doc.cadn.net.cn

要开始使用，请添加spring-security-oauth2-resource-server依赖项目。使用 Spring Boot 时，添加以下Starters：spring-doc.cadn.net.cn

带有 Spring Boot 的 OAuth2 客户端

Gradlespring-doc.cadn.net.cn
Mavenspring-doc.cadn.net.cn

implementation 'org.springframework.boot:spring-boot-starter-oauth2-resource-server'

<dependency>
	<groupId>org.springframework.boot</groupId>
	<artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
</dependency>

有关不使用 Spring Boot 时的其他选项，请参阅获取 Spring Security。spring-doc.cadn.net.cn

考虑 OAuth2 资源服务器的以下用例：spring-doc.cadn.net.cn

我想使用 OAuth2 保护对 API 的访问（授权服务器提供 JWT 或不透明访问Tokens）spring-doc.cadn.net.cn
我想使用 JWT（自定义Tokens）保护对 API 的访问 spring-doc.cadn.net.cn

使用 OAuth2 访问Tokens保护访问

使用 OAuth2 访问Tokens保护对 API 的访问是很常见的。在大多数情况下，Spring Security 只需要最少的配置即可使用 OAuth2 保护应用程序。spring-doc.cadn.net.cn

有两种类型BearerSpring Security 支持的Tokens，每个Tokens都使用不同的组件进行验证：spring-doc.cadn.net.cn

JWT 支持使用ReactiveJwtDecoder用于验证签名和解码Tokens的 beanspring-doc.cadn.net.cn
不透明Tokens支持使用ReactiveOpaqueTokenIntrospectorbean 到 Introspect Tokensspring-doc.cadn.net.cn

JWT 支持

以下示例配置ReactiveJwtDecoderbean 使用 Spring Boot 配置属性：spring-doc.cadn.net.cn

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: https://my-auth-server.com

使用 Spring Boot 时，只需这样做即可。 Spring Boot提供的默认排列方式相当于以下内容：spring-doc.cadn.net.cn

使用 JWT 配置资源服务器

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Configuration
@EnableWebFluxSecurity
public class SecurityConfig {

	@Bean
	public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
		http
			.authorizeExchange((authorize) -> authorize
				.anyExchange().authenticated()
			)
			.oauth2ResourceServer((oauth2) -> oauth2
				.jwt(Customizer.withDefaults())
			);
		return http.build();
	}

	@Bean
	public ReactiveJwtDecoder jwtDecoder() {
		return ReactiveJwtDecoders.fromIssuerLocation("https://my-auth-server.com");
	}

}

import org.springframework.security.config.web.server.invoke

@Configuration
@EnableWebFluxSecurity
class SecurityConfig {

	@Bean
	fun securityWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
		return http {
			authorizeExchange {
				authorize(anyExchange, authenticated)
			}
			oauth2ResourceServer {
				jwt { }
			}
		}
	}

	@Bean
	fun jwtDecoder(): ReactiveJwtDecoder {
		return ReactiveJwtDecoders.fromIssuerLocation("https://my-auth-server.com")
	}

}

不透明Tokens支持

以下示例配置了ReactiveOpaqueTokenIntrospectorbean 使用 Spring Boot 配置属性：spring-doc.cadn.net.cn

spring:
  security:
    oauth2:
      resourceserver:
        opaquetoken:
          introspection-uri: https://my-auth-server.com/oauth2/introspect
          client-id: my-client-id
          client-secret: my-client-secret

使用 Spring Boot 时，只需这样做即可。 Spring Boot提供的默认排列方式相当于以下内容：spring-doc.cadn.net.cn

使用不透明Tokens配置资源服务器

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Configuration
@EnableWebFluxSecurity
public class SecurityConfig {

	@Bean
	public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
		http
			.authorizeExchange((authorize) -> authorize
				.anyExchange().authenticated()
			)
			.oauth2ResourceServer((oauth2) -> oauth2
				.opaqueToken(Customizer.withDefaults())
			);
		return http.build();
	}

	@Bean
	public ReactiveOpaqueTokenIntrospector opaqueTokenIntrospector() {
		return new SpringReactiveOpaqueTokenIntrospector(
			"https://my-auth-server.com/oauth2/introspect", "my-client-id", "my-client-secret");
	}

}

import org.springframework.security.config.web.server.invoke

@Configuration
@EnableWebFluxSecurity
class SecurityConfig {

	@Bean
	fun securityWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
		return http {
			authorizeExchange {
				authorize(anyExchange, authenticated)
			}
			oauth2ResourceServer {
				opaqueToken { }
			}
		}
	}

	@Bean
	fun opaqueTokenIntrospector(): ReactiveOpaqueTokenIntrospector {
		return SpringReactiveOpaqueTokenIntrospector(
			"https://my-auth-server.com/oauth2/introspect", "my-client-id", "my-client-secret"
		)
	}

}

使用自定义 JWT 保护访问

使用 JWT 保护对 API 的访问是一个相当普遍的目标，特别是当前端被开发为单页应用程序时。 Spring Security 中的 OAuth2 资源服务器支持可用于任何类型的BearerTokens，包括自定义 JWT。spring-doc.cadn.net.cn

使用 JWT 保护 API 所需的只是一个ReactiveJwtDecoderbean，用于验证签名和解码Tokens。 Spring Security 将自动使用提供的 bean 在SecurityWebFilterChain.spring-doc.cadn.net.cn

以下示例配置ReactiveJwtDecoderbean 使用 Spring Boot 配置属性：spring-doc.cadn.net.cn

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          public-key-location: classpath:my-public-key.pub

您可以将公密钥作为类路径资源（称为my-public-key.pub在本例中）。spring-doc.cadn.net.cn

使用 Spring Boot 时，只需这样做即可。 Spring Boot提供的默认排列方式相当于以下内容：spring-doc.cadn.net.cn

使用自定义 JWT 配置资源服务器

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Configuration
@EnableWebFluxSecurity
public class SecurityConfig {

	@Bean
	public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
		http
			.authorizeExchange((authorize) -> authorize
				.anyExchange().authenticated()
			)
			.oauth2ResourceServer((oauth2) -> oauth2
				.jwt(Customizer.withDefaults())
			);
		return http.build();
	}

	@Bean
	public ReactiveJwtDecoder jwtDecoder() {
		return NimbusReactiveJwtDecoder.withPublicKey(publicKey()).build();
	}

	private RSAPublicKey publicKey() {
		// ...
	}

}

import org.springframework.security.config.web.server.invoke

@Configuration
@EnableWebFluxSecurity
class SecurityConfig {

	@Bean
	fun securityWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
		return http {
			authorizeExchange {
				authorize(anyExchange, authenticated)
			}
			oauth2ResourceServer {
				jwt { }
			}
		}
	}

	@Bean
	fun jwtDecoder(): ReactiveJwtDecoder {
		return NimbusReactiveJwtDecoder.withPublicKey(publicKey()).build()
	}

	private fun publicKey(): RSAPublicKey {
		// ...
	}

}

Spring Security 不提供用于铸造Tokens的端点。但是，Spring Security 确实提供了JwtEncoder接口以及一个实现，即NimbusJwtEncoder.spring-doc.cadn.net.cn

OAuth2 客户端

本节包含 OAuth2 客户端功能的摘要和示例。有关完整的参考文档，请参阅 OAuth 2.0 客户端和 OAuth 2.0 登录。spring-doc.cadn.net.cn

要开始使用，请添加spring-security-oauth2-client依赖项目。使用 Spring Boot 时，添加以下Starters：spring-doc.cadn.net.cn

带有 Spring Boot 的 OAuth2 客户端

Gradlespring-doc.cadn.net.cn
Mavenspring-doc.cadn.net.cn

implementation 'org.springframework.boot:spring-boot-starter-oauth2-client'

<dependency>
	<groupId>org.springframework.boot</groupId>
	<artifactId>spring-boot-starter-oauth2-client</artifactId>
</dependency>

有关不使用 Spring Boot 时的其他选项，请参阅获取 Spring Security。spring-doc.cadn.net.cn

考虑 OAuth2 客户端的以下用例：spring-doc.cadn.net.cn

我想使用 OAuth 2.0 或 OpenID Connect 1.0 登录用户 spring-doc.cadn.net.cn
我想为用户获取访问Tokens，以便访问第三方 APIspring-doc.cadn.net.cn
我想同时执行这两个作（登录用户并访问第三方 API）spring-doc.cadn.net.cn
我想启用延期授权类型 spring-doc.cadn.net.cn
我想自定义现有授权类型 spring-doc.cadn.net.cn
我想自定义Tokens请求参数 spring-doc.cadn.net.cn
我想自定义WebClient由 OAuth2 客户端组件使用 spring-doc.cadn.net.cn

使用 OAuth2 登录用户

要求用户通过 OAuth2 登录是很常见的。OpenID Connect 1.0 提供了一个名为id_token旨在为 OAuth2 客户端提供执行用户身份验证和登录用户的能力。在某些情况下，OAuth2 可以直接用于登录用户（例如未实现 OpenID Connect 的流行社交登录提供商，例如 GitHub 和 Facebook）。spring-doc.cadn.net.cn

以下示例将应用程序配置为充当能够使用 OAuth2 或 OpenID Connect 登录用户的 OAuth2 客户端：spring-doc.cadn.net.cn

配置 OAuth2 登录

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Configuration
@EnableWebFluxSecurity
public class SecurityConfig {

	@Bean
	public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
		http
			// ...
			.oauth2Login(Customizer.withDefaults());
		return http.build();
	}

}

import org.springframework.security.config.web.server.invoke

@Configuration
@EnableWebFluxSecurity
class SecurityConfig {

	@Bean
	fun securityWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
		return http {
			// ...
			oauth2Login { }
		}
	}

}

除了上述配置外，应用程序还需要至少一个ClientRegistration通过使用ReactiveClientRegistrationRepository豆。以下示例配置了InMemoryReactiveClientRegistrationRepositorybean 使用 Spring Boot 配置属性：spring-doc.cadn.net.cn

spring:
  security:
    oauth2:
      client:
        registration:
          my-oidc-client:
            provider: my-oidc-provider
            client-id: my-client-id
            client-secret: my-client-secret
            authorization-grant-type: authorization_code
            scope: openid,profile
        provider:
          my-oidc-provider:
            issuer-uri: https://my-oidc-provider.com

通过上述配置，应用程序现在支持两个额外的终结点：spring-doc.cadn.net.cn

登录端点（例如/oauth2/authorization/my-oidc-client）用于启动登录并执行重定向到第三方授权服务器。spring-doc.cadn.net.cn
重定向端点（例如/login/oauth2/code/my-oidc-client）被授权服务器用来重定向回客户端应用程序，并且将包含一个code参数用于获取id_token和/或access_token通过访问Tokens请求。spring-doc.cadn.net.cn

的存在openidscope 表示应使用 OpenID Connect 1.0。这指示 Spring Security 使用特定于 OIDC 的组件（例如OidcReactiveOAuth2UserService）在请求处理期间。如果没有此范围，Spring Security 将使用特定于 OAuth2 的组件（例如DefaultReactiveOAuth2UserService）代替。spring-doc.cadn.net.cn

访问受保护的资源

向受 OAuth2 保护的第三方 API 发出请求是 OAuth2 客户端的核心用例。这是通过授权客户端（由OAuth2AuthorizedClient类）并通过放置Bearertoken 中的Authorization出站请求的标头。spring-doc.cadn.net.cn

以下示例将应用程序配置为充当能够从第三方 API 请求受保护资源的 OAuth2 客户端：spring-doc.cadn.net.cn

配置 OAuth2 客户端

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Configuration
@EnableWebFluxSecurity
public class SecurityConfig {

	@Bean
	public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
		http
			// ...
			.oauth2Client(Customizer.withDefaults());
		return http.build();
	}

}

import org.springframework.security.config.web.server.invoke

@Configuration
@EnableWebFluxSecurity
class SecurityConfig {

	@Bean
	fun securityWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
		return http {
			// ...
			oauth2Client { }
		}
	}

}

上面的示例没有提供登录用户的方法。您可以使用任何其他登录机制（例如formLogin()). 请参阅下一节，了解组合示例oauth2Client()跟oauth2Login().spring-doc.cadn.net.cn

spring:
  security:
    oauth2:
      client:
        registration:
          my-oauth2-client:
            provider: my-auth-server
            client-id: my-client-id
            client-secret: my-client-secret
            authorization-grant-type: authorization_code
            scope: message.read,message.write
        provider:
          my-auth-server:
            issuer-uri: https://my-auth-server.com

除了配置 Spring Security 以支持 OAuth2 客户端功能外，您还需要决定如何访问受保护的资源并相应地配置您的应用程序。 Spring Security 提供了ReactiveOAuth2AuthorizedClientManager用于获取可用于访问受保护资源的访问Tokens。spring-doc.cadn.net.cn

Spring Security 注册默认值ReactiveOAuth2AuthorizedClientManager当一个不存在时，你会遇到一个豆。spring-doc.cadn.net.cn

使用ReactiveOAuth2AuthorizedClientManager是通过ExchangeFilterFunction通过WebClient.spring-doc.cadn.net.cn

以下示例使用默认的ReactiveOAuth2AuthorizedClientManager配置WebClient能够通过放置BearerTokens中的Authorization每个请求的标头：spring-doc.cadn.net.cn

配置WebClient跟ExchangeFilterFunction

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Configuration
public class WebClientConfig {

	@Bean
	public WebClient webClient(ReactiveOAuth2AuthorizedClientManager authorizedClientManager) {
		ServerOAuth2AuthorizedClientExchangeFilterFunction filter =
				new ServerOAuth2AuthorizedClientExchangeFilterFunction(authorizedClientManager);
		return WebClient.builder()
				.filter(filter)
				.build();
	}

}

@Configuration
class WebClientConfig {

	@Bean
	fun webClient(authorizedClientManager: ReactiveOAuth2AuthorizedClientManager): WebClient {
		val filter = ServerOAuth2AuthorizedClientExchangeFilterFunction(authorizedClientManager)
		return WebClient.builder()
			.filter(filter)
			.build()
	}

}

这配置了WebClient可以如以下示例所示：spring-doc.cadn.net.cn

用WebClient访问受保护资源

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

import static org.springframework.security.oauth2.client.web.reactive.function.client.ServerOAuth2AuthorizedClientExchangeFilterFunction.clientRegistrationId;

@RestController
public class MessagesController {

	private final WebClient webClient;

	public MessagesController(WebClient webClient) {
		this.webClient = webClient;
	}

	@GetMapping("/messages")
	public Mono<ResponseEntity<List<Message>>> messages() {
		return this.webClient.get()
				.uri("http://localhost:8090/messages")
				.attributes(clientRegistrationId("my-oauth2-client"))
				.retrieve()
				.toEntityList(Message.class);
	}

	public record Message(String message) {
	}

}

import org.springframework.security.oauth2.client.web.reactive.function.client.ServerOAuth2AuthorizedClientExchangeFilterFunction.clientRegistrationId

@RestController
class MessagesController(private val webClient: WebClient) {

	@GetMapping("/messages")
	fun messages(): Mono<ResponseEntity<List<Message>>> {
		return webClient.get()
			.uri("http://localhost:8090/messages")
			.attributes(clientRegistrationId("my-oauth2-client"))
			.retrieve()
			.toEntityList<Message>()
	}

	data class Message(val message: String)

}

访问当前用户的受保护资源

当用户通过 OAuth2 或 OpenID Connect 登录时，授权服务器可能会提供一个访问Tokens，该Tokens可直接用于访问受保护的资源。这很方便，因为它只需要一个ClientRegistration同时为两个用例进行配置。spring-doc.cadn.net.cn

本节将使用 OAuth2 登录用户和访问受保护资源合并到单个配置中。还存在其他高级方案，例如配置一个ClientRegistration用于登录，另一个用于访问受保护资源。所有这些方案都将使用相同的基本配置。spring-doc.cadn.net.cn

以下示例将应用程序配置为充当 OAuth2 客户端，能够登录用户并从第三方 API 请求受保护的资源：spring-doc.cadn.net.cn

配置 OAuth2 登录和 OAuth2 客户端

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Configuration
@EnableWebFluxSecurity
public class SecurityConfig {

	@Bean
	public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
		http
			// ...
			.oauth2Login(Customizer.withDefaults())
			.oauth2Client(Customizer.withDefaults());
		return http.build();
	}

}

import org.springframework.security.config.web.server.invoke

@Configuration
@EnableWebFluxSecurity
class SecurityConfig {

	@Bean
	fun securityWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
		return http {
			// ...
			oauth2Login { }
			oauth2Client { }
		}
	}

}

spring:
  security:
    oauth2:
      client:
        registration:
          my-combined-client:
            provider: my-auth-server
            client-id: my-client-id
            client-secret: my-client-secret
            authorization-grant-type: authorization_code
            scope: openid,profile,message.read,message.write
        provider:
          my-auth-server:
            issuer-uri: https://my-auth-server.com

前面的示例（使用 OAuth2 登录用户，访问受保护的资源）与此示例之间的主要区别在于通过scope属性，它结合了标准作用域openid和profile使用自定义范围message.read和message.write.spring-doc.cadn.net.cn

Spring Security 注册默认值ReactiveOAuth2AuthorizedClientManager当一个不存在时，你会遇到一个豆。spring-doc.cadn.net.cn

使用ReactiveOAuth2AuthorizedClientManager是通过ExchangeFilterFunction通过WebClient.spring-doc.cadn.net.cn

以下示例使用默认的ReactiveOAuth2AuthorizedClientManager配置WebClient能够通过放置BearerTokens中的Authorization每个请求的标头：spring-doc.cadn.net.cn

配置WebClient跟ExchangeFilterFunction

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Configuration
public class WebClientConfig {

	@Bean
	public WebClient webClient(ReactiveOAuth2AuthorizedClientManager authorizedClientManager) {
		ServerOAuth2AuthorizedClientExchangeFilterFunction filter =
				new ServerOAuth2AuthorizedClientExchangeFilterFunction(authorizedClientManager);
		return WebClient.builder()
				.filter(filter)
				.build();
	}

}

@Configuration
class WebClientConfig {

	@Bean
	fun webClient(authorizedClientManager: ReactiveOAuth2AuthorizedClientManager): WebClient {
		val filter = ServerOAuth2AuthorizedClientExchangeFilterFunction(authorizedClientManager)
		return WebClient.builder()
			.filter(filter)
			.build()
	}

}

这配置了WebClient可以如以下示例所示：spring-doc.cadn.net.cn

用WebClient访问受保护的资源（当前用户）

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@RestController
public class MessagesController {

	private final WebClient webClient;

	public MessagesController(WebClient webClient) {
		this.webClient = webClient;
	}

	@GetMapping("/messages")
	public Mono<ResponseEntity<List<Message>>> messages() {
		return this.webClient.get()
				.uri("http://localhost:8090/messages")
				.retrieve()
				.toEntityList(Message.class);
	}

	public record Message(String message) {
	}

}

@RestController
class MessagesController(private val webClient: WebClient) {

	@GetMapping("/messages")
	fun messages(): Mono<ResponseEntity<List<Message>>> {
		return webClient.get()
			.uri("http://localhost:8090/messages")
			.retrieve()
			.toEntityList<Message>()
	}

	data class Message(val message: String)

}

与前面的示例不同，请注意，我们不需要告诉 Spring Security 有关clientRegistrationId我们想使用。这是因为它可以从当前登录的用户派生。spring-doc.cadn.net.cn

启用延期授权类型

常见用例涉及启用和/或配置扩展授权类型。例如，Spring Security 为jwt-bearer和token-exchangegrant 类型，但默认情况下不会启用它们，因为它们不是核心 OAuth 2.0 规范的一部分。spring-doc.cadn.net.cn

使用 Spring Security 6.3 及更高版本，我们可以简单地为一个或多个发布一个 beanReactiveOAuth2AuthorizedClientProvider它们将被自动拾取。以下示例只是启用jwt-bearer赠款类型：spring-doc.cadn.net.cn

使jwt-bearer赠款类型

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Configuration
public class SecurityConfig {

	@Bean
	public ReactiveOAuth2AuthorizedClientProvider jwtBearer() {
		return new JwtBearerReactiveOAuth2AuthorizedClientProvider();
	}

}

@Configuration
class SecurityConfig {

	@Bean
	fun jwtBearer(): ReactiveOAuth2AuthorizedClientProvider {
		return JwtBearerReactiveOAuth2AuthorizedClientProvider()
	}

}

默认ReactiveOAuth2AuthorizedClientManager如果尚未提供，则将由 Spring Security 自动发布。spring-doc.cadn.net.cn

任何自定义OAuth2AuthorizedClientProvider豆子也将被拾取并应用于提供的ReactiveOAuth2AuthorizedClientManager在默认授权类型之后。spring-doc.cadn.net.cn

为了在 Spring Security 6.3 之前实现上述配置，我们必须自己发布此 bean，并确保我们也重新启用了默认授权类型。要了解幕后配置的内容，配置可能如下所示：spring-doc.cadn.net.cn

使jwt-bearer授权类型（6.3 之前）

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Configuration
public class SecurityConfig {

	@Bean
	public ReactiveOAuth2AuthorizedClientManager authorizedClientManager(
			ReactiveClientRegistrationRepository clientRegistrationRepository,
			ServerOAuth2AuthorizedClientRepository authorizedClientRepository) {

		ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
			ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
				.authorizationCode()
				.refreshToken()
				.clientCredentials()
				.provider(new JwtBearerReactiveOAuth2AuthorizedClientProvider())
				.build();

		DefaultReactiveOAuth2AuthorizedClientManager authorizedClientManager =
			new DefaultReactiveOAuth2AuthorizedClientManager(
				clientRegistrationRepository, authorizedClientRepository);
		authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);

		return authorizedClientManager;
	}

}

@Configuration
class SecurityConfig {

	@Bean
	fun authorizedClientManager(
		clientRegistrationRepository: ReactiveClientRegistrationRepository,
		authorizedClientRepository: ServerOAuth2AuthorizedClientRepository
	): ReactiveOAuth2AuthorizedClientManager {
		val authorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
			.authorizationCode()
			.refreshToken()
			.clientCredentials()
			.provider(JwtBearerReactiveOAuth2AuthorizedClientProvider())
			.build()

		val authorizedClientManager = DefaultReactiveOAuth2AuthorizedClientManager(
			clientRegistrationRepository, authorizedClientRepository
		)
		authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)

		return authorizedClientManager
	}

}

自定义现有授权类型

通过发布 Bean 启用扩展授权类型的功能还提供了自定义现有授权类型的机会，而无需重新定义默认值。例如，如果我们想自定义ReactiveOAuth2AuthorizedClientProvider对于client_credentialsgrant，我们可以简单地发布一个 bean，如下所示：spring-doc.cadn.net.cn

自定义客户端凭据授权类型

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Configuration
public class SecurityConfig {

	@Bean
	public ReactiveOAuth2AuthorizedClientProvider clientCredentials() {
		ClientCredentialsReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
				new ClientCredentialsReactiveOAuth2AuthorizedClientProvider();
		authorizedClientProvider.setClockSkew(Duration.ofMinutes(5));

		return authorizedClientProvider;
	}

}

@Configuration
class SecurityConfig {

	@Bean
	fun clientCredentials(): ReactiveOAuth2AuthorizedClientProvider {
		val authorizedClientProvider = ClientCredentialsReactiveOAuth2AuthorizedClientProvider()
		authorizedClientProvider.setClockSkew(Duration.ofMinutes(5))
		return authorizedClientProvider
	}

}

自定义Tokens请求参数

在获取访问Tokens时需要自定义请求参数是相当普遍的。例如，假设我们要添加自定义audience参数添加到Tokens请求，因为提供程序需要此参数才能用于authorization_code授予。spring-doc.cadn.net.cn

我们可以简单地发布一个类型的 beanReactiveOAuth2AccessTokenResponseClient替换为 generic 类型OAuth2AuthorizationCodeGrantRequestSpring Security 将使用它来配置 OAuth2 客户端组件。spring-doc.cadn.net.cn

以下示例自定义了authorization_code授予：spring-doc.cadn.net.cn

自定义授权码授予的Tokens请求参数

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Configuration
public class SecurityConfig {

	@Bean
	public ReactiveOAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> authorizationCodeAccessTokenResponseClient() {
		WebClientReactiveAuthorizationCodeTokenResponseClient accessTokenResponseClient =
			new WebClientReactiveAuthorizationCodeTokenResponseClient();
		accessTokenResponseClient.addParametersConverter(parametersConverter());

		return accessTokenResponseClient;
	}

	private static Converter<OAuth2AuthorizationCodeGrantRequest, MultiValueMap<String, String>> parametersConverter() {
		return (grantRequest) -> {
			MultiValueMap<String, String> parameters = new LinkedMultiValueMap<>();
			parameters.set("audience", "xyz_value");

			return parameters;
		};
	}

}

@Configuration
class SecurityConfig {

	@Bean
	fun authorizationCodeAccessTokenResponseClient(): ReactiveOAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> {
		val accessTokenResponseClient = WebClientReactiveAuthorizationCodeTokenResponseClient()
		accessTokenResponseClient.addParametersConverter(parametersConverter())

		return accessTokenResponseClient
	}

	private fun parametersConverter(): Converter<OAuth2AuthorizationCodeGrantRequest, MultiValueMap<String, String>> {
		return Converter<OAuth2AuthorizationCodeGrantRequest, MultiValueMap<String, String>> { grantRequest ->
			LinkedMultiValueMap<String, String>().also { parameters ->
				parameters["audience"] = "xyz_value"
			}
		}
	}

}

请注意，我们不需要自定义SecurityWebFilterChainbean 的，并且可以坚持使用默认值。如果使用 Spring Boot 而不进行额外的自定义，我们实际上可以省略SecurityWebFilterChain豆子。spring-doc.cadn.net.cn

如您所见，提供ReactiveOAuth2AccessTokenResponseClient作为豆子很方便。直接使用 Spring Security DSL 时，我们需要确保此自定义同时应用于 OAuth2 登录（如果我们使用此功能）和 OAuth2 客户端组件。要了解幕后配置的内容，以下是 DSL 的配置：spring-doc.cadn.net.cn

使用 DSL 自定义授权代码授予的Tokens请求参数

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Configuration
@EnableWebFluxSecurity
public class SecurityConfig {

	@Bean
	public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
		WebClientReactiveAuthorizationCodeTokenResponseClient accessTokenResponseClient =
			new WebClientReactiveAuthorizationCodeTokenResponseClient();
		accessTokenResponseClient.addParametersConverter(parametersConverter());

		http
			.authorizeExchange((authorize) -> authorize
				.anyExchange().authenticated()
			)
			.oauth2Login((oauth2Login) -> oauth2Login
				.authenticationManager(new DelegatingReactiveAuthenticationManager(
					new OidcAuthorizationCodeReactiveAuthenticationManager(
						accessTokenResponseClient, new OidcReactiveOAuth2UserService()
					),
					new OAuth2LoginReactiveAuthenticationManager(
						accessTokenResponseClient, new DefaultReactiveOAuth2UserService()
					)
				))
			)
			.oauth2Client((oauth2Client) -> oauth2Client
				.authenticationManager(new OAuth2AuthorizationCodeReactiveAuthenticationManager(
					accessTokenResponseClient
				))
			);

		return http.build();
	}

	private static Converter<OAuth2AuthorizationCodeGrantRequest, MultiValueMap<String, String>> parametersConverter() {
		// ...
	}

}

import org.springframework.security.config.web.server.invoke

@Configuration
@EnableWebFluxSecurity
class SecurityConfig {

	@Bean
	fun securityWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
		val accessTokenResponseClient = WebClientReactiveAuthorizationCodeTokenResponseClient()
		accessTokenResponseClient.addParametersConverter(parametersConverter())

		return http {
			authorizeExchange {
				authorize(anyExchange, authenticated)
			}
			oauth2Login {
				authenticationManager = DelegatingReactiveAuthenticationManager(
					OidcAuthorizationCodeReactiveAuthenticationManager(
						accessTokenResponseClient, OidcReactiveOAuth2UserService()
					),
					OAuth2LoginReactiveAuthenticationManager(
						accessTokenResponseClient, DefaultReactiveOAuth2UserService()
					)
				)
			}
			oauth2Client {
				authenticationManager = OAuth2AuthorizationCodeReactiveAuthenticationManager(
					accessTokenResponseClient
				)
			}
		}
	}

	private fun parametersConverter(): Converter<OAuth2AuthorizationCodeGrantRequest, MultiValueMap<String, String>> {
		// ...
	}

}

对于其他赠款类型，我们可以发布额外的ReactiveOAuth2AccessTokenResponseClientbean 来覆盖默认值。例如，要自定义client_credentials授予我们可以发布以下 bean：spring-doc.cadn.net.cn

自定义客户端凭证授予的Tokens请求参数

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Configuration
public class SecurityConfig {

	@Bean
	public ReactiveOAuth2AccessTokenResponseClient<OAuth2ClientCredentialsGrantRequest> clientCredentialsAccessTokenResponseClient() {
		WebClientReactiveClientCredentialsTokenResponseClient accessTokenResponseClient =
				new WebClientReactiveClientCredentialsTokenResponseClient();
		accessTokenResponseClient.addParametersConverter(parametersConverter());

		return accessTokenResponseClient;
	}

	private static Converter<OAuth2ClientCredentialsGrantRequest, MultiValueMap<String, String>> parametersConverter() {
		// ...
	}

}

@Configuration
class SecurityConfig {

	@Bean
	fun clientCredentialsAccessTokenResponseClient(): ReactiveOAuth2AccessTokenResponseClient<OAuth2ClientCredentialsGrantRequest> {
		val accessTokenResponseClient = WebClientReactiveClientCredentialsTokenResponseClient()
		accessTokenResponseClient.addParametersConverter(parametersConverter())

		return accessTokenResponseClient
	}

	private fun parametersConverter(): Converter<OAuth2ClientCredentialsGrantRequest, MultiValueMap<String, String>> {
		// ...
	}

}

Spring Security 会自动解析以下泛型类型的ReactiveOAuth2AccessTokenResponseClient豆：spring-doc.cadn.net.cn

OAuth2AuthorizationCodeGrantRequest（参见WebClientReactiveAuthorizationCodeTokenResponseClient)spring-doc.cadn.net.cn
OAuth2RefreshTokenGrantRequest（参见WebClientReactiveRefreshTokenTokenResponseClient)spring-doc.cadn.net.cn
OAuth2ClientCredentialsGrantRequest（参见WebClientReactiveClientCredentialsTokenResponseClient)spring-doc.cadn.net.cn
JwtBearerGrantRequest（参见WebClientReactiveJwtBearerTokenResponseClient)spring-doc.cadn.net.cn
TokenExchangeGrantRequest（参见WebClientReactiveTokenExchangeTokenResponseClient)spring-doc.cadn.net.cn

发布类型为ReactiveOAuth2AccessTokenResponseClient<JwtBearerGrantRequest>将自动启用jwt-bearer授权类型，无需单独配置。spring-doc.cadn.net.cn

发布类型为ReactiveOAuth2AccessTokenResponseClient<TokenExchangeGrantRequest>将自动启用token-exchange授权类型，无需单独配置。spring-doc.cadn.net.cn

自定义`WebClient`由 OAuth2 客户端组件使用

另一个常见用例是需要自定义WebClient获取访问Tokens时使用。我们可能需要这样做来自定义底层 HTTP 客户端库（通过自定义ClientHttpConnector）配置 SSL 设置或为公司网络应用代理设置。spring-doc.cadn.net.cn

在 Spring Security 6.3 及更高版本中，我们可以简单地发布类型为ReactiveOAuth2AccessTokenResponseClientSpring Security 将配置并发布一个ReactiveOAuth2AuthorizedClientManager豆子。spring-doc.cadn.net.cn

以下示例自定义WebClient对于所有受支持的授权类型：spring-doc.cadn.net.cn

自定义WebClient对于 OAuth2 客户端

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Configuration
public class SecurityConfig {

	@Bean
	public ReactiveOAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> authorizationCodeAccessTokenResponseClient() {
		WebClientReactiveAuthorizationCodeTokenResponseClient accessTokenResponseClient =
			new WebClientReactiveAuthorizationCodeTokenResponseClient();
		accessTokenResponseClient.setWebClient(webClient());

		return accessTokenResponseClient;
	}

	@Bean
	public ReactiveOAuth2AccessTokenResponseClient<OAuth2RefreshTokenGrantRequest> refreshTokenAccessTokenResponseClient() {
		WebClientReactiveRefreshTokenTokenResponseClient accessTokenResponseClient =
			new WebClientReactiveRefreshTokenTokenResponseClient();
		accessTokenResponseClient.setWebClient(webClient());

		return accessTokenResponseClient;
	}

	@Bean
	public ReactiveOAuth2AccessTokenResponseClient<OAuth2ClientCredentialsGrantRequest> clientCredentialsAccessTokenResponseClient() {
		WebClientReactiveClientCredentialsTokenResponseClient accessTokenResponseClient =
			new WebClientReactiveClientCredentialsTokenResponseClient();
		accessTokenResponseClient.setWebClient(webClient());

		return accessTokenResponseClient;
	}

	@Bean
	public ReactiveOAuth2AccessTokenResponseClient<JwtBearerGrantRequest> jwtBearerAccessTokenResponseClient() {
		WebClientReactiveJwtBearerTokenResponseClient accessTokenResponseClient =
			new WebClientReactiveJwtBearerTokenResponseClient();
		accessTokenResponseClient.setWebClient(webClient());

		return accessTokenResponseClient;
	}

	@Bean
	public ReactiveOAuth2AccessTokenResponseClient<TokenExchangeGrantRequest> tokenExchangeAccessTokenResponseClient() {
		WebClientReactiveTokenExchangeTokenResponseClient accessTokenResponseClient =
			new WebClientReactiveTokenExchangeTokenResponseClient();
		accessTokenResponseClient.setWebClient(webClient());

		return accessTokenResponseClient;
	}

	@Bean
	public WebClient webClient() {
		// ...
	}

}

@Configuration
class SecurityConfig {

	@Bean
	fun authorizationCodeAccessTokenResponseClient(): ReactiveOAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> {
		val accessTokenResponseClient = WebClientReactiveAuthorizationCodeTokenResponseClient()
		accessTokenResponseClient.setWebClient(webClient())

		return accessTokenResponseClient
	}

	@Bean
	fun refreshTokenAccessTokenResponseClient(): ReactiveOAuth2AccessTokenResponseClient<OAuth2RefreshTokenGrantRequest> {
		val accessTokenResponseClient = WebClientReactiveRefreshTokenTokenResponseClient()
		accessTokenResponseClient.setWebClient(webClient())

		return accessTokenResponseClient
	}

	@Bean
	fun clientCredentialsAccessTokenResponseClient(): ReactiveOAuth2AccessTokenResponseClient<OAuth2ClientCredentialsGrantRequest> {
		val accessTokenResponseClient = WebClientReactiveClientCredentialsTokenResponseClient()
		accessTokenResponseClient.setWebClient(webClient())

		return accessTokenResponseClient
	}

	@Bean
	fun jwtBearerAccessTokenResponseClient(): ReactiveOAuth2AccessTokenResponseClient<JwtBearerGrantRequest> {
		val accessTokenResponseClient = WebClientReactiveJwtBearerTokenResponseClient()
		accessTokenResponseClient.setWebClient(webClient())

		return accessTokenResponseClient
	}

	@Bean
	fun tokenExchangeAccessTokenResponseClient(): ReactiveOAuth2AccessTokenResponseClient<TokenExchangeGrantRequest> {
		val accessTokenResponseClient = WebClientReactiveTokenExchangeTokenResponseClient()
		accessTokenResponseClient.setWebClient(webClient())

		return accessTokenResponseClient
	}

	@Bean
	fun webClient(): WebClient {
		// ...
	}

}

默认ReactiveOAuth2AuthorizedClientManager如果尚未提供，则将由 Spring Security 自动发布。spring-doc.cadn.net.cn

在 Spring Security 6.3 之前，我们必须确保将此自定义应用于我们自己的 OAuth2 客户端组件。虽然我们可以发布类型ReactiveOAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest>对于authorization_codegrant，我们必须发布一个类型的 beanReactiveOAuth2AuthorizedClientManager对于其他赠款类型。要了解幕后配置的内容，配置可能如下所示：spring-doc.cadn.net.cn

自定义WebClient对于 OAuth2 客户端（6.3 之前）

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Configuration
public class SecurityConfig {

	@Bean
	public ReactiveOAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> authorizationCodeAccessTokenResponseClient() {
		WebClientReactiveAuthorizationCodeTokenResponseClient accessTokenResponseClient =
			new WebClientReactiveAuthorizationCodeTokenResponseClient();
		accessTokenResponseClient.setWebClient(webClient());

		return accessTokenResponseClient;
	}

	@Bean
	public ReactiveOAuth2AuthorizedClientManager authorizedClientManager(
			ReactiveClientRegistrationRepository clientRegistrationRepository,
			ServerOAuth2AuthorizedClientRepository authorizedClientRepository) {

		WebClientReactiveRefreshTokenTokenResponseClient refreshTokenAccessTokenResponseClient =
			new WebClientReactiveRefreshTokenTokenResponseClient();
		refreshTokenAccessTokenResponseClient.setWebClient(webClient());

		WebClientReactiveClientCredentialsTokenResponseClient clientCredentialsAccessTokenResponseClient =
			new WebClientReactiveClientCredentialsTokenResponseClient();
		clientCredentialsAccessTokenResponseClient.setWebClient(webClient());

		WebClientReactiveJwtBearerTokenResponseClient jwtBearerAccessTokenResponseClient =
			new WebClientReactiveJwtBearerTokenResponseClient();
		jwtBearerAccessTokenResponseClient.setWebClient(webClient());

		JwtBearerReactiveOAuth2AuthorizedClientProvider jwtBearerAuthorizedClientProvider =
			new JwtBearerReactiveOAuth2AuthorizedClientProvider();
		jwtBearerAuthorizedClientProvider.setAccessTokenResponseClient(jwtBearerAccessTokenResponseClient);

		WebClientReactiveTokenExchangeTokenResponseClient tokenExchangeAccessTokenResponseClient =
			new WebClientReactiveTokenExchangeTokenResponseClient();
		tokenExchangeAccessTokenResponseClient.setWebClient(webClient());

		TokenExchangeReactiveOAuth2AuthorizedClientProvider tokenExchangeAuthorizedClientProvider =
			new TokenExchangeReactiveOAuth2AuthorizedClientProvider();
		tokenExchangeAuthorizedClientProvider.setAccessTokenResponseClient(tokenExchangeAccessTokenResponseClient);

		ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
			ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
				.authorizationCode()
				.refreshToken((refreshToken) -> refreshToken
					.accessTokenResponseClient(refreshTokenAccessTokenResponseClient)
				)
				.clientCredentials((clientCredentials) -> clientCredentials
					.accessTokenResponseClient(clientCredentialsAccessTokenResponseClient)
				)
				.provider(jwtBearerAuthorizedClientProvider)
				.provider(tokenExchangeAuthorizedClientProvider)
				.build();

		DefaultReactiveOAuth2AuthorizedClientManager authorizedClientManager =
			new DefaultReactiveOAuth2AuthorizedClientManager(
				clientRegistrationRepository, authorizedClientRepository);
		authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);

		return authorizedClientManager;
	}

	@Bean
	public WebClient webClient() {
		// ...
	}

}

import org.springframework.security.config.web.server.invoke

@Configuration
class SecurityConfig {

	@Bean
	fun authorizationCodeAccessTokenResponseClient(): ReactiveOAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> {
		val accessTokenResponseClient = WebClientReactiveAuthorizationCodeTokenResponseClient()
		accessTokenResponseClient.setWebClient(webClient())

		return accessTokenResponseClient
	}

	@Bean
	fun authorizedClientManager(
		clientRegistrationRepository: ReactiveClientRegistrationRepository?,
		authorizedClientRepository: ServerOAuth2AuthorizedClientRepository?
	): ReactiveOAuth2AuthorizedClientManager {
		val refreshTokenAccessTokenResponseClient = WebClientReactiveRefreshTokenTokenResponseClient()
		refreshTokenAccessTokenResponseClient.setWebClient(webClient())

		val clientCredentialsAccessTokenResponseClient = WebClientReactiveClientCredentialsTokenResponseClient()
		clientCredentialsAccessTokenResponseClient.setWebClient(webClient())

		val jwtBearerAccessTokenResponseClient = WebClientReactiveJwtBearerTokenResponseClient()
		jwtBearerAccessTokenResponseClient.setWebClient(webClient())

		val jwtBearerAuthorizedClientProvider = JwtBearerReactiveOAuth2AuthorizedClientProvider()
		jwtBearerAuthorizedClientProvider.setAccessTokenResponseClient(jwtBearerAccessTokenResponseClient)

		val tokenExchangeAccessTokenResponseClient = WebClientReactiveTokenExchangeTokenResponseClient()
		tokenExchangeAccessTokenResponseClient.setWebClient(webClient())

		val tokenExchangeAuthorizedClientProvider = TokenExchangeReactiveOAuth2AuthorizedClientProvider()
		tokenExchangeAuthorizedClientProvider.setAccessTokenResponseClient(tokenExchangeAccessTokenResponseClient)

		val authorizedClientProvider = OAuth2AuthorizedClientProviderBuilder.builder()
			.authorizationCode()
			.refreshToken { refreshToken ->
				refreshToken.accessTokenResponseClient(refreshTokenAccessTokenResponseClient)
			}
			.clientCredentials { clientCredentials ->
				clientCredentials.accessTokenResponseClient(clientCredentialsAccessTokenResponseClient)
			}
			.provider(jwtBearerAuthorizedClientProvider)
			.provider(tokenExchangeAuthorizedClientProvider)
			.build()

		val authorizedClientManager = DefaultReactiveOAuth2AuthorizedClientManager(
			clientRegistrationRepository, authorizedClientRepository
		)
		authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)

		return authorizedClientManager
	}

	@Bean
	fun webClient(): WebClient {
		// ...
	}

}

延伸阅读

前面的部分介绍了 Spring Security 对 OAuth2 的支持，并提供了常见场景的示例。您可以在参考文档的以下部分中阅读有关 OAuth2 客户端和资源服务器的更多信息：spring-doc.cadn.net.cn

OAuth2 WebFlux

概述

OAuth2 资源服务器

使用 OAuth2 访问Tokens保护访问

JWT 支持

不透明Tokens支持

使用自定义 JWT 保护访问

OAuth2 客户端

使用 OAuth2 登录用户

访问受保护的资源

访问当前用户的受保护资源

启用延期授权类型

自定义现有授权类型

自定义Tokens请求参数

自定义WebClient由 OAuth2 客户端组件使用

延伸阅读

自定义`WebClient`由 OAuth2 客户端组件使用