此版本仍在开发中，尚不被认为是稳定的。对于最新的稳定版本，请使用 Spring Security 6.5.3！spring-doc.cadn.net.cn

授权授予支持

本节介绍 Spring Security 对授权授权的支持。spring-doc.cadn.net.cn

授权码

有关授权代码授予的更多详细信息，请参阅 OAuth 2.0 授权框架。spring-doc.cadn.net.cn

获得授权

请参阅授权请求/响应协议流，了解授权代码授予。spring-doc.cadn.net.cn

发起授权请求

这OAuth2AuthorizationRequestRedirectWebFilter使用ServerOAuth2AuthorizationRequestResolver以解决OAuth2AuthorizationRequest并通过将最终用户的用户代理重定向到授权服务器的授权端点来启动授权代码授权流。spring-doc.cadn.net.cn

的主要作用ServerOAuth2AuthorizationRequestResolver是解决OAuth2AuthorizationRequest来自提供的 Web 请求。默认实现DefaultServerOAuth2AuthorizationRequestResolver（默认）路径上的匹配项/oauth2/authorization/{registrationId}提取registrationId并使用它来构建OAuth2AuthorizationRequest对于关联的ClientRegistration.spring-doc.cadn.net.cn

给定 OAuth 2.0 客户端注册的以下 Spring Boot 属性：spring-doc.cadn.net.cn

spring:
  security:
    oauth2:
      client:
        registration:
          okta:
            client-id: okta-client-id
            client-secret: okta-client-secret
            authorization-grant-type: authorization_code
            redirect-uri: "{baseUrl}/authorized/okta"
            scope: read, write
        provider:
          okta:
            authorization-uri: https://dev-1234.oktapreview.com/oauth2/v1/authorize
            token-uri: https://dev-1234.oktapreview.com/oauth2/v1/token

具有基本路径的请求/oauth2/authorization/okta将通过OAuth2AuthorizationRequestRedirectWebFilter并最终启动授权代码授予流。spring-doc.cadn.net.cn

这AuthorizationCodeReactiveOAuth2AuthorizedClientProvider是ReactiveOAuth2AuthorizedClientProvider对于授权代码授权，它还通过OAuth2AuthorizationRequestRedirectWebFilter.spring-doc.cadn.net.cn

如果 OAuth 2.0 客户端是公共客户端，则按如下方式配置 OAuth 2.0 客户端注册：spring-doc.cadn.net.cn

spring:
  security:
    oauth2:
      client:
        registration:
          okta:
            client-id: okta-client-id
            client-authentication-method: none
            authorization-grant-type: authorization_code
            redirect-uri: "{baseUrl}/authorized/okta"
            # ...

使用代码交换证明密钥（PKCE）支持公共客户端。如果客户端在不受信任的环境（例如本机应用程序或基于 Web 浏览器的应用程序）中运行，因此无法维护其凭据的机密性，则当满足以下条件时，将自动使用 PKCE：spring-doc.cadn.net.cn

client-secret被省略（或为空）spring-doc.cadn.net.cn
client-authentication-method设置为“无”（ClientAuthenticationMethod.NONE)spring-doc.cadn.net.cn

或spring-doc.cadn.net.cn

什么时候ClientRegistration.clientSettings.requireProofKey是true（在本例中ClientRegistration.authorizationGrantType必须是authorization_code)spring-doc.cadn.net.cn

如果 OAuth 2.0 提供程序支持机密客户端的 PKCE，您可以（可选）使用DefaultServerOAuth2AuthorizationRequestResolver.setAuthorizationRequestCustomizer(OAuth2AuthorizationRequestCustomizers.withPkce()).spring-doc.cadn.net.cn

这DefaultServerOAuth2AuthorizationRequestResolver还支持URI模板变量redirect-uri用UriComponentsBuilder.spring-doc.cadn.net.cn

以下配置使用所有受支持的URI模板变量：spring-doc.cadn.net.cn

spring:
  security:
    oauth2:
      client:
        registration:
          okta:
            # ...
            redirect-uri: "{baseScheme}://{baseHost}{basePort}{basePath}/authorized/{registrationId}"
            # ...

{baseUrl}解析为{baseScheme}://{baseHost}{basePort}{basePath}spring-doc.cadn.net.cn

配置redirect-uri跟URI模板变量在 OAuth 2.0 客户端在代理服务器后面运行时特别有用。这确保了X-Forwarded-*headers 用于扩展redirect-uri.spring-doc.cadn.net.cn

自定义授权请求

主要用例之一ServerOAuth2AuthorizationRequestResolver可以实现的是，能够使用 OAuth 2.0 授权框架中定义的标准参数之上的附加参数自定义授权请求。spring-doc.cadn.net.cn

例如，OpenID Connect 为授权代码流定义了其他 OAuth 2.0 请求参数，该参数从 OAuth 2.0 授权框架中定义的标准参数扩展而来。其中一个扩展参数是prompt参数。spring-doc.cadn.net.cn

这prompt参数是可选的。以空格分隔的区分大小写的 ASCII 字符串值列表，指定授权服务器是否提示最终用户重新进行身份验证和同意。定义的值为：none,login,consent和select_account.spring-doc.cadn.net.cn

以下示例显示如何配置DefaultServerOAuth2AuthorizationRequestResolver使用Consumer<OAuth2AuthorizationRequest.Builder>自定义授权请求oauth2Login()，通过包含 request 参数prompt=consent.spring-doc.cadn.net.cn

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Configuration
@EnableWebFluxSecurity
public class OAuth2LoginSecurityConfig {

	@Autowired
	private ReactiveClientRegistrationRepository clientRegistrationRepository;

	@Bean
	public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
		http
			.authorizeExchange((authorize) -> authorize
				.anyExchange().authenticated()
			)
			.oauth2Login((oauth2) -> oauth2
				.authorizationRequestResolver(
					authorizationRequestResolver(this.clientRegistrationRepository)
				)
			);
		return http.build();
	}

	private ServerOAuth2AuthorizationRequestResolver authorizationRequestResolver(
			ReactiveClientRegistrationRepository clientRegistrationRepository) {

		DefaultServerOAuth2AuthorizationRequestResolver authorizationRequestResolver =
				new DefaultServerOAuth2AuthorizationRequestResolver(
						clientRegistrationRepository);
		authorizationRequestResolver.setAuthorizationRequestCustomizer(
				authorizationRequestCustomizer());

		return  authorizationRequestResolver;
	}

	private Consumer<OAuth2AuthorizationRequest.Builder> authorizationRequestCustomizer() {
		return customizer -> customizer
					.additionalParameters((params) -> params.put("prompt", "consent"));
	}
}

@Configuration
@EnableWebFluxSecurity
class SecurityConfig {

    @Autowired
    private lateinit var customClientRegistrationRepository: ReactiveClientRegistrationRepository

    @Bean
    fun securityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
        http {
            authorizeExchange {
                authorize(anyExchange, authenticated)
            }
            oauth2Login {
                authorizationRequestResolver = authorizationRequestResolver(customClientRegistrationRepository)
            }
        }

        return http.build()
    }

    private fun authorizationRequestResolver(
            clientRegistrationRepository: ReactiveClientRegistrationRepository): ServerOAuth2AuthorizationRequestResolver {
        val authorizationRequestResolver = DefaultServerOAuth2AuthorizationRequestResolver(
                clientRegistrationRepository)
        authorizationRequestResolver.setAuthorizationRequestCustomizer(
                authorizationRequestCustomizer())
        return authorizationRequestResolver
    }

    private fun authorizationRequestCustomizer(): Consumer<OAuth2AuthorizationRequest.Builder> {
        return Consumer { customizer ->
            customizer
                .additionalParameters { params -> params["prompt"] = "consent" }
        }
    }
}

对于简单的用例，其中特定提供程序的附加请求参数始终相同，可以将其直接添加到authorization-uri财产。spring-doc.cadn.net.cn

例如，如果请求参数的值prompt总是consent对于提供者okta，而不是简单地配置如下：spring-doc.cadn.net.cn

spring:
  security:
    oauth2:
      client:
        provider:
          okta:
            authorization-uri: https://dev-1234.oktapreview.com/oauth2/v1/authorize?prompt=consent

前面的示例显示了在标准参数之上添加自定义参数的常见用例。或者，如果你的需求更高级，你可以通过简单地覆盖OAuth2AuthorizationRequest.authorizationRequestUri财产。spring-doc.cadn.net.cn

OAuth2AuthorizationRequest.Builder.build()构造OAuth2AuthorizationRequest.authorizationRequestUri，它表示授权请求 URI，包括使用application/x-www-form-urlencoded格式。spring-doc.cadn.net.cn

以下示例显示了authorizationRequestCustomizer()，而是覆盖OAuth2AuthorizationRequest.authorizationRequestUri财产。spring-doc.cadn.net.cn

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

private Consumer<OAuth2AuthorizationRequest.Builder> authorizationRequestCustomizer() {
	return customizer -> customizer
			.authorizationRequestUri((uriBuilder) -> uriBuilder
					.queryParam("prompt", "consent").build());
}

private fun authorizationRequestCustomizer(): Consumer<OAuth2AuthorizationRequest.Builder> {
    return Consumer { customizer: OAuth2AuthorizationRequest.Builder ->
        customizer
                .authorizationRequestUri { uriBuilder: UriBuilder ->
                    uriBuilder
                            .queryParam("prompt", "consent").build()
                }
    }
}

存储授权请求

这ServerAuthorizationRequestRepository负责OAuth2AuthorizationRequest从启动授权请求到收到授权响应（回调）。spring-doc.cadn.net.cn

这OAuth2AuthorizationRequest用于关联和验证授权响应。spring-doc.cadn.net.cn

默认实现ServerAuthorizationRequestRepository是WebSessionOAuth2ServerAuthorizationRequestRepository，它存储OAuth2AuthorizationRequest在WebSession.spring-doc.cadn.net.cn

如果您有ServerAuthorizationRequestRepository，您可以按照以下示例所示进行配置：spring-doc.cadn.net.cn

ServerAuthorizationRequestRepository 配置

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Configuration
@EnableWebFluxSecurity
public class OAuth2ClientSecurityConfig {

	@Bean
	public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
		http
			.oauth2Client((oauth2) -> oauth2
				.authorizationRequestRepository(this.authorizationRequestRepository())
				// ...
			);
		return http.build();
	}
}

@Configuration
@EnableWebFluxSecurity
class OAuth2ClientSecurityConfig {

    @Bean
    fun securityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
        http {
            oauth2Client {
                authorizationRequestRepository = authorizationRequestRepository()
            }
        }

        return http.build()
    }
}

请求访问Tokens

请参阅访问Tokens请求/响应协议流以获取授权代码授予。spring-doc.cadn.net.cn

默认实现ReactiveOAuth2AccessTokenResponseClient授权码授权为WebClientReactiveAuthorizationCodeTokenResponseClient，它使用WebClient用于在授权服务器的Tokens端点上交换访问Tokens的授权代码。spring-doc.cadn.net.cn

自定义WebClientReactiveAuthorizationCodeTokenResponseClient，只需提供一个 bean，如以下示例所示，默认情况下就会选择它ReactiveOAuth2AuthorizedClientManager自然而然：spring-doc.cadn.net.cn

访问Tokens响应配置

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Bean
public ReactiveOAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> accessTokenResponseClient() {
	WebClientReactiveAuthorizationCodeTokenResponseClient accessTokenResponseClient =
		new WebClientReactiveAuthorizationCodeTokenResponseClient();
	// ...
	return accessTokenResponseClient;
}

@Bean
fun accessTokenResponseClient(): ReactiveOAuth2AccessTokenResponseClient<Authorization Code> {
	val accessTokenResponseClient = WebClientReactiveAuthorizationCodeTokenResponseClient()
	// ...
	return accessTokenResponseClient
}

WebClientReactiveAuthorizationCodeTokenResponseClient非常灵活，并提供了多个选项来自定义授权代码授予的 OAuth 2.0 访问Tokens请求和响应。从以下用例中进行选择以了解更多信息：spring-doc.cadn.net.cn

自定义访问Tokens请求

WebClientReactiveAuthorizationCodeTokenResponseClient提供用于自定义 Token Request 的 HTTP 标头和请求参数的钩子。spring-doc.cadn.net.cn

自定义请求标头

自定义 HTTP 标头有两个选项：spring-doc.cadn.net.cn

通过调用添加其他标头addHeadersConverter()spring-doc.cadn.net.cn
通过调用setHeadersConverter()spring-doc.cadn.net.cn

您可以包含其他标头，而不会影响使用addHeadersConverter(). 以下示例将User-Agent标头添加到请求中，当registrationId是spring:spring-doc.cadn.net.cn

包括其他 HTTP 标头

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClientReactiveAuthorizationCodeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveAuthorizationCodeTokenResponseClient();
accessTokenResponseClient.addHeadersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	HttpHeaders headers = new HttpHeaders();
	if (clientRegistration.getRegistrationId().equals("spring")) {
		headers.set(HttpHeaders.USER_AGENT, "my-user-agent");
	}
	return headers;
});

val accessTokenResponseClient = WebClientReactiveAuthorizationCodeTokenResponseClient()
accessTokenResponseClient.addHeadersConverter { grantRequest ->
	val clientRegistration = grantRequest.getClientRegistration()
	val headers = HttpHeaders()
	if (clientRegistration.getRegistrationId() == "spring") {
        headers[HttpHeaders.USER_AGENT] = "my-user-agent"
	}
	headers
}

您可以通过重复使用DefaultOAuth2TokenRequestHeadersConverter或使用setHeadersConverter(). 以下示例重用DefaultOAuth2TokenRequestHeadersConverter并禁用encodeClientCredentials以便 HTTP Basic 凭据不再使用application/x-www-form-urlencoded:spring-doc.cadn.net.cn

自定义 HTTP 标头

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

DefaultOAuth2TokenRequestHeadersConverter headersConverter =
	new DefaultOAuth2TokenRequestHeadersConverter();
headersConverter.setEncodeClientCredentials(false);

WebClientReactiveAuthorizationCodeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveAuthorizationCodeTokenResponseClient();
accessTokenResponseClient.setHeadersConverter(headersConverter);

val headersConverter = DefaultOAuth2TokenRequestHeadersConverter()
headersConverter.setEncodeClientCredentials(false)

val accessTokenResponseClient = WebClientReactiveAuthorizationCodeTokenResponseClient()
accessTokenResponseClient.setHeadersConverter(headersConverter)

自定义请求参数

自定义请求参数有三个选项：spring-doc.cadn.net.cn

通过调用添加其他参数addParametersConverter()spring-doc.cadn.net.cn
通过调用setParametersConverter()spring-doc.cadn.net.cn
通过调用完全自定义参数setParametersCustomizer()spring-doc.cadn.net.cn

用setParametersConverter()不会完全自定义参数，因为它需要用户自己提供所有默认参数。始终提供默认参数，但可以通过调用setParametersCustomizer().spring-doc.cadn.net.cn

您可以包含其他参数，而不会影响使用addParametersConverter(). 以下示例添加了一个audience参数添加到请求中，当registrationId是keycloak:spring-doc.cadn.net.cn

包括其他请求参数

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClientReactiveAuthorizationCodeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveAuthorizationCodeTokenResponseClient();
accessTokenResponseClient.addParametersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	MultiValueMap<String, String> parameters = new LinkedMultiValueMap<String, String>();
	if (clientRegistration.getRegistrationId().equals("keycloak")) {
		parameters.set(OAuth2ParameterNames.AUDIENCE, "my-audience");
	}
	return parameters;
});

val accessTokenResponseClient = WebClientReactiveAuthorizationCodeTokenResponseClient()
accessTokenResponseClient.addParametersConverter { grantRequest ->
	val clientRegistration = grantRequest.getClientRegistration()
	val parameters = LinkedMultiValueMap<String, String>()
	if (clientRegistration.getRegistrationId() == "keycloak") {
        parameters[OAuth2ParameterNames.AUDIENCE] = "my-audience"
	}
	parameters
}

您可以使用以下命令覆盖默认参数setParametersConverter(). 以下示例覆盖了client_id参数，当registrationId是okta:spring-doc.cadn.net.cn

覆盖请求参数

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClientReactiveAuthorizationCodeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveAuthorizationCodeTokenResponseClient();
accessTokenResponseClient.setParametersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	LinkedMultiValueMap<String, String> parameters = new LinkedMultiValueMap<>();
	if (clientRegistration.getRegistrationId().equals("okta")) {
		parameters.set(OAuth2ParameterNames.CLIENT_ID, "my-client");
	}
	return parameters;
});

val accessTokenResponseClient = WebClientReactiveAuthorizationCodeTokenResponseClient()
accessTokenResponseClient.setParametersConverter { grantRequest ->
    val clientRegistration = grantRequest.getClientRegistration()
	val parameters = LinkedMultiValueMap<String, String>()
	if (clientRegistration.getRegistrationId() == "okta") {
        parameters[OAuth2ParameterNames.CLIENT_ID] = "my-client"
	}
	parameters
}

您可以使用以下命令完全自定义参数（包括省略默认参数）setParametersCustomizer(). 以下示例省略了client_id参数，当client_assertion参数存在于请求中：spring-doc.cadn.net.cn

省略请求参数

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClientReactiveAuthorizationCodeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveAuthorizationCodeTokenResponseClient();
accessTokenResponseClient.setParametersCustomizer(parameters -> {
	if (parameters.containsKey(OAuth2ParameterNames.CLIENT_ASSERTION)) {
		parameters.remove(OAuth2ParameterNames.CLIENT_ID);
	}
});

val accessTokenResponseClient = WebClientReactiveAuthorizationCodeTokenResponseClient()
accessTokenResponseClient.setParametersCustomizer { parameters ->
	if (parameters.containsKey(OAuth2ParameterNames.CLIENT_ASSERTION)) {
		parameters.remove(OAuth2ParameterNames.CLIENT_ID)
	}
}

自定义访问Tokens响应

WebClientReactiveAuthorizationCodeTokenResponseClient提供了用于自定义 OAuth 2.0 访问Tokens响应的挂钩。spring-doc.cadn.net.cn

自定义响应参数

您可以自定义将Tokens响应参数转换为OAuth2AccessTokenResponse通过调用setBodyExtractor(). 由OAuth2BodyExtractors.oauth2AccessTokenResponse()解析响应并相应地处理错误。spring-doc.cadn.net.cn

以下示例提供了将Tokens响应参数转换为OAuth2AccessTokenResponse:spring-doc.cadn.net.cn

自定义身体提取器

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClientReactiveAuthorizationCodeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveAuthorizationCodeTokenResponseClient();

BodyExtractor<Mono<Map<String, Object>>, ReactiveHttpInputMessage> bodyExtractor =
	BodyExtractors.toMono(new ParameterizedTypeReference<>() {});
accessTokenResponseClient.setBodyExtractor((inputMessage, context) ->
	bodyExtractor.extract(inputMessage, context)
		.map((parameters) -> parameters.withToken("custom-token")
			// ...
			.build()
		)
);

val accessTokenResponseClient = WebClientReactiveAuthorizationCodeTokenResponseClient()

val bodyExtractor = BodyExtractors.toMono(object : ParameterizedTypeReference<Map<String, Any>>() {})
accessTokenResponseClient.setBodyExtractor { inputMessage, context ->
	bodyExtractor.extract(inputMessage, context).map { parameters ->
		OAuth2AccessTokenResponse.withToken("custom-token")
			// ...
			.build()
	}
}

提供自定义BodyExtractor，则您负责检测 OAuth 2.0 错误响应并将其转换为Mono.error()跟OAuth2Error基于响应的参数。spring-doc.cadn.net.cn

自定义`WebClient`

或者，如果您的需求更高级，您可以通过提供预配置的WebClient自setWebClient()如以下示例所示：spring-doc.cadn.net.cn

自定义WebClient

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClient webClient = WebClient.builder()
	// ...
	.build();

WebClientReactiveAuthorizationCodeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveAuthorizationCodeTokenResponseClient();
accessTokenResponseClient.setWebClient(webClient);

val webClient = WebClient.builder()
	// ...
	.build()

val accessTokenResponseClient = WebClientReactiveAuthorizationCodeTokenResponseClient()
accessTokenResponseClient.setWebClient(webClient)

使用 DSL 进行自定义

无论您是自定义WebClientReactiveAuthorizationCodeTokenResponseClient或提供您自己的实现ReactiveOAuth2AccessTokenResponseClient，您可以使用 DSL（作为发布 Bean 的替代方法）对其进行配置，如以下示例所示：spring-doc.cadn.net.cn

通过 DSL 的访问Tokens响应配置

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Configuration
@EnableWebFluxSecurity
public class OAuth2ClientSecurityConfig {

	@Bean
	public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
		http
			.oauth2Client((oauth2) -> oauth2
				.authenticationManager(this.authorizationCodeAuthenticationManager())
				// ...
			);
		return http.build();
	}

	private ReactiveAuthenticationManager authorizationCodeAuthenticationManager() {
		WebClientReactiveAuthorizationCodeTokenResponseClient accessTokenResponseClient =
				new WebClientReactiveAuthorizationCodeTokenResponseClient();
		// ...

		return new OAuth2AuthorizationCodeReactiveAuthenticationManager(accessTokenResponseClient);
	}
}

@Configuration
@EnableWebFluxSecurity
class OAuth2ClientSecurityConfig {

    @Bean
    fun securityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
        http {
            oauth2Client {
                authenticationManager = authorizationCodeAuthenticationManager()
            }
        }

        return http.build()
    }

    private fun authorizationCodeAuthenticationManager(): ReactiveAuthenticationManager {
        val accessTokenResponseClient = WebClientReactiveAuthorizationCodeTokenResponseClient()
        // ...

        return OAuth2AuthorizationCodeReactiveAuthenticationManager(accessTokenResponseClient)
    }
}

刷新Tokens

有关刷新Tokens的更多详细信息，请参阅 OAuth 2.0 授权框架。spring-doc.cadn.net.cn

刷新访问Tokens

请参阅访问Tokens请求/响应协议流，了解刷新Tokens授予。spring-doc.cadn.net.cn

默认实现ReactiveOAuth2AccessTokenResponseClient对于刷新Tokens授权为WebClientReactiveRefreshTokenTokenResponseClient，它使用WebClient在授权服务器的Tokens端点刷新访问Tokens时。spring-doc.cadn.net.cn

自定义WebClientReactiveRefreshTokenTokenResponseClient，只需提供一个 bean，如以下示例所示，默认情况下就会选择它ReactiveOAuth2AuthorizedClientManager自然而然：spring-doc.cadn.net.cn

访问Tokens响应配置

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Bean
public ReactiveOAuth2AccessTokenResponseClient<OAuth2RefreshTokenGrantRequest> accessTokenResponseClient() {
	WebClientReactiveRefreshTokenTokenResponseClient accessTokenResponseClient =
		new WebClientReactiveRefreshTokenTokenResponseClient();
	// ...
	return accessTokenResponseClient;
}

@Bean
fun accessTokenResponseClient(): ReactiveOAuth2AccessTokenResponseClient<Refresh Token> {
	val accessTokenResponseClient = WebClientReactiveRefreshTokenTokenResponseClient()
	// ...
	return accessTokenResponseClient
}

WebClientReactiveRefreshTokenTokenResponseClient非常灵活，并提供了多个选项来自定义刷新Tokens授予的 OAuth 2.0 访问Tokens请求和响应。从以下用例中进行选择以了解更多信息：spring-doc.cadn.net.cn

自定义访问Tokens请求

WebClientReactiveRefreshTokenTokenResponseClient提供用于自定义 Token Request 的 HTTP 标头和请求参数的钩子。spring-doc.cadn.net.cn

自定义请求标头

自定义 HTTP 标头有两个选项：spring-doc.cadn.net.cn

通过调用添加其他标头addHeadersConverter()spring-doc.cadn.net.cn
通过调用setHeadersConverter()spring-doc.cadn.net.cn

您可以包含其他标头，而不会影响使用addHeadersConverter(). 以下示例将User-Agent标头添加到请求中，当registrationId是spring:spring-doc.cadn.net.cn

包括其他 HTTP 标头

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClientReactiveRefreshTokenTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveRefreshTokenTokenResponseClient();
accessTokenResponseClient.addHeadersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	HttpHeaders headers = new HttpHeaders();
	if (clientRegistration.getRegistrationId().equals("spring")) {
		headers.set(HttpHeaders.USER_AGENT, "my-user-agent");
	}
	return headers;
});

val accessTokenResponseClient = WebClientReactiveRefreshTokenTokenResponseClient()
accessTokenResponseClient.addHeadersConverter { grantRequest ->
	val clientRegistration = grantRequest.getClientRegistration()
	val headers = HttpHeaders()
	if (clientRegistration.getRegistrationId() == "spring") {
        headers[HttpHeaders.USER_AGENT] = "my-user-agent"
	}
	headers
}

自定义 HTTP 标头

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

DefaultOAuth2TokenRequestHeadersConverter headersConverter =
	new DefaultOAuth2TokenRequestHeadersConverter();
headersConverter.setEncodeClientCredentials(false);

WebClientReactiveRefreshTokenTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveRefreshTokenTokenResponseClient();
accessTokenResponseClient.setHeadersConverter(headersConverter);

val headersConverter = DefaultOAuth2TokenRequestHeadersConverter()
headersConverter.setEncodeClientCredentials(false)

val accessTokenResponseClient = WebClientReactiveRefreshTokenTokenResponseClient()
accessTokenResponseClient.setHeadersConverter(headersConverter)

自定义请求参数

自定义请求参数有三个选项：spring-doc.cadn.net.cn

通过调用添加其他参数addParametersConverter()spring-doc.cadn.net.cn
通过调用setParametersConverter()spring-doc.cadn.net.cn
通过调用完全自定义参数setParametersCustomizer()spring-doc.cadn.net.cn

您可以包含其他参数，而不会影响使用addParametersConverter(). 以下示例添加了一个audience参数添加到请求中，当registrationId是keycloak:spring-doc.cadn.net.cn

包括其他请求参数

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClientReactiveRefreshTokenTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveRefreshTokenTokenResponseClient();
accessTokenResponseClient.addParametersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	MultiValueMap<String, String> parameters = new LinkedMultiValueMap<String, String>();
	if (clientRegistration.getRegistrationId().equals("keycloak")) {
		parameters.set(OAuth2ParameterNames.AUDIENCE, "my-audience");
	}
	return parameters;
});

val accessTokenResponseClient = WebClientReactiveRefreshTokenTokenResponseClient()
accessTokenResponseClient.addParametersConverter { grantRequest ->
	val clientRegistration = grantRequest.getClientRegistration()
	val parameters = LinkedMultiValueMap<String, String>()
	if (clientRegistration.getRegistrationId() == "keycloak") {
        parameters[OAuth2ParameterNames.AUDIENCE] = "my-audience"
	}
	parameters
}

您可以使用以下命令覆盖默认参数setParametersConverter(). 以下示例覆盖了client_id参数，当registrationId是okta:spring-doc.cadn.net.cn

覆盖请求参数

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClientReactiveRefreshTokenTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveRefreshTokenTokenResponseClient();
accessTokenResponseClient.setParametersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	LinkedMultiValueMap<String, String> parameters = new LinkedMultiValueMap<>();
	if (clientRegistration.getRegistrationId().equals("okta")) {
		parameters.set(OAuth2ParameterNames.CLIENT_ID, "my-client");
	}
	return parameters;
});

val accessTokenResponseClient = WebClientReactiveRefreshTokenTokenResponseClient()
accessTokenResponseClient.setParametersConverter { grantRequest ->
    val clientRegistration = grantRequest.getClientRegistration()
	val parameters = LinkedMultiValueMap<String, String>()
	if (clientRegistration.getRegistrationId() == "okta") {
        parameters[OAuth2ParameterNames.CLIENT_ID] = "my-client"
	}
	parameters
}

省略请求参数

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClientReactiveRefreshTokenTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveRefreshTokenTokenResponseClient();
accessTokenResponseClient.setParametersCustomizer(parameters -> {
	if (parameters.containsKey(OAuth2ParameterNames.CLIENT_ASSERTION)) {
		parameters.remove(OAuth2ParameterNames.CLIENT_ID);
	}
});

val accessTokenResponseClient = WebClientReactiveRefreshTokenTokenResponseClient()
accessTokenResponseClient.setParametersCustomizer { parameters ->
	if (parameters.containsKey(OAuth2ParameterNames.CLIENT_ASSERTION)) {
		parameters.remove(OAuth2ParameterNames.CLIENT_ID)
	}
}

自定义访问Tokens响应

WebClientReactiveRefreshTokenTokenResponseClient提供了用于自定义 OAuth 2.0 访问Tokens响应的挂钩。spring-doc.cadn.net.cn

自定义响应参数

以下示例提供了将Tokens响应参数转换为OAuth2AccessTokenResponse:spring-doc.cadn.net.cn

自定义身体提取器

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClientReactiveRefreshTokenTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveRefreshTokenTokenResponseClient();

BodyExtractor<Mono<Map<String, Object>>, ReactiveHttpInputMessage> bodyExtractor =
	BodyExtractors.toMono(new ParameterizedTypeReference<>() {});
accessTokenResponseClient.setBodyExtractor((inputMessage, context) ->
	bodyExtractor.extract(inputMessage, context)
		.map((parameters) -> parameters.withToken("custom-token")
			// ...
			.build()
		)
);

val accessTokenResponseClient = WebClientReactiveRefreshTokenTokenResponseClient()

val bodyExtractor = BodyExtractors.toMono(object : ParameterizedTypeReference<Map<String, Any>>() {})
accessTokenResponseClient.setBodyExtractor { inputMessage, context ->
	bodyExtractor.extract(inputMessage, context).map { parameters ->
		OAuth2AccessTokenResponse.withToken("custom-token")
			// ...
			.build()
	}
}

提供自定义BodyExtractor，则您负责检测 OAuth 2.0 错误响应并将其转换为Mono.error()跟OAuth2Error基于响应的参数。spring-doc.cadn.net.cn

自定义`WebClient`

或者，如果您的需求更高级，您可以通过提供预配置的WebClient自setWebClient()如以下示例所示：spring-doc.cadn.net.cn

自定义WebClient

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClient webClient = WebClient.builder()
	// ...
	.build();

WebClientReactiveRefreshTokenTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveRefreshTokenTokenResponseClient();
accessTokenResponseClient.setWebClient(webClient);

val webClient = WebClient.builder()
	// ...
	.build()

val accessTokenResponseClient = WebClientReactiveRefreshTokenTokenResponseClient()
accessTokenResponseClient.setWebClient(webClient)

使用构建器进行自定义

无论您是自定义WebClientReactiveRefreshTokenTokenResponseClient或提供您自己的实现ReactiveOAuth2AccessTokenResponseClient，您可以使用ReactiveOAuth2AuthorizedClientProviderBuilder（作为发布 Bean 的替代方法），如下所示：spring-doc.cadn.net.cn

通过构建器配置访问Tokens响应

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

// Customize
ReactiveOAuth2AccessTokenResponseClient<OAuth2RefreshTokenGrantRequest> refreshTokenTokenResponseClient = ...

ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
		ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
				.authorizationCode()
				.refreshToken((configurer) -> configurer.accessTokenResponseClient(refreshTokenTokenResponseClient))
				.build();

// ...

authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);

// Customize
val refreshTokenTokenResponseClient: ReactiveOAuth2AccessTokenResponseClient<OAuth2RefreshTokenGrantRequest> = ...

val authorizedClientProvider: ReactiveOAuth2AuthorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
        .authorizationCode()
        .refreshToken { it.accessTokenResponseClient(refreshTokenTokenResponseClient) }
        .build()

// ...

authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)

ReactiveOAuth2AuthorizedClientProviderBuilder.builder().refreshToken()配置一个RefreshTokenReactiveOAuth2AuthorizedClientProvider, 这是ReactiveOAuth2AuthorizedClientProvider刷新Tokens授权。spring-doc.cadn.net.cn

这OAuth2RefreshToken可以选择在访问Tokens响应中返回authorization_code授权类型。如果OAuth2AuthorizedClient.getRefreshToken()可用，并且OAuth2AuthorizedClient.getAccessToken()已过期，则会自动刷新RefreshTokenReactiveOAuth2AuthorizedClientProvider.spring-doc.cadn.net.cn

客户端凭据

有关客户端凭据授予的更多详细信息，请参阅 OAuth 2.0 授权框架。spring-doc.cadn.net.cn

请求访问Tokens

请参阅访问Tokens请求/响应协议流，了解客户端凭据授予。spring-doc.cadn.net.cn

默认实现ReactiveOAuth2AccessTokenResponseClient对于客户端凭据授权为WebClientReactiveClientCredentialsTokenResponseClient，它使用WebClient在授权服务器的Tokens端点请求访问Tokens时。spring-doc.cadn.net.cn

自定义WebClientReactiveClientCredentialsTokenResponseClient，只需提供一个 bean，如以下示例所示，默认情况下就会选择它ReactiveOAuth2AuthorizedClientManager自然而然：spring-doc.cadn.net.cn

访问Tokens响应配置

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Bean
public ReactiveOAuth2AccessTokenResponseClient<OAuth2ClientCredentialsGrantRequest> accessTokenResponseClient() {
	WebClientReactiveClientCredentialsTokenResponseClient accessTokenResponseClient =
		new WebClientReactiveClientCredentialsTokenResponseClient();
	// ...
	return accessTokenResponseClient;
}

@Bean
fun accessTokenResponseClient(): ReactiveOAuth2AccessTokenResponseClient<Client Credentials> {
	val accessTokenResponseClient = WebClientReactiveClientCredentialsTokenResponseClient()
	// ...
	return accessTokenResponseClient
}

WebClientReactiveClientCredentialsTokenResponseClient非常灵活，并提供了多个选项来自定义客户端凭据授予的 OAuth 2.0 访问Tokens请求和响应。从以下用例中进行选择以了解更多信息：spring-doc.cadn.net.cn

自定义访问Tokens请求

WebClientReactiveClientCredentialsTokenResponseClient提供用于自定义 Token Request 的 HTTP 标头和请求参数的钩子。spring-doc.cadn.net.cn

自定义请求标头

自定义 HTTP 标头有两个选项：spring-doc.cadn.net.cn

通过调用添加其他标头addHeadersConverter()spring-doc.cadn.net.cn
通过调用setHeadersConverter()spring-doc.cadn.net.cn

您可以包含其他标头，而不会影响使用addHeadersConverter(). 以下示例将User-Agent标头添加到请求中，当registrationId是spring:spring-doc.cadn.net.cn

包括其他 HTTP 标头

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClientReactiveClientCredentialsTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveClientCredentialsTokenResponseClient();
accessTokenResponseClient.addHeadersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	HttpHeaders headers = new HttpHeaders();
	if (clientRegistration.getRegistrationId().equals("spring")) {
		headers.set(HttpHeaders.USER_AGENT, "my-user-agent");
	}
	return headers;
});

val accessTokenResponseClient = WebClientReactiveClientCredentialsTokenResponseClient()
accessTokenResponseClient.addHeadersConverter { grantRequest ->
	val clientRegistration = grantRequest.getClientRegistration()
	val headers = HttpHeaders()
	if (clientRegistration.getRegistrationId() == "spring") {
        headers[HttpHeaders.USER_AGENT] = "my-user-agent"
	}
	headers
}

自定义 HTTP 标头

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

DefaultOAuth2TokenRequestHeadersConverter headersConverter =
	new DefaultOAuth2TokenRequestHeadersConverter();
headersConverter.setEncodeClientCredentials(false);

WebClientReactiveClientCredentialsTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveClientCredentialsTokenResponseClient();
accessTokenResponseClient.setHeadersConverter(headersConverter);

val headersConverter = DefaultOAuth2TokenRequestHeadersConverter()
headersConverter.setEncodeClientCredentials(false)

val accessTokenResponseClient = WebClientReactiveClientCredentialsTokenResponseClient()
accessTokenResponseClient.setHeadersConverter(headersConverter)

自定义请求参数

自定义请求参数有三个选项：spring-doc.cadn.net.cn

通过调用添加其他参数addParametersConverter()spring-doc.cadn.net.cn
通过调用setParametersConverter()spring-doc.cadn.net.cn
通过调用完全自定义参数setParametersCustomizer()spring-doc.cadn.net.cn

您可以包含其他参数，而不会影响使用addParametersConverter(). 以下示例添加了一个audience参数添加到请求中，当registrationId是keycloak:spring-doc.cadn.net.cn

包括其他请求参数

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClientReactiveClientCredentialsTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveClientCredentialsTokenResponseClient();
accessTokenResponseClient.addParametersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	MultiValueMap<String, String> parameters = new LinkedMultiValueMap<String, String>();
	if (clientRegistration.getRegistrationId().equals("keycloak")) {
		parameters.set(OAuth2ParameterNames.AUDIENCE, "my-audience");
	}
	return parameters;
});

val accessTokenResponseClient = WebClientReactiveClientCredentialsTokenResponseClient()
accessTokenResponseClient.addParametersConverter { grantRequest ->
	val clientRegistration = grantRequest.getClientRegistration()
	val parameters = LinkedMultiValueMap<String, String>()
	if (clientRegistration.getRegistrationId() == "keycloak") {
        parameters[OAuth2ParameterNames.AUDIENCE] = "my-audience"
	}
	parameters
}

您可以使用以下命令覆盖默认参数setParametersConverter(). 以下示例覆盖了client_id参数，当registrationId是okta:spring-doc.cadn.net.cn

覆盖请求参数

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClientReactiveClientCredentialsTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveClientCredentialsTokenResponseClient();
accessTokenResponseClient.setParametersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	LinkedMultiValueMap<String, String> parameters = new LinkedMultiValueMap<>();
	if (clientRegistration.getRegistrationId().equals("okta")) {
		parameters.set(OAuth2ParameterNames.CLIENT_ID, "my-client");
	}
	return parameters;
});

val accessTokenResponseClient = WebClientReactiveClientCredentialsTokenResponseClient()
accessTokenResponseClient.setParametersConverter { grantRequest ->
    val clientRegistration = grantRequest.getClientRegistration()
	val parameters = LinkedMultiValueMap<String, String>()
	if (clientRegistration.getRegistrationId() == "okta") {
        parameters[OAuth2ParameterNames.CLIENT_ID] = "my-client"
	}
	parameters
}

省略请求参数

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClientReactiveClientCredentialsTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveClientCredentialsTokenResponseClient();
accessTokenResponseClient.setParametersCustomizer(parameters -> {
	if (parameters.containsKey(OAuth2ParameterNames.CLIENT_ASSERTION)) {
		parameters.remove(OAuth2ParameterNames.CLIENT_ID);
	}
});

val accessTokenResponseClient = WebClientReactiveClientCredentialsTokenResponseClient()
accessTokenResponseClient.setParametersCustomizer { parameters ->
	if (parameters.containsKey(OAuth2ParameterNames.CLIENT_ASSERTION)) {
		parameters.remove(OAuth2ParameterNames.CLIENT_ID)
	}
}

自定义访问Tokens响应

WebClientReactiveClientCredentialsTokenResponseClient提供了用于自定义 OAuth 2.0 访问Tokens响应的挂钩。spring-doc.cadn.net.cn

自定义响应参数

以下示例提供了将Tokens响应参数转换为OAuth2AccessTokenResponse:spring-doc.cadn.net.cn

自定义身体提取器

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClientReactiveClientCredentialsTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveClientCredentialsTokenResponseClient();

BodyExtractor<Mono<Map<String, Object>>, ReactiveHttpInputMessage> bodyExtractor =
	BodyExtractors.toMono(new ParameterizedTypeReference<>() {});
accessTokenResponseClient.setBodyExtractor((inputMessage, context) ->
	bodyExtractor.extract(inputMessage, context)
		.map((parameters) -> parameters.withToken("custom-token")
			// ...
			.build()
		)
);

val accessTokenResponseClient = WebClientReactiveClientCredentialsTokenResponseClient()

val bodyExtractor = BodyExtractors.toMono(object : ParameterizedTypeReference<Map<String, Any>>() {})
accessTokenResponseClient.setBodyExtractor { inputMessage, context ->
	bodyExtractor.extract(inputMessage, context).map { parameters ->
		OAuth2AccessTokenResponse.withToken("custom-token")
			// ...
			.build()
	}
}

提供自定义BodyExtractor，则您负责检测 OAuth 2.0 错误响应并将其转换为Mono.error()跟OAuth2Error基于响应的参数。spring-doc.cadn.net.cn

自定义`WebClient`

或者，如果您的需求更高级，您可以通过提供预配置的WebClient自setWebClient()如以下示例所示：spring-doc.cadn.net.cn

自定义WebClient

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClient webClient = WebClient.builder()
	// ...
	.build();

WebClientReactiveClientCredentialsTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveClientCredentialsTokenResponseClient();
accessTokenResponseClient.setWebClient(webClient);

val webClient = WebClient.builder()
	// ...
	.build()

val accessTokenResponseClient = WebClientReactiveClientCredentialsTokenResponseClient()
accessTokenResponseClient.setWebClient(webClient)

使用构建器进行自定义

无论您是自定义WebClientReactiveClientCredentialsTokenResponseClient或提供您自己的实现ReactiveOAuth2AccessTokenResponseClient，您可以使用ReactiveOAuth2AuthorizedClientProviderBuilder（作为发布 Bean 的替代方法），如下所示：spring-doc.cadn.net.cn

通过构建器配置访问Tokens响应

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

// Customize
ReactiveOAuth2AccessTokenResponseClient<OAuth2ClientCredentialsGrantRequest> clientCredentialsTokenResponseClient = ...

ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
		ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
				.clientCredentials((configurer) -> configurer.accessTokenResponseClient(clientCredentialsTokenResponseClient))
				.build();

// ...

authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);

// Customize
val clientCredentialsTokenResponseClient: ReactiveOAuth2AccessTokenResponseClient<OAuth2ClientCredentialsGrantRequest> = ...

val authorizedClientProvider: ReactiveOAuth2AuthorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
        .clientCredentials { it.accessTokenResponseClient(clientCredentialsTokenResponseClient) }
        .build()

// ...

authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)

ReactiveOAuth2AuthorizedClientProviderBuilder.builder().clientCredentials()配置一个ClientCredentialsReactiveOAuth2AuthorizedClientProvider，它是ReactiveOAuth2AuthorizedClientProvider用于客户端凭据授权。spring-doc.cadn.net.cn

使用访问Tokens

给定 OAuth 2.0 客户端注册的以下 Spring Boot 属性：spring-doc.cadn.net.cn

spring:
  security:
    oauth2:
      client:
        registration:
          okta:
            client-id: okta-client-id
            client-secret: okta-client-secret
            authorization-grant-type: client_credentials
            scope: read, write
        provider:
          okta:
            token-uri: https://dev-1234.oktapreview.com/oauth2/v1/token

…和ReactiveOAuth2AuthorizedClientManager @Bean:spring-doc.cadn.net.cn

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Bean
public ReactiveOAuth2AuthorizedClientManager authorizedClientManager(
		ReactiveClientRegistrationRepository clientRegistrationRepository,
		ServerOAuth2AuthorizedClientRepository authorizedClientRepository) {

	ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
			ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
					.clientCredentials()
					.build();

	DefaultReactiveOAuth2AuthorizedClientManager authorizedClientManager =
			new DefaultReactiveOAuth2AuthorizedClientManager(
					clientRegistrationRepository, authorizedClientRepository);
	authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);

	return authorizedClientManager;
}

@Bean
fun authorizedClientManager(
        clientRegistrationRepository: ReactiveClientRegistrationRepository,
        authorizedClientRepository: ServerOAuth2AuthorizedClientRepository): ReactiveOAuth2AuthorizedClientManager {
    val authorizedClientProvider: ReactiveOAuth2AuthorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
            .clientCredentials()
            .build()
    val authorizedClientManager = DefaultReactiveOAuth2AuthorizedClientManager(
            clientRegistrationRepository, authorizedClientRepository)
    authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)
    return authorizedClientManager
}

您可以获得OAuth2AccessToken如下：spring-doc.cadn.net.cn

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Controller
public class OAuth2ClientController {

	@Autowired
	private ReactiveOAuth2AuthorizedClientManager authorizedClientManager;

	@GetMapping("/")
	public Mono<String> index(Authentication authentication, ServerWebExchange exchange) {
		OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("okta")
				.principal(authentication)
				.attribute(ServerWebExchange.class.getName(), exchange)
				.build();

		return this.authorizedClientManager.authorize(authorizeRequest)
				.map(OAuth2AuthorizedClient::getAccessToken)
				// ...
				.thenReturn("index");
	}
}

class OAuth2ClientController {

    @Autowired
    private lateinit var authorizedClientManager: ReactiveOAuth2AuthorizedClientManager

    @GetMapping("/")
    fun index(authentication: Authentication, exchange: ServerWebExchange): Mono<String> {
        val authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("okta")
                .principal(authentication)
                .attribute(ServerWebExchange::class.java.name, exchange)
                .build()

        return authorizedClientManager.authorize(authorizeRequest)
                .map { it.accessToken }
                // ...
                .thenReturn("index")
    }
}

ServerWebExchange是 OPTIONAL 属性。如果未提供，则将通过键从 Reactor 的上下文中获取ServerWebExchange.class.spring-doc.cadn.net.cn

JWT 承载者

有关 JWT 持有者授权的更多详细信息，请参阅 OAuth 2.0 客户端身份验证和授权授权的 JSON Web Tokens （JWT）配置文件。spring-doc.cadn.net.cn

请求访问Tokens

请参阅访问Tokens请求/响应协议流，了解 JWT 持有者授权。spring-doc.cadn.net.cn

默认实现ReactiveOAuth2AccessTokenResponseClient对于 JWT Bearer 赠款是WebClientReactiveJwtBearerTokenResponseClient，它使用WebClient在授权服务器的Tokens端点请求访问Tokens时。spring-doc.cadn.net.cn

自定义WebClientReactiveJwtBearerTokenResponseClient，只需提供一个 bean，如以下示例所示，默认情况下就会选择它ReactiveOAuth2AuthorizedClientManager自然而然：spring-doc.cadn.net.cn

访问Tokens响应配置

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Bean
public ReactiveOAuth2AccessTokenResponseClient<JwtBearerGrantRequest> accessTokenResponseClient() {
	WebClientReactiveJwtBearerTokenResponseClient accessTokenResponseClient =
		new WebClientReactiveJwtBearerTokenResponseClient();
	// ...
	return accessTokenResponseClient;
}

@Bean
fun accessTokenResponseClient(): ReactiveOAuth2AccessTokenResponseClient<JWT Bearer> {
	val accessTokenResponseClient = WebClientReactiveJwtBearerTokenResponseClient()
	// ...
	return accessTokenResponseClient
}

WebClientReactiveJwtBearerTokenResponseClient非常灵活，并提供了多个选项来自定义 JWT 持有者授权的 OAuth 2.0 访问Tokens请求和响应。从以下用例中进行选择以了解更多信息：spring-doc.cadn.net.cn

自定义访问Tokens请求

WebClientReactiveJwtBearerTokenResponseClient提供用于自定义 Token Request 的 HTTP 标头和请求参数的钩子。spring-doc.cadn.net.cn

自定义请求标头

自定义 HTTP 标头有两个选项：spring-doc.cadn.net.cn

通过调用添加其他标头addHeadersConverter()spring-doc.cadn.net.cn
通过调用setHeadersConverter()spring-doc.cadn.net.cn

您可以包含其他标头，而不会影响使用addHeadersConverter(). 以下示例将User-Agent标头添加到请求中，当registrationId是spring:spring-doc.cadn.net.cn

包括其他 HTTP 标头

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClientReactiveJwtBearerTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveJwtBearerTokenResponseClient();
accessTokenResponseClient.addHeadersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	HttpHeaders headers = new HttpHeaders();
	if (clientRegistration.getRegistrationId().equals("spring")) {
		headers.set(HttpHeaders.USER_AGENT, "my-user-agent");
	}
	return headers;
});

val accessTokenResponseClient = WebClientReactiveJwtBearerTokenResponseClient()
accessTokenResponseClient.addHeadersConverter { grantRequest ->
	val clientRegistration = grantRequest.getClientRegistration()
	val headers = HttpHeaders()
	if (clientRegistration.getRegistrationId() == "spring") {
        headers[HttpHeaders.USER_AGENT] = "my-user-agent"
	}
	headers
}

自定义 HTTP 标头

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

DefaultOAuth2TokenRequestHeadersConverter headersConverter =
	new DefaultOAuth2TokenRequestHeadersConverter();
headersConverter.setEncodeClientCredentials(false);

WebClientReactiveJwtBearerTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveJwtBearerTokenResponseClient();
accessTokenResponseClient.setHeadersConverter(headersConverter);

val headersConverter = DefaultOAuth2TokenRequestHeadersConverter()
headersConverter.setEncodeClientCredentials(false)

val accessTokenResponseClient = WebClientReactiveJwtBearerTokenResponseClient()
accessTokenResponseClient.setHeadersConverter(headersConverter)

自定义请求参数

自定义请求参数有三个选项：spring-doc.cadn.net.cn

通过调用添加其他参数addParametersConverter()spring-doc.cadn.net.cn
通过调用setParametersConverter()spring-doc.cadn.net.cn
通过调用完全自定义参数setParametersCustomizer()spring-doc.cadn.net.cn

您可以包含其他参数，而不会影响使用addParametersConverter(). 以下示例添加了一个audience参数添加到请求中，当registrationId是keycloak:spring-doc.cadn.net.cn

包括其他请求参数

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClientReactiveJwtBearerTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveJwtBearerTokenResponseClient();
accessTokenResponseClient.addParametersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	MultiValueMap<String, String> parameters = new LinkedMultiValueMap<String, String>();
	if (clientRegistration.getRegistrationId().equals("keycloak")) {
		parameters.set(OAuth2ParameterNames.AUDIENCE, "my-audience");
	}
	return parameters;
});

val accessTokenResponseClient = WebClientReactiveJwtBearerTokenResponseClient()
accessTokenResponseClient.addParametersConverter { grantRequest ->
	val clientRegistration = grantRequest.getClientRegistration()
	val parameters = LinkedMultiValueMap<String, String>()
	if (clientRegistration.getRegistrationId() == "keycloak") {
        parameters[OAuth2ParameterNames.AUDIENCE] = "my-audience"
	}
	parameters
}

您可以使用以下命令覆盖默认参数setParametersConverter(). 以下示例覆盖了client_id参数，当registrationId是okta:spring-doc.cadn.net.cn

覆盖请求参数

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClientReactiveJwtBearerTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveJwtBearerTokenResponseClient();
accessTokenResponseClient.setParametersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	LinkedMultiValueMap<String, String> parameters = new LinkedMultiValueMap<>();
	if (clientRegistration.getRegistrationId().equals("okta")) {
		parameters.set(OAuth2ParameterNames.CLIENT_ID, "my-client");
	}
	return parameters;
});

val accessTokenResponseClient = WebClientReactiveJwtBearerTokenResponseClient()
accessTokenResponseClient.setParametersConverter { grantRequest ->
    val clientRegistration = grantRequest.getClientRegistration()
	val parameters = LinkedMultiValueMap<String, String>()
	if (clientRegistration.getRegistrationId() == "okta") {
        parameters[OAuth2ParameterNames.CLIENT_ID] = "my-client"
	}
	parameters
}

省略请求参数

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClientReactiveJwtBearerTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveJwtBearerTokenResponseClient();
accessTokenResponseClient.setParametersCustomizer(parameters -> {
	if (parameters.containsKey(OAuth2ParameterNames.CLIENT_ASSERTION)) {
		parameters.remove(OAuth2ParameterNames.CLIENT_ID);
	}
});

val accessTokenResponseClient = WebClientReactiveJwtBearerTokenResponseClient()
accessTokenResponseClient.setParametersCustomizer { parameters ->
	if (parameters.containsKey(OAuth2ParameterNames.CLIENT_ASSERTION)) {
		parameters.remove(OAuth2ParameterNames.CLIENT_ID)
	}
}

自定义访问Tokens响应

WebClientReactiveJwtBearerTokenResponseClient提供了用于自定义 OAuth 2.0 访问Tokens响应的挂钩。spring-doc.cadn.net.cn

自定义响应参数

以下示例提供了将Tokens响应参数转换为OAuth2AccessTokenResponse:spring-doc.cadn.net.cn

自定义身体提取器

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClientReactiveJwtBearerTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveJwtBearerTokenResponseClient();

BodyExtractor<Mono<Map<String, Object>>, ReactiveHttpInputMessage> bodyExtractor =
	BodyExtractors.toMono(new ParameterizedTypeReference<>() {});
accessTokenResponseClient.setBodyExtractor((inputMessage, context) ->
	bodyExtractor.extract(inputMessage, context)
		.map((parameters) -> parameters.withToken("custom-token")
			// ...
			.build()
		)
);

val accessTokenResponseClient = WebClientReactiveJwtBearerTokenResponseClient()

val bodyExtractor = BodyExtractors.toMono(object : ParameterizedTypeReference<Map<String, Any>>() {})
accessTokenResponseClient.setBodyExtractor { inputMessage, context ->
	bodyExtractor.extract(inputMessage, context).map { parameters ->
		OAuth2AccessTokenResponse.withToken("custom-token")
			// ...
			.build()
	}
}

提供自定义BodyExtractor，则您负责检测 OAuth 2.0 错误响应并将其转换为Mono.error()跟OAuth2Error基于响应的参数。spring-doc.cadn.net.cn

自定义`WebClient`

或者，如果您的需求更高级，您可以通过提供预配置的WebClient自setWebClient()如以下示例所示：spring-doc.cadn.net.cn

自定义WebClient

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClient webClient = WebClient.builder()
	// ...
	.build();

WebClientReactiveJwtBearerTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveJwtBearerTokenResponseClient();
accessTokenResponseClient.setWebClient(webClient);

val webClient = WebClient.builder()
	// ...
	.build()

val accessTokenResponseClient = WebClientReactiveJwtBearerTokenResponseClient()
accessTokenResponseClient.setWebClient(webClient)

使用构建器进行自定义

无论您是自定义WebClientReactiveJwtBearerTokenResponseClient或提供您自己的实现ReactiveOAuth2AccessTokenResponseClient，您可以使用ReactiveOAuth2AuthorizedClientProviderBuilder（作为发布 Bean 的替代方法），如下所示：spring-doc.cadn.net.cn

通过构建器配置访问Tokens响应

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

// Customize
ReactiveOAuth2AccessTokenResponseClient<JwtBearerGrantRequest> jwtBearerTokenResponseClient = ...

JwtBearerReactiveOAuth2AuthorizedClientProvider jwtBearerAuthorizedClientProvider = new JwtBearerReactiveOAuth2AuthorizedClientProvider();
jwtBearerAuthorizedClientProvider.setAccessTokenResponseClient(jwtBearerTokenResponseClient);

ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
		ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
				.provider(jwtBearerAuthorizedClientProvider)
				.build();

// ...

authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);

// Customize
val jwtBearerTokenResponseClient: ReactiveOAuth2AccessTokenResponseClient<JwtBearerGrantRequest> = ...

val jwtBearerAuthorizedClientProvider = JwtBearerReactiveOAuth2AuthorizedClientProvider()
jwtBearerAuthorizedClientProvider.setAccessTokenResponseClient(jwtBearerTokenResponseClient)

val authorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
        .provider(jwtBearerAuthorizedClientProvider)
        .build()

// ...

authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)

使用访问Tokens

给定 OAuth 2.0 客户端注册的以下 Spring Boot 属性：spring-doc.cadn.net.cn

spring:
  security:
    oauth2:
      client:
        registration:
          okta:
            client-id: okta-client-id
            client-secret: okta-client-secret
            authorization-grant-type: urn:ietf:params:oauth:grant-type:jwt-bearer
            scope: read
        provider:
          okta:
            token-uri: https://dev-1234.oktapreview.com/oauth2/v1/token

…和OAuth2AuthorizedClientManager @Bean:spring-doc.cadn.net.cn

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Bean
public ReactiveOAuth2AuthorizedClientManager authorizedClientManager(
		ReactiveClientRegistrationRepository clientRegistrationRepository,
		ServerOAuth2AuthorizedClientRepository authorizedClientRepository) {

	JwtBearerReactiveOAuth2AuthorizedClientProvider jwtBearerAuthorizedClientProvider =
			new JwtBearerReactiveOAuth2AuthorizedClientProvider();

	ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
			ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
					.provider(jwtBearerAuthorizedClientProvider)
					.build();

	DefaultReactiveOAuth2AuthorizedClientManager authorizedClientManager =
			new DefaultReactiveOAuth2AuthorizedClientManager(
					clientRegistrationRepository, authorizedClientRepository);
	authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);

	return authorizedClientManager;
}

@Bean
fun authorizedClientManager(
        clientRegistrationRepository: ReactiveClientRegistrationRepository,
        authorizedClientRepository: ServerOAuth2AuthorizedClientRepository): ReactiveOAuth2AuthorizedClientManager {
    val jwtBearerAuthorizedClientProvider = JwtBearerReactiveOAuth2AuthorizedClientProvider()
    val authorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
            .provider(jwtBearerAuthorizedClientProvider)
            .build()
    val authorizedClientManager = DefaultReactiveOAuth2AuthorizedClientManager(
            clientRegistrationRepository, authorizedClientRepository)
    authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)
    return authorizedClientManager
}

您可以获得OAuth2AccessToken如下：spring-doc.cadn.net.cn

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@RestController
public class OAuth2ResourceServerController {

	@Autowired
	private ReactiveOAuth2AuthorizedClientManager authorizedClientManager;

	@GetMapping("/resource")
	public Mono<String> resource(JwtAuthenticationToken jwtAuthentication, ServerWebExchange exchange) {
		OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("okta")
				.principal(jwtAuthentication)
				.build();

		return this.authorizedClientManager.authorize(authorizeRequest)
				.map(OAuth2AuthorizedClient::getAccessToken)
				// ...
				.thenReturn("index");
	}
}

class OAuth2ResourceServerController {

    @Autowired
    private lateinit var authorizedClientManager: ReactiveOAuth2AuthorizedClientManager

    @GetMapping("/resource")
    fun resource(jwtAuthentication: JwtAuthenticationToken, exchange: ServerWebExchange): Mono<String> {
        val authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("okta")
                .principal(jwtAuthentication)
                .build()
        return authorizedClientManager.authorize(authorizeRequest)
                .map { it.accessToken }
                // ...
                .thenReturn("index")
    }
}

JwtBearerReactiveOAuth2AuthorizedClientProvider解析Jwt断言通过OAuth2AuthorizationContext.getPrincipal().getPrincipal()默认情况下，因此使用JwtAuthenticationToken在前面的示例中。spring-doc.cadn.net.cn

如果您需要解决Jwt断言，你可以提供JwtBearerReactiveOAuth2AuthorizedClientProvider.setJwtAssertionResolver()使用自定义Function<OAuth2AuthorizationContext, Mono<Jwt>>.spring-doc.cadn.net.cn

Tokens兑换

有关Tokens交换授权的更多详细信息，请参阅 OAuth 2.0 Tokens交换。spring-doc.cadn.net.cn

请求访问Tokens

有关Tokens交换授权，请参阅Tokens交换请求和响应协议流。spring-doc.cadn.net.cn

默认实现ReactiveOAuth2AccessTokenResponseClient对于Tokens交换授权是WebClientReactiveTokenExchangeTokenResponseClient，它使用WebClient在授权服务器的Tokens端点请求访问Tokens时。spring-doc.cadn.net.cn

自定义WebClientReactiveTokenExchangeTokenResponseClient，只需提供一个 bean，如以下示例所示，默认情况下就会选择它ReactiveOAuth2AuthorizedClientManager自然而然：spring-doc.cadn.net.cn

访问Tokens响应配置

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Bean
public ReactiveOAuth2AccessTokenResponseClient<TokenExchangeGrantRequest> accessTokenResponseClient() {
	WebClientReactiveTokenExchangeTokenResponseClient accessTokenResponseClient =
		new WebClientReactiveTokenExchangeTokenResponseClient();
	// ...
	return accessTokenResponseClient;
}

@Bean
fun accessTokenResponseClient(): ReactiveOAuth2AccessTokenResponseClient<Token Exchange> {
	val accessTokenResponseClient = WebClientReactiveTokenExchangeTokenResponseClient()
	// ...
	return accessTokenResponseClient
}

WebClientReactiveTokenExchangeTokenResponseClient非常灵活，并提供了多个选项来自定义 OAuth 2.0 访问Tokens请求和Tokens交换授权的响应。从以下用例中进行选择以了解更多信息：spring-doc.cadn.net.cn

自定义访问Tokens请求

WebClientReactiveTokenExchangeTokenResponseClient提供用于自定义 Token Request 的 HTTP 标头和请求参数的钩子。spring-doc.cadn.net.cn

自定义请求标头

自定义 HTTP 标头有两个选项：spring-doc.cadn.net.cn

通过调用添加其他标头addHeadersConverter()spring-doc.cadn.net.cn
通过调用setHeadersConverter()spring-doc.cadn.net.cn

您可以包含其他标头，而不会影响使用addHeadersConverter(). 以下示例将User-Agent标头添加到请求中，当registrationId是spring:spring-doc.cadn.net.cn

包括其他 HTTP 标头

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClientReactiveTokenExchangeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveTokenExchangeTokenResponseClient();
accessTokenResponseClient.addHeadersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	HttpHeaders headers = new HttpHeaders();
	if (clientRegistration.getRegistrationId().equals("spring")) {
		headers.set(HttpHeaders.USER_AGENT, "my-user-agent");
	}
	return headers;
});

val accessTokenResponseClient = WebClientReactiveTokenExchangeTokenResponseClient()
accessTokenResponseClient.addHeadersConverter { grantRequest ->
	val clientRegistration = grantRequest.getClientRegistration()
	val headers = HttpHeaders()
	if (clientRegistration.getRegistrationId() == "spring") {
        headers[HttpHeaders.USER_AGENT] = "my-user-agent"
	}
	headers
}

自定义 HTTP 标头

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

DefaultOAuth2TokenRequestHeadersConverter headersConverter =
	new DefaultOAuth2TokenRequestHeadersConverter();
headersConverter.setEncodeClientCredentials(false);

WebClientReactiveTokenExchangeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveTokenExchangeTokenResponseClient();
accessTokenResponseClient.setHeadersConverter(headersConverter);

val headersConverter = DefaultOAuth2TokenRequestHeadersConverter()
headersConverter.setEncodeClientCredentials(false)

val accessTokenResponseClient = WebClientReactiveTokenExchangeTokenResponseClient()
accessTokenResponseClient.setHeadersConverter(headersConverter)

自定义请求参数

自定义请求参数有三个选项：spring-doc.cadn.net.cn

通过调用添加其他参数addParametersConverter()spring-doc.cadn.net.cn
通过调用setParametersConverter()spring-doc.cadn.net.cn
通过调用完全自定义参数setParametersCustomizer()spring-doc.cadn.net.cn

您可以包含其他参数，而不会影响使用addParametersConverter(). 以下示例添加了一个audience参数添加到请求中，当registrationId是keycloak:spring-doc.cadn.net.cn

包括其他请求参数

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClientReactiveTokenExchangeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveTokenExchangeTokenResponseClient();
accessTokenResponseClient.addParametersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	MultiValueMap<String, String> parameters = new LinkedMultiValueMap<String, String>();
	if (clientRegistration.getRegistrationId().equals("keycloak")) {
		parameters.set(OAuth2ParameterNames.AUDIENCE, "my-audience");
	}
	return parameters;
});

val accessTokenResponseClient = WebClientReactiveTokenExchangeTokenResponseClient()
accessTokenResponseClient.addParametersConverter { grantRequest ->
	val clientRegistration = grantRequest.getClientRegistration()
	val parameters = LinkedMultiValueMap<String, String>()
	if (clientRegistration.getRegistrationId() == "keycloak") {
        parameters[OAuth2ParameterNames.AUDIENCE] = "my-audience"
	}
	parameters
}

您可以使用以下命令覆盖默认参数setParametersConverter(). 以下示例覆盖了client_id参数，当registrationId是okta:spring-doc.cadn.net.cn

覆盖请求参数

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClientReactiveTokenExchangeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveTokenExchangeTokenResponseClient();
accessTokenResponseClient.setParametersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	LinkedMultiValueMap<String, String> parameters = new LinkedMultiValueMap<>();
	if (clientRegistration.getRegistrationId().equals("okta")) {
		parameters.set(OAuth2ParameterNames.CLIENT_ID, "my-client");
	}
	return parameters;
});

val accessTokenResponseClient = WebClientReactiveTokenExchangeTokenResponseClient()
accessTokenResponseClient.setParametersConverter { grantRequest ->
    val clientRegistration = grantRequest.getClientRegistration()
	val parameters = LinkedMultiValueMap<String, String>()
	if (clientRegistration.getRegistrationId() == "okta") {
        parameters[OAuth2ParameterNames.CLIENT_ID] = "my-client"
	}
	parameters
}

省略请求参数

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClientReactiveTokenExchangeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveTokenExchangeTokenResponseClient();
accessTokenResponseClient.setParametersCustomizer(parameters -> {
	if (parameters.containsKey(OAuth2ParameterNames.CLIENT_ASSERTION)) {
		parameters.remove(OAuth2ParameterNames.CLIENT_ID);
	}
});

val accessTokenResponseClient = WebClientReactiveTokenExchangeTokenResponseClient()
accessTokenResponseClient.setParametersCustomizer { parameters ->
	if (parameters.containsKey(OAuth2ParameterNames.CLIENT_ASSERTION)) {
		parameters.remove(OAuth2ParameterNames.CLIENT_ID)
	}
}

自定义访问Tokens响应

WebClientReactiveTokenExchangeTokenResponseClient提供了用于自定义 OAuth 2.0 访问Tokens响应的挂钩。spring-doc.cadn.net.cn

自定义响应参数

以下示例提供了将Tokens响应参数转换为OAuth2AccessTokenResponse:spring-doc.cadn.net.cn

自定义身体提取器

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClientReactiveTokenExchangeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveTokenExchangeTokenResponseClient();

BodyExtractor<Mono<Map<String, Object>>, ReactiveHttpInputMessage> bodyExtractor =
	BodyExtractors.toMono(new ParameterizedTypeReference<>() {});
accessTokenResponseClient.setBodyExtractor((inputMessage, context) ->
	bodyExtractor.extract(inputMessage, context)
		.map((parameters) -> parameters.withToken("custom-token")
			// ...
			.build()
		)
);

val accessTokenResponseClient = WebClientReactiveTokenExchangeTokenResponseClient()

val bodyExtractor = BodyExtractors.toMono(object : ParameterizedTypeReference<Map<String, Any>>() {})
accessTokenResponseClient.setBodyExtractor { inputMessage, context ->
	bodyExtractor.extract(inputMessage, context).map { parameters ->
		OAuth2AccessTokenResponse.withToken("custom-token")
			// ...
			.build()
	}
}

提供自定义BodyExtractor，则您负责检测 OAuth 2.0 错误响应并将其转换为Mono.error()跟OAuth2Error基于响应的参数。spring-doc.cadn.net.cn

自定义`WebClient`

或者，如果您的需求更高级，您可以通过提供预配置的WebClient自setWebClient()如以下示例所示：spring-doc.cadn.net.cn

自定义WebClient

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

WebClient webClient = WebClient.builder()
	// ...
	.build();

WebClientReactiveTokenExchangeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveTokenExchangeTokenResponseClient();
accessTokenResponseClient.setWebClient(webClient);

val webClient = WebClient.builder()
	// ...
	.build()

val accessTokenResponseClient = WebClientReactiveTokenExchangeTokenResponseClient()
accessTokenResponseClient.setWebClient(webClient)

使用构建器进行自定义

无论您是自定义WebClientReactiveTokenExchangeTokenResponseClient或提供您自己的实现ReactiveOAuth2AccessTokenResponseClient，您可以使用ReactiveOAuth2AuthorizedClientProviderBuilder（作为发布 Bean 的替代方法），如下所示：spring-doc.cadn.net.cn

通过构建器配置访问Tokens响应

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

// Customize
ReactiveOAuth2AccessTokenResponseClient<TokenExchangeGrantRequest> tokenExchangeTokenResponseClient = ...

TokenExchangeReactiveOAuth2AuthorizedClientProvider tokenExchangeAuthorizedClientProvider = new TokenExchangeReactiveOAuth2AuthorizedClientProvider();
tokenExchangeAuthorizedClientProvider.setAccessTokenResponseClient(tokenExchangeTokenResponseClient);

ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
		ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
				.provider(tokenExchangeAuthorizedClientProvider)
				.build();

// ...

authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);

// Customize
val tokenExchangeTokenResponseClient: ReactiveOAuth2AccessTokenResponseClient<TokenExchangeGrantRequest> = ...

val tokenExchangeAuthorizedClientProvider = TokenExchangeReactiveOAuth2AuthorizedClientProvider()
tokenExchangeAuthorizedClientProvider.setAccessTokenResponseClient(tokenExchangeTokenResponseClient)

val authorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
        .provider(tokenExchangeAuthorizedClientProvider)
        .build()

// ...

authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)

使用访问Tokens

给定 OAuth 2.0 客户端注册的以下 Spring Boot 属性：spring-doc.cadn.net.cn

spring:
  security:
    oauth2:
      client:
        registration:
          okta:
            client-id: okta-client-id
            client-secret: okta-client-secret
            authorization-grant-type: urn:ietf:params:oauth:grant-type:token-exchange
            scope: read
        provider:
          okta:
            token-uri: https://dev-1234.oktapreview.com/oauth2/v1/token

…和OAuth2AuthorizedClientManager @Bean:spring-doc.cadn.net.cn

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Bean
public ReactiveOAuth2AuthorizedClientManager authorizedClientManager(
		ReactiveClientRegistrationRepository clientRegistrationRepository,
		ServerOAuth2AuthorizedClientRepository authorizedClientRepository) {

	TokenExchangeReactiveOAuth2AuthorizedClientProvider tokenExchangeAuthorizedClientProvider =
			new TokenExchangeReactiveOAuth2AuthorizedClientProvider();

	ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
			ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
					.provider(tokenExchangeAuthorizedClientProvider)
					.build();

	DefaultReactiveOAuth2AuthorizedClientManager authorizedClientManager =
			new DefaultReactiveOAuth2AuthorizedClientManager(
					clientRegistrationRepository, authorizedClientRepository);
	authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);

	return authorizedClientManager;
}

@Bean
fun authorizedClientManager(
        clientRegistrationRepository: ReactiveClientRegistrationRepository,
        authorizedClientRepository: ServerOAuth2AuthorizedClientRepository): ReactiveOAuth2AuthorizedClientManager {
    val tokenExchangeAuthorizedClientProvider = TokenExchangeReactiveOAuth2AuthorizedClientProvider()
    val authorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
            .provider(tokenExchangeAuthorizedClientProvider)
            .build()
    val authorizedClientManager = DefaultReactiveOAuth2AuthorizedClientManager(
            clientRegistrationRepository, authorizedClientRepository)
    authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)
    return authorizedClientManager
}

您可以获得OAuth2AccessToken如下：spring-doc.cadn.net.cn

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@RestController
public class OAuth2ResourceServerController {

	@Autowired
	private ReactiveOAuth2AuthorizedClientManager authorizedClientManager;

	@GetMapping("/resource")
	public Mono<String> resource(JwtAuthenticationToken jwtAuthentication) {
		OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("okta")
				.principal(jwtAuthentication)
				.build();

		return this.authorizedClientManager.authorize(authorizeRequest)
				.map(OAuth2AuthorizedClient::getAccessToken)
				// ...
				.thenReturn("index");
	}
}

class OAuth2ResourceServerController {

    @Autowired
    private lateinit var authorizedClientManager: ReactiveOAuth2AuthorizedClientManager

    @GetMapping("/resource")
    fun resource(jwtAuthentication: JwtAuthenticationToken): Mono<String> {
        val authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("okta")
                .principal(jwtAuthentication)
                .build()
        return authorizedClientManager.authorize(authorizeRequest)
                .map { it.accessToken }
                // ...
                .thenReturn("index")
    }
}

TokenExchangeReactiveOAuth2AuthorizedClientProvider解析主题标记（作为OAuth2Token）通过OAuth2AuthorizationContext.getPrincipal().getPrincipal()默认情况下，因此使用JwtAuthenticationToken在前面的示例中。默认情况下，不会解析执行组件Tokens。spring-doc.cadn.net.cn

如果需要从其他源解析主题Tokens，可以提供TokenExchangeReactiveOAuth2AuthorizedClientProvider.setSubjectTokenResolver()使用自定义Function<OAuth2AuthorizationContext, Mono<OAuth2Token>>.spring-doc.cadn.net.cn

如果需要解析 actor Tokens，可以提供TokenExchangeReactiveOAuth2AuthorizedClientProvider.setActorTokenResolver()使用自定义Function<OAuth2AuthorizationContext, Mono<OAuth2Token>>.spring-doc.cadn.net.cn

授权授予支持

授权码

获得授权

发起授权请求

自定义授权请求

存储授权请求

请求访问Tokens

自定义访问Tokens请求

自定义请求标头

自定义请求参数

自定义访问Tokens响应

自定义响应参数

自定义WebClient

使用 DSL 进行自定义

刷新Tokens

刷新访问Tokens

自定义访问Tokens请求

自定义请求标头

自定义请求参数

自定义访问Tokens响应

自定义响应参数

自定义WebClient

使用构建器进行自定义

客户端凭据

请求访问Tokens

自定义访问Tokens请求

自定义请求标头

自定义请求参数

自定义访问Tokens响应

自定义响应参数

自定义WebClient

使用构建器进行自定义

使用访问Tokens

JWT 承载者

请求访问Tokens

自定义访问Tokens请求

自定义请求标头

自定义请求参数

自定义访问Tokens响应

自定义响应参数

自定义WebClient

使用构建器进行自定义

使用访问Tokens

Tokens兑换

请求访问Tokens

自定义访问Tokens请求

自定义请求标头

自定义请求参数

自定义访问Tokens响应

自定义响应参数

自定义WebClient

使用构建器进行自定义

使用访问Tokens

自定义`WebClient`

自定义`WebClient`

自定义`WebClient`

自定义`WebClient`

自定义`WebClient`