授权许可类型支持

本节介绍 Spring Security 对授权许可类型的支持。

授权码

有关 授权码 许可类型的更多详细信息，请参阅 OAuth 2.0 授权框架。

获取授权

有关授权码许可类型的授权请求/响应协议流程，请参阅 OAuth 2.0 授权框架。

发起授权请求

OAuth2AuthorizationRequestRedirectWebFilter 使用 ServerOAuth2AuthorizationRequestResolver 解析 OAuth2AuthorizationRequest，并通过将终端用户的用户代理重定向到授权服务器的授权端点来发起授权码许可流程。

ServerOAuth2AuthorizationRequestResolver 的主要作用是从提供的 Web 请求中解析 OAuth2AuthorizationRequest。默认实现 DefaultServerOAuth2AuthorizationRequestResolver 匹配（默认）路径 /oauth2/authorization/{registrationId}，提取 registrationId 并用它来构建关联 ClientRegistration 的 OAuth2AuthorizationRequest。

假设有以下用于 OAuth 2.0 客户端注册的 Spring Boot 属性

spring:
  security:
    oauth2:
      client:
        registration:
          okta:
            client-id: okta-client-id
            client-secret: okta-client-secret
            authorization-grant-type: authorization_code
            redirect-uri: "{baseUrl}/authorized/okta"
            scope: read, write
        provider:
          okta:
            authorization-uri: https://dev-1234.oktapreview.com/oauth2/v1/authorize
            token-uri: https://dev-1234.oktapreview.com/oauth2/v1/token

基本路径为 /oauth2/authorization/okta 的请求将由 OAuth2AuthorizationRequestRedirectWebFilter 发起授权请求重定向，并最终启动授权码许可流程。

AuthorizationCodeReactiveOAuth2AuthorizedClientProvider 是针对授权码许可类型的 ReactiveOAuth2AuthorizedClientProvider 实现，它也通过 OAuth2AuthorizationRequestRedirectWebFilter 发起授权请求重定向。

如果 OAuth 2.0 客户端是公共客户端，则按如下方式配置 OAuth 2.0 客户端注册：

spring:
  security:
    oauth2:
      client:
        registration:
          okta:
            client-id: okta-client-id
            client-authentication-method: none
            authorization-grant-type: authorization_code
            redirect-uri: "{baseUrl}/authorized/okta"
            # ...

公共客户端通过 代码交换证明密钥 (PKCE) 得到支持。如果客户端运行在不受信任的环境中（例如，原生应用程序或基于 Web 浏览器的应用程序），因此无法维护其凭据的机密性，则在满足以下条件时将自动使用 PKCE：

  1. client-secret 被省略（或为空）

  2. client-authentication-method 设置为 "none" (ClientAuthenticationMethod.NONE)

如果 OAuth 2.0 提供者支持针对机密客户端的 PKCE，您可以（可选地）使用 DefaultServerOAuth2AuthorizationRequestResolver.setAuthorizationRequestCustomizer(OAuth2AuthorizationRequestCustomizers.withPkce()) 进行配置。

DefaultServerOAuth2AuthorizationRequestResolver 还支持使用 UriComponentsBuilder 为 redirect-uri 使用 URI 模板变量。

以下配置使用了所有支持的 URI 模板变量

spring:
  security:
    oauth2:
      client:
        registration:
          okta:
            # ...
            redirect-uri: "{baseScheme}://{baseHost}{basePort}{basePath}/authorized/{registrationId}"
            # ...

{baseUrl} 解析为 {baseScheme}://{baseHost}{basePort}{basePath}

使用 URI 模板变量配置 redirect-uri 在 OAuth 2.0 客户端运行在代理服务器后面时特别有用。这确保在扩展 redirect-uri 时使用 X-Forwarded-* 头。

定制授权请求

ServerOAuth2AuthorizationRequestResolver 可以实现的主要用例之一是能够通过 OAuth 2.0 授权框架中定义的标准参数之外的额外参数来定制授权请求。

例如，OpenID Connect 为授权码流程定义了额外的 OAuth 2.0 请求参数，这些参数扩展了OAuth 2.0 授权框架中定义的标准参数。其中一个扩展参数是 prompt 参数。

prompt 参数是可选的。它是 ASCII 字符串值的空格分隔的、区分大小写的列表，指定授权服务器是否提示终端用户进行重新认证和同意。定义的值包括：none、login、consent 和 select_account。

以下示例展示了如何使用 Consumer<OAuth2AuthorizationRequest.Builder> 配置 DefaultServerOAuth2AuthorizationRequestResolver，通过包含请求参数 prompt=consent 来定制 oauth2Login() 的授权请求。

  • Java

  • Kotlin

@Configuration
@EnableWebFluxSecurity
public class OAuth2LoginSecurityConfig {

	@Autowired
	private ReactiveClientRegistrationRepository clientRegistrationRepository;

	@Bean
	public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
		http
			.authorizeExchange(authorize -> authorize
				.anyExchange().authenticated()
			)
			.oauth2Login(oauth2 -> oauth2
				.authorizationRequestResolver(
					authorizationRequestResolver(this.clientRegistrationRepository)
				)
			);
		return http.build();
	}

	private ServerOAuth2AuthorizationRequestResolver authorizationRequestResolver(
			ReactiveClientRegistrationRepository clientRegistrationRepository) {

		DefaultServerOAuth2AuthorizationRequestResolver authorizationRequestResolver =
				new DefaultServerOAuth2AuthorizationRequestResolver(
						clientRegistrationRepository);
		authorizationRequestResolver.setAuthorizationRequestCustomizer(
				authorizationRequestCustomizer());

		return  authorizationRequestResolver;
	}

	private Consumer<OAuth2AuthorizationRequest.Builder> authorizationRequestCustomizer() {
		return customizer -> customizer
					.additionalParameters(params -> params.put("prompt", "consent"));
	}
}
@Configuration
@EnableWebFluxSecurity
class SecurityConfig {

    @Autowired
    private lateinit var customClientRegistrationRepository: ReactiveClientRegistrationRepository

    @Bean
    fun securityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
        http {
            authorizeExchange {
                authorize(anyExchange, authenticated)
            }
            oauth2Login {
                authorizationRequestResolver = authorizationRequestResolver(customClientRegistrationRepository)
            }
        }

        return http.build()
    }

    private fun authorizationRequestResolver(
            clientRegistrationRepository: ReactiveClientRegistrationRepository): ServerOAuth2AuthorizationRequestResolver {
        val authorizationRequestResolver = DefaultServerOAuth2AuthorizationRequestResolver(
                clientRegistrationRepository)
        authorizationRequestResolver.setAuthorizationRequestCustomizer(
                authorizationRequestCustomizer())
        return authorizationRequestResolver
    }

    private fun authorizationRequestCustomizer(): Consumer<OAuth2AuthorizationRequest.Builder> {
        return Consumer { customizer ->
            customizer
                .additionalParameters { params -> params["prompt"] = "consent" }
        }
    }
}

对于简单用例，如果额外请求参数对于特定提供者始终相同，可以直接在 authorization-uri 属性中添加它。

例如，如果提供者 okta 的请求参数 prompt 的值始终是 consent，则只需按如下方式配置：

spring:
  security:
    oauth2:
      client:
        provider:
          okta:
            authorization-uri: https://dev-1234.oktapreview.com/oauth2/v1/authorize?prompt=consent

前面的示例展示了在标准参数之上添加自定义参数的常见用例。或者，如果您的要求更高级，您可以通过简单地覆盖 OAuth2AuthorizationRequest.authorizationRequestUri 属性来完全控制构建授权请求 URI。

OAuth2AuthorizationRequest.Builder.build() 构造 OAuth2AuthorizationRequest.authorizationRequestUri，它表示包含所有查询参数并使用 application/x-www-form-urlencoded 格式的授权请求 URI。

以下示例展示了前例中 authorizationRequestCustomizer() 的一种变体，它转而覆盖了 OAuth2AuthorizationRequest.authorizationRequestUri 属性。

  • Java

  • Kotlin

private Consumer<OAuth2AuthorizationRequest.Builder> authorizationRequestCustomizer() {
	return customizer -> customizer
			.authorizationRequestUri(uriBuilder -> uriBuilder
					.queryParam("prompt", "consent").build());
}
private fun authorizationRequestCustomizer(): Consumer<OAuth2AuthorizationRequest.Builder> {
    return Consumer { customizer: OAuth2AuthorizationRequest.Builder ->
        customizer
                .authorizationRequestUri { uriBuilder: UriBuilder ->
                    uriBuilder
                            .queryParam("prompt", "consent").build()
                }
    }
}

存储授权请求

ServerAuthorizationRequestRepository 负责从发起授权请求到接收授权响应（回调）这段时间内 OAuth2AuthorizationRequest 的持久化。

OAuth2AuthorizationRequest 用于关联和验证授权响应。

ServerAuthorizationRequestRepository 的默认实现是 WebSessionOAuth2ServerAuthorizationRequestRepository，它将 OAuth2AuthorizationRequest 存储在 WebSession 中。

如果您有自定义的 ServerAuthorizationRequestRepository 实现，可以按以下示例进行配置：

ServerAuthorizationRequestRepository 配置

  • Java

  • Kotlin

@Configuration
@EnableWebFluxSecurity
public class OAuth2ClientSecurityConfig {

	@Bean
	public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
		http
			.oauth2Client(oauth2 -> oauth2
				.authorizationRequestRepository(this.authorizationRequestRepository())
				// ...
			);
		return http.build();
	}
}
@Configuration
@EnableWebFluxSecurity
class OAuth2ClientSecurityConfig {

    @Bean
    fun securityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
        http {
            oauth2Client {
                authorizationRequestRepository = authorizationRequestRepository()
            }
        }

        return http.build()
    }
}

请求访问令牌

有关授权码许可类型的访问令牌请求/响应协议流程，请参阅 OAuth 2.0 授权框架。

针对授权码许可类型的 ReactiveOAuth2AccessTokenResponseClient 默认实现是 WebClientReactiveAuthorizationCodeTokenResponseClient，它使用 WebClient 在授权服务器的令牌端点交换授权码以获取访问令牌。

要定制 WebClientReactiveAuthorizationCodeTokenResponseClient，只需按以下示例提供一个 bean，默认的 ReactiveOAuth2AuthorizedClientManager 将自动拾取它。

访问令牌响应配置

  • Java

  • Kotlin

@Bean
public ReactiveOAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> accessTokenResponseClient() {
	WebClientReactiveAuthorizationCodeTokenResponseClient accessTokenResponseClient =
		new WebClientReactiveAuthorizationCodeTokenResponseClient();
	// ...
	return accessTokenResponseClient;
}
@Bean
fun accessTokenResponseClient(): ReactiveOAuth2AccessTokenResponseClient<Authorization Code> {
	val accessTokenResponseClient = WebClientReactiveAuthorizationCodeTokenResponseClient()
	// ...
	return accessTokenResponseClient
}

WebClientReactiveAuthorizationCodeTokenResponseClient 非常灵活，并为定制授权码许可类型的 OAuth 2.0 访问令牌请求和响应提供了多种选项。选择以下用例以了解更多信息：

定制访问令牌请求

WebClientReactiveAuthorizationCodeTokenResponseClient 提供了用于定制令牌请求的 HTTP 头和请求参数的钩子。

定制请求头

定制 HTTP 头有两种选项：

  • 通过调用 addHeadersConverter() 添加额外的头

  • 通过调用 setHeadersConverter() 完全定制头

您可以使用 addHeadersConverter() 添加额外的头，而不会影响添加到每个请求的默认头。以下示例在 registrationId 为 spring 时向请求添加一个 User-Agent 头。

包含额外的 HTTP 头

  • Java

  • Kotlin

WebClientReactiveAuthorizationCodeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveAuthorizationCodeTokenResponseClient();
accessTokenResponseClient.addHeadersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	HttpHeaders headers = new HttpHeaders();
	if (clientRegistration.getRegistrationId().equals("spring")) {
		headers.set(HttpHeaders.USER_AGENT, "my-user-agent");
	}
	return headers;
});
val accessTokenResponseClient = WebClientReactiveAuthorizationCodeTokenResponseClient()
accessTokenResponseClient.addHeadersConverter { grantRequest ->
	val clientRegistration = grantRequest.getClientRegistration()
	val headers = HttpHeaders()
	if (clientRegistration.getRegistrationId() == "spring") {
        headers[HttpHeaders.USER_AGENT] = "my-user-agent"
	}
	headers
}

您可以通过复用 DefaultOAuth2TokenRequestHeadersConverter 或使用 setHeadersConverter() 提供自定义实现来完全定制头。以下示例复用 DefaultOAuth2TokenRequestHeadersConverter 并禁用 encodeClientCredentials，以便 HTTP Basic 凭据不再使用 application/x-www-form-urlencoded 进行编码。

定制 HTTP 头

  • Java

  • Kotlin

DefaultOAuth2TokenRequestHeadersConverter headersConverter =
	new DefaultOAuth2TokenRequestHeadersConverter();
headersConverter.setEncodeClientCredentials(false);

WebClientReactiveAuthorizationCodeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveAuthorizationCodeTokenResponseClient();
accessTokenResponseClient.setHeadersConverter(headersConverter);
val headersConverter = DefaultOAuth2TokenRequestHeadersConverter()
headersConverter.setEncodeClientCredentials(false)

val accessTokenResponseClient = WebClientReactiveAuthorizationCodeTokenResponseClient()
accessTokenResponseClient.setHeadersConverter(headersConverter)

定制请求参数

定制请求参数有三种选项：

  • 通过调用 addParametersConverter() 添加额外参数

  • 通过调用 setParametersConverter() 覆盖参数

  • 通过调用 setParametersCustomizer() 完全定制参数

使用 setParametersConverter() 不能完全定制参数，因为它要求用户自己提供所有默认参数。默认参数总是提供的，但可以通过调用 setParametersCustomizer() 来完全定制或省略。

您可以使用 addParametersConverter() 包含额外参数，而不会影响添加到每个请求的默认参数。以下示例在 registrationId 为 keycloak 时向请求添加一个 audience 参数。

包含额外的请求参数

  • Java

  • Kotlin

WebClientReactiveAuthorizationCodeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveAuthorizationCodeTokenResponseClient();
accessTokenResponseClient.addParametersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	MultiValueMap<String, String> parameters = new LinkedMultiValueMap<String, String>();
	if (clientRegistration.getRegistrationId().equals("keycloak")) {
		parameters.set(OAuth2ParameterNames.AUDIENCE, "my-audience");
	}
	return parameters;
});
val accessTokenResponseClient = WebClientReactiveAuthorizationCodeTokenResponseClient()
accessTokenResponseClient.addParametersConverter { grantRequest ->
	val clientRegistration = grantRequest.getClientRegistration()
	val parameters = LinkedMultiValueMap<String, String>()
	if (clientRegistration.getRegistrationId() == "keycloak") {
        parameters[OAuth2ParameterNames.AUDIENCE] = "my-audience"
	}
	parameters
}

您可以使用 setParametersConverter() 覆盖默认参数。以下示例在 registrationId 为 okta 时覆盖 client_id 参数。

覆盖请求参数

  • Java

  • Kotlin

WebClientReactiveAuthorizationCodeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveAuthorizationCodeTokenResponseClient();
accessTokenResponseClient.setParametersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	LinkedMultiValueMap<String, String> parameters = new LinkedMultiValueMap<>();
	if (clientRegistration.getRegistrationId().equals("okta")) {
		parameters.set(OAuth2ParameterNames.CLIENT_ID, "my-client");
	}
	return parameters;
});
val accessTokenResponseClient = WebClientReactiveAuthorizationCodeTokenResponseClient()
accessTokenResponseClient.setParametersConverter { grantRequest ->
    val clientRegistration = grantRequest.getClientRegistration()
	val parameters = LinkedMultiValueMap<String, String>()
	if (clientRegistration.getRegistrationId() == "okta") {
        parameters[OAuth2ParameterNames.CLIENT_ID] = "my-client"
	}
	parameters
}

您可以使用 setParametersCustomizer() 完全定制参数（包括省略默认参数）。以下示例在请求中存在 client_assertion 参数时省略 client_id 参数。

省略请求参数

  • Java

  • Kotlin

WebClientReactiveAuthorizationCodeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveAuthorizationCodeTokenResponseClient();
accessTokenResponseClient.setParametersCustomizer(parameters -> {
	if (parameters.containsKey(OAuth2ParameterNames.CLIENT_ASSERTION)) {
		parameters.remove(OAuth2ParameterNames.CLIENT_ID);
	}
});
val accessTokenResponseClient = WebClientReactiveAuthorizationCodeTokenResponseClient()
accessTokenResponseClient.setParametersCustomizer { parameters ->
	if (parameters.containsKey(OAuth2ParameterNames.CLIENT_ASSERTION)) {
		parameters.remove(OAuth2ParameterNames.CLIENT_ID)
	}
}

定制访问令牌响应

WebClientReactiveAuthorizationCodeTokenResponseClient 提供了用于定制 OAuth 2.0 访问令牌响应的钩子。

定制响应参数

您可以通过调用 setBodyExtractor() 定制令牌响应参数到 OAuth2AccessTokenResponse 的转换。OAuth2BodyExtractors.oauth2AccessTokenResponse() 提供的默认实现解析响应并相应地处理错误。

以下示例提供了定制令牌响应参数到 OAuth2AccessTokenResponse 转换的起点。

定制 Body Extractor

  • Java

  • Kotlin

WebClientReactiveAuthorizationCodeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveAuthorizationCodeTokenResponseClient();

BodyExtractor<Mono<Map<String, Object>>, ReactiveHttpInputMessage> bodyExtractor =
	BodyExtractors.toMono(new ParameterizedTypeReference<>() {});
accessTokenResponseClient.setBodyExtractor((inputMessage, context) ->
	bodyExtractor.extract(inputMessage, context)
		.map(parameters -> OAuth2AccessTokenResponse.withToken("custom-token")
			// ...
			.build()
		)
);
val accessTokenResponseClient = WebClientReactiveAuthorizationCodeTokenResponseClient()

val bodyExtractor = BodyExtractors.toMono(object : ParameterizedTypeReference<Map<String, Any>>() {})
accessTokenResponseClient.setBodyExtractor { inputMessage, context ->
	bodyExtractor.extract(inputMessage, context).map { parameters ->
		OAuth2AccessTokenResponse.withToken("custom-token")
			// ...
			.build()
	}
}

提供自定义 BodyExtractor 时，您需要负责根据响应参数检测 OAuth 2.0 错误响应并将其转换为带有 OAuth2Error 的 Mono.error()。

定制 WebClient

或者，如果您的要求更高级，您可以通过向 setWebClient() 提供一个预配置的 WebClient 来完全控制请求和/或响应，如下例所示。

定制 WebClient

  • Java

  • Kotlin

WebClient webClient = WebClient.builder()
	// ...
	.build();

WebClientReactiveAuthorizationCodeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveAuthorizationCodeTokenResponseClient();
accessTokenResponseClient.setWebClient(webClient);
val webClient = WebClient.builder()
	// ...
	.build()

val accessTokenResponseClient = WebClientReactiveAuthorizationCodeTokenResponseClient()
accessTokenResponseClient.setWebClient(webClient)

使用 DSL 定制

无论您是定制 WebClientReactiveAuthorizationCodeTokenResponseClient 还是提供自己的 ReactiveOAuth2AccessTokenResponseClient 实现，您都可以使用 DSL（作为发布 bean 的替代方法）进行配置，如下例所示。

通过 DSL 进行访问令牌响应配置

  • Java

  • Kotlin

@Configuration
@EnableWebFluxSecurity
public class OAuth2ClientSecurityConfig {

	@Bean
	public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
		http
			.oauth2Client(oauth2 -> oauth2
				.authenticationManager(this.authorizationCodeAuthenticationManager())
				// ...
			);
		return http.build();
	}

	private ReactiveAuthenticationManager authorizationCodeAuthenticationManager() {
		WebClientReactiveAuthorizationCodeTokenResponseClient accessTokenResponseClient =
				new WebClientReactiveAuthorizationCodeTokenResponseClient();
		// ...

		return new OAuth2AuthorizationCodeReactiveAuthenticationManager(accessTokenResponseClient);
	}
}
@Configuration
@EnableWebFluxSecurity
class OAuth2ClientSecurityConfig {

    @Bean
    fun securityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
        http {
            oauth2Client {
                authenticationManager = authorizationCodeAuthenticationManager()
            }
        }

        return http.build()
    }

    private fun authorizationCodeAuthenticationManager(): ReactiveAuthenticationManager {
        val accessTokenResponseClient = WebClientReactiveAuthorizationCodeTokenResponseClient()
        // ...

        return OAuth2AuthorizationCodeReactiveAuthenticationManager(accessTokenResponseClient)
    }
}

刷新令牌

有关刷新令牌的更多详细信息，请参阅 OAuth 2.0 授权框架。

刷新访问令牌

有关刷新令牌许可类型的访问令牌请求/响应协议流程，请参阅 OAuth 2.0 授权框架。

针对刷新令牌许可类型的 ReactiveOAuth2AccessTokenResponseClient 默认实现是 WebClientReactiveRefreshTokenTokenResponseClient，它在授权服务器的令牌端点刷新访问令牌时使用 WebClient。

要定制 WebClientReactiveRefreshTokenTokenResponseClient，只需按以下示例提供一个 bean，默认的 ReactiveOAuth2AuthorizedClientManager 将自动拾取它。

访问令牌响应配置

  • Java

  • Kotlin

@Bean
public ReactiveOAuth2AccessTokenResponseClient<OAuth2RefreshTokenGrantRequest> accessTokenResponseClient() {
	WebClientReactiveRefreshTokenTokenResponseClient accessTokenResponseClient =
		new WebClientReactiveRefreshTokenTokenResponseClient();
	// ...
	return accessTokenResponseClient;
}
@Bean
fun accessTokenResponseClient(): ReactiveOAuth2AccessTokenResponseClient<Refresh Token> {
	val accessTokenResponseClient = WebClientReactiveRefreshTokenTokenResponseClient()
	// ...
	return accessTokenResponseClient
}

WebClientReactiveRefreshTokenTokenResponseClient 非常灵活，并为定制刷新令牌许可类型的 OAuth 2.0 访问令牌请求和响应提供了多种选项。选择以下用例以了解更多信息：

定制访问令牌请求

WebClientReactiveRefreshTokenTokenResponseClient 提供了用于定制令牌请求的 HTTP 头和请求参数的钩子。

定制请求头

定制 HTTP 头有两种选项：

  • 通过调用 addHeadersConverter() 添加额外的头

  • 通过调用 setHeadersConverter() 完全定制头

您可以使用 addHeadersConverter() 添加额外的头，而不会影响添加到每个请求的默认头。以下示例在 registrationId 为 spring 时向请求添加一个 User-Agent 头。

包含额外的 HTTP 头

  • Java

  • Kotlin

WebClientReactiveRefreshTokenTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveRefreshTokenTokenResponseClient();
accessTokenResponseClient.addHeadersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	HttpHeaders headers = new HttpHeaders();
	if (clientRegistration.getRegistrationId().equals("spring")) {
		headers.set(HttpHeaders.USER_AGENT, "my-user-agent");
	}
	return headers;
});
val accessTokenResponseClient = WebClientReactiveRefreshTokenTokenResponseClient()
accessTokenResponseClient.addHeadersConverter { grantRequest ->
	val clientRegistration = grantRequest.getClientRegistration()
	val headers = HttpHeaders()
	if (clientRegistration.getRegistrationId() == "spring") {
        headers[HttpHeaders.USER_AGENT] = "my-user-agent"
	}
	headers
}

您可以通过复用 DefaultOAuth2TokenRequestHeadersConverter 或使用 setHeadersConverter() 提供自定义实现来完全定制头。以下示例复用 DefaultOAuth2TokenRequestHeadersConverter 并禁用 encodeClientCredentials，以便 HTTP Basic 凭据不再使用 application/x-www-form-urlencoded 进行编码。

定制 HTTP 头

  • Java

  • Kotlin

DefaultOAuth2TokenRequestHeadersConverter headersConverter =
	new DefaultOAuth2TokenRequestHeadersConverter();
headersConverter.setEncodeClientCredentials(false);

WebClientReactiveRefreshTokenTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveRefreshTokenTokenResponseClient();
accessTokenResponseClient.setHeadersConverter(headersConverter);
val headersConverter = DefaultOAuth2TokenRequestHeadersConverter()
headersConverter.setEncodeClientCredentials(false)

val accessTokenResponseClient = WebClientReactiveRefreshTokenTokenResponseClient()
accessTokenResponseClient.setHeadersConverter(headersConverter)

定制请求参数

定制请求参数有三种选项：

  • 通过调用 addParametersConverter() 添加额外参数

  • 通过调用 setParametersConverter() 覆盖参数

  • 通过调用 setParametersCustomizer() 完全定制参数

使用 setParametersConverter() 不能完全定制参数，因为它要求用户自己提供所有默认参数。默认参数总是提供的，但可以通过调用 setParametersCustomizer() 来完全定制或省略。

您可以使用 addParametersConverter() 包含额外参数，而不会影响添加到每个请求的默认参数。以下示例在 registrationId 为 keycloak 时向请求添加一个 audience 参数。

包含额外的请求参数

  • Java

  • Kotlin

WebClientReactiveRefreshTokenTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveRefreshTokenTokenResponseClient();
accessTokenResponseClient.addParametersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	MultiValueMap<String, String> parameters = new LinkedMultiValueMap<String, String>();
	if (clientRegistration.getRegistrationId().equals("keycloak")) {
		parameters.set(OAuth2ParameterNames.AUDIENCE, "my-audience");
	}
	return parameters;
});
val accessTokenResponseClient = WebClientReactiveRefreshTokenTokenResponseClient()
accessTokenResponseClient.addParametersConverter { grantRequest ->
	val clientRegistration = grantRequest.getClientRegistration()
	val parameters = LinkedMultiValueMap<String, String>()
	if (clientRegistration.getRegistrationId() == "keycloak") {
        parameters[OAuth2ParameterNames.AUDIENCE] = "my-audience"
	}
	parameters
}

您可以使用 setParametersConverter() 覆盖默认参数。以下示例在 registrationId 为 okta 时覆盖 client_id 参数。

覆盖请求参数

  • Java

  • Kotlin

WebClientReactiveRefreshTokenTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveRefreshTokenTokenResponseClient();
accessTokenResponseClient.setParametersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	LinkedMultiValueMap<String, String> parameters = new LinkedMultiValueMap<>();
	if (clientRegistration.getRegistrationId().equals("okta")) {
		parameters.set(OAuth2ParameterNames.CLIENT_ID, "my-client");
	}
	return parameters;
});
val accessTokenResponseClient = WebClientReactiveRefreshTokenTokenResponseClient()
accessTokenResponseClient.setParametersConverter { grantRequest ->
    val clientRegistration = grantRequest.getClientRegistration()
	val parameters = LinkedMultiValueMap<String, String>()
	if (clientRegistration.getRegistrationId() == "okta") {
        parameters[OAuth2ParameterNames.CLIENT_ID] = "my-client"
	}
	parameters
}

您可以使用 setParametersCustomizer() 完全定制参数（包括省略默认参数）。以下示例在请求中存在 client_assertion 参数时省略 client_id 参数。

省略请求参数

  • Java

  • Kotlin

WebClientReactiveRefreshTokenTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveRefreshTokenTokenResponseClient();
accessTokenResponseClient.setParametersCustomizer(parameters -> {
	if (parameters.containsKey(OAuth2ParameterNames.CLIENT_ASSERTION)) {
		parameters.remove(OAuth2ParameterNames.CLIENT_ID);
	}
});
val accessTokenResponseClient = WebClientReactiveRefreshTokenTokenResponseClient()
accessTokenResponseClient.setParametersCustomizer { parameters ->
	if (parameters.containsKey(OAuth2ParameterNames.CLIENT_ASSERTION)) {
		parameters.remove(OAuth2ParameterNames.CLIENT_ID)
	}
}

定制访问令牌响应

WebClientReactiveRefreshTokenTokenResponseClient 提供了用于定制 OAuth 2.0 访问令牌响应的钩子。

定制响应参数

您可以通过调用 setBodyExtractor() 定制令牌响应参数到 OAuth2AccessTokenResponse 的转换。OAuth2BodyExtractors.oauth2AccessTokenResponse() 提供的默认实现解析响应并相应地处理错误。

以下示例提供了定制令牌响应参数到 OAuth2AccessTokenResponse 转换的起点。

定制 Body Extractor

  • Java

  • Kotlin

WebClientReactiveRefreshTokenTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveRefreshTokenTokenResponseClient();

BodyExtractor<Mono<Map<String, Object>>, ReactiveHttpInputMessage> bodyExtractor =
	BodyExtractors.toMono(new ParameterizedTypeReference<>() {});
accessTokenResponseClient.setBodyExtractor((inputMessage, context) ->
	bodyExtractor.extract(inputMessage, context)
		.map(parameters -> OAuth2AccessTokenResponse.withToken("custom-token")
			// ...
			.build()
		)
);
val accessTokenResponseClient = WebClientReactiveRefreshTokenTokenResponseClient()

val bodyExtractor = BodyExtractors.toMono(object : ParameterizedTypeReference<Map<String, Any>>() {})
accessTokenResponseClient.setBodyExtractor { inputMessage, context ->
	bodyExtractor.extract(inputMessage, context).map { parameters ->
		OAuth2AccessTokenResponse.withToken("custom-token")
			// ...
			.build()
	}
}

提供自定义 BodyExtractor 时，您需要负责根据响应参数检测 OAuth 2.0 错误响应并将其转换为带有 OAuth2Error 的 Mono.error()。

定制 WebClient

或者，如果您的要求更高级，您可以通过向 setWebClient() 提供一个预配置的 WebClient 来完全控制请求和/或响应，如下例所示。

定制 WebClient

  • Java

  • Kotlin

WebClient webClient = WebClient.builder()
	// ...
	.build();

WebClientReactiveRefreshTokenTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveRefreshTokenTokenResponseClient();
accessTokenResponseClient.setWebClient(webClient);
val webClient = WebClient.builder()
	// ...
	.build()

val accessTokenResponseClient = WebClientReactiveRefreshTokenTokenResponseClient()
accessTokenResponseClient.setWebClient(webClient)

使用 Builder 定制

无论您是定制 WebClientReactiveRefreshTokenTokenResponseClient 还是提供自己的 ReactiveOAuth2AccessTokenResponseClient 实现，您都可以使用 ReactiveOAuth2AuthorizedClientProviderBuilder（作为发布 bean 的替代方法）进行配置，如下所示。

通过 Builder 进行访问令牌响应配置

  • Java

  • Kotlin

// Customize
ReactiveOAuth2AccessTokenResponseClient<OAuth2RefreshTokenGrantRequest> refreshTokenTokenResponseClient = ...

ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
		ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
				.authorizationCode()
				.refreshToken(configurer -> configurer.accessTokenResponseClient(refreshTokenTokenResponseClient))
				.build();

// ...

authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);
// Customize
val refreshTokenTokenResponseClient: ReactiveOAuth2AccessTokenResponseClient<OAuth2RefreshTokenGrantRequest> = ...

val authorizedClientProvider: ReactiveOAuth2AuthorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
        .authorizationCode()
        .refreshToken { it.accessTokenResponseClient(refreshTokenTokenResponseClient) }
        .build()

// ...

authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)

ReactiveOAuth2AuthorizedClientProviderBuilder.builder().refreshToken() 配置一个 RefreshTokenReactiveOAuth2AuthorizedClientProvider，它是针对刷新令牌许可类型的 ReactiveOAuth2AuthorizedClientProvider 实现。

对于 authorization_code 和 password 许可类型，OAuth2RefreshToken 可能会在访问令牌响应中可选地返回。如果 OAuth2AuthorizedClient.getRefreshToken() 可用且 OAuth2AuthorizedClient.getAccessToken() 已过期，它将由 RefreshTokenReactiveOAuth2AuthorizedClientProvider 自动刷新。

客户端凭据

有关客户端凭据许可类型的更多详细信息，请参阅 OAuth 2.0 授权框架。

请求访问令牌

有关客户端凭据许可类型的访问令牌请求/响应协议流程，请参阅 OAuth 2.0 授权框架。

针对客户端凭据许可类型的 ReactiveOAuth2AccessTokenResponseClient 默认实现是 WebClientReactiveClientCredentialsTokenResponseClient，它在授权服务器的令牌端点请求访问令牌时使用 WebClient。

要定制 WebClientReactiveClientCredentialsTokenResponseClient，只需按以下示例提供一个 bean，默认的 ReactiveOAuth2AuthorizedClientManager 将自动拾取它。

访问令牌响应配置

  • Java

  • Kotlin

@Bean
public ReactiveOAuth2AccessTokenResponseClient<OAuth2ClientCredentialsGrantRequest> accessTokenResponseClient() {
	WebClientReactiveClientCredentialsTokenResponseClient accessTokenResponseClient =
		new WebClientReactiveClientCredentialsTokenResponseClient();
	// ...
	return accessTokenResponseClient;
}
@Bean
fun accessTokenResponseClient(): ReactiveOAuth2AccessTokenResponseClient<Client Credentials> {
	val accessTokenResponseClient = WebClientReactiveClientCredentialsTokenResponseClient()
	// ...
	return accessTokenResponseClient
}

WebClientReactiveClientCredentialsTokenResponseClient 非常灵活，并为定制客户端凭据许可类型的 OAuth 2.0 访问令牌请求和响应提供了多种选项。选择以下用例以了解更多信息：

定制访问令牌请求

WebClientReactiveClientCredentialsTokenResponseClient 提供了用于定制令牌请求的 HTTP 头和请求参数的钩子。

定制请求头

定制 HTTP 头有两种选项：

  • 通过调用 addHeadersConverter() 添加额外的头

  • 通过调用 setHeadersConverter() 完全定制头

您可以使用 addHeadersConverter() 添加额外的头，而不会影响添加到每个请求的默认头。以下示例在 registrationId 为 spring 时向请求添加一个 User-Agent 头。

包含额外的 HTTP 头

  • Java

  • Kotlin

WebClientReactiveClientCredentialsTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveClientCredentialsTokenResponseClient();
accessTokenResponseClient.addHeadersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	HttpHeaders headers = new HttpHeaders();
	if (clientRegistration.getRegistrationId().equals("spring")) {
		headers.set(HttpHeaders.USER_AGENT, "my-user-agent");
	}
	return headers;
});
val accessTokenResponseClient = WebClientReactiveClientCredentialsTokenResponseClient()
accessTokenResponseClient.addHeadersConverter { grantRequest ->
	val clientRegistration = grantRequest.getClientRegistration()
	val headers = HttpHeaders()
	if (clientRegistration.getRegistrationId() == "spring") {
        headers[HttpHeaders.USER_AGENT] = "my-user-agent"
	}
	headers
}

您可以通过复用 DefaultOAuth2TokenRequestHeadersConverter 或使用 setHeadersConverter() 提供自定义实现来完全定制头。以下示例复用 DefaultOAuth2TokenRequestHeadersConverter 并禁用 encodeClientCredentials，以便 HTTP Basic 凭据不再使用 application/x-www-form-urlencoded 进行编码。

定制 HTTP 头

  • Java

  • Kotlin

DefaultOAuth2TokenRequestHeadersConverter headersConverter =
	new DefaultOAuth2TokenRequestHeadersConverter();
headersConverter.setEncodeClientCredentials(false);

WebClientReactiveClientCredentialsTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveClientCredentialsTokenResponseClient();
accessTokenResponseClient.setHeadersConverter(headersConverter);
val headersConverter = DefaultOAuth2TokenRequestHeadersConverter()
headersConverter.setEncodeClientCredentials(false)

val accessTokenResponseClient = WebClientReactiveClientCredentialsTokenResponseClient()
accessTokenResponseClient.setHeadersConverter(headersConverter)

定制请求参数

定制请求参数有三种选项：

  • 通过调用 addParametersConverter() 添加额外参数

  • 通过调用 setParametersConverter() 覆盖参数

  • 通过调用 setParametersCustomizer() 完全定制参数

使用 setParametersConverter() 不能完全定制参数，因为它要求用户自己提供所有默认参数。默认参数总是提供的，但可以通过调用 setParametersCustomizer() 来完全定制或省略。

您可以使用 addParametersConverter() 包含额外参数，而不会影响添加到每个请求的默认参数。以下示例在 registrationId 为 keycloak 时向请求添加一个 audience 参数。

包含额外的请求参数

  • Java

  • Kotlin

WebClientReactiveClientCredentialsTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveClientCredentialsTokenResponseClient();
accessTokenResponseClient.addParametersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	MultiValueMap<String, String> parameters = new LinkedMultiValueMap<String, String>();
	if (clientRegistration.getRegistrationId().equals("keycloak")) {
		parameters.set(OAuth2ParameterNames.AUDIENCE, "my-audience");
	}
	return parameters;
});
val accessTokenResponseClient = WebClientReactiveClientCredentialsTokenResponseClient()
accessTokenResponseClient.addParametersConverter { grantRequest ->
	val clientRegistration = grantRequest.getClientRegistration()
	val parameters = LinkedMultiValueMap<String, String>()
	if (clientRegistration.getRegistrationId() == "keycloak") {
        parameters[OAuth2ParameterNames.AUDIENCE] = "my-audience"
	}
	parameters
}

您可以使用 setParametersConverter() 覆盖默认参数。以下示例在 registrationId 为 okta 时覆盖 client_id 参数。

覆盖请求参数

  • Java

  • Kotlin

WebClientReactiveClientCredentialsTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveClientCredentialsTokenResponseClient();
accessTokenResponseClient.setParametersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	LinkedMultiValueMap<String, String> parameters = new LinkedMultiValueMap<>();
	if (clientRegistration.getRegistrationId().equals("okta")) {
		parameters.set(OAuth2ParameterNames.CLIENT_ID, "my-client");
	}
	return parameters;
});
val accessTokenResponseClient = WebClientReactiveClientCredentialsTokenResponseClient()
accessTokenResponseClient.setParametersConverter { grantRequest ->
    val clientRegistration = grantRequest.getClientRegistration()
	val parameters = LinkedMultiValueMap<String, String>()
	if (clientRegistration.getRegistrationId() == "okta") {
        parameters[OAuth2ParameterNames.CLIENT_ID] = "my-client"
	}
	parameters
}

您可以使用 setParametersCustomizer() 完全定制参数（包括省略默认参数）。以下示例在请求中存在 client_assertion 参数时省略 client_id 参数。

省略请求参数

  • Java

  • Kotlin

WebClientReactiveClientCredentialsTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveClientCredentialsTokenResponseClient();
accessTokenResponseClient.setParametersCustomizer(parameters -> {
	if (parameters.containsKey(OAuth2ParameterNames.CLIENT_ASSERTION)) {
		parameters.remove(OAuth2ParameterNames.CLIENT_ID);
	}
});
val accessTokenResponseClient = WebClientReactiveClientCredentialsTokenResponseClient()
accessTokenResponseClient.setParametersCustomizer { parameters ->
	if (parameters.containsKey(OAuth2ParameterNames.CLIENT_ASSERTION)) {
		parameters.remove(OAuth2ParameterNames.CLIENT_ID)
	}
}

定制访问令牌响应

WebClientReactiveClientCredentialsTokenResponseClient 提供了用于定制 OAuth 2.0 访问令牌响应的钩子。

定制响应参数

您可以通过调用 setBodyExtractor() 定制令牌响应参数到 OAuth2AccessTokenResponse 的转换。OAuth2BodyExtractors.oauth2AccessTokenResponse() 提供的默认实现解析响应并相应地处理错误。

以下示例提供了定制令牌响应参数到 OAuth2AccessTokenResponse 转换的起点。

定制 Body Extractor

  • Java

  • Kotlin

WebClientReactiveClientCredentialsTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveClientCredentialsTokenResponseClient();

BodyExtractor<Mono<Map<String, Object>>, ReactiveHttpInputMessage> bodyExtractor =
	BodyExtractors.toMono(new ParameterizedTypeReference<>() {});
accessTokenResponseClient.setBodyExtractor((inputMessage, context) ->
	bodyExtractor.extract(inputMessage, context)
		.map(parameters -> OAuth2AccessTokenResponse.withToken("custom-token")
			// ...
			.build()
		)
);
val accessTokenResponseClient = WebClientReactiveClientCredentialsTokenResponseClient()

val bodyExtractor = BodyExtractors.toMono(object : ParameterizedTypeReference<Map<String, Any>>() {})
accessTokenResponseClient.setBodyExtractor { inputMessage, context ->
	bodyExtractor.extract(inputMessage, context).map { parameters ->
		OAuth2AccessTokenResponse.withToken("custom-token")
			// ...
			.build()
	}
}

提供自定义 BodyExtractor 时，您需要负责根据响应参数检测 OAuth 2.0 错误响应并将其转换为带有 OAuth2Error 的 Mono.error()。

定制 WebClient

或者，如果您的要求更高级，您可以通过向 setWebClient() 提供一个预配置的 WebClient 来完全控制请求和/或响应，如下例所示。

定制 WebClient

  • Java

  • Kotlin

WebClient webClient = WebClient.builder()
	// ...
	.build();

WebClientReactiveClientCredentialsTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveClientCredentialsTokenResponseClient();
accessTokenResponseClient.setWebClient(webClient);
val webClient = WebClient.builder()
	// ...
	.build()

val accessTokenResponseClient = WebClientReactiveClientCredentialsTokenResponseClient()
accessTokenResponseClient.setWebClient(webClient)

使用 Builder 定制

无论您是定制 WebClientReactiveClientCredentialsTokenResponseClient 还是提供自己的 ReactiveOAuth2AccessTokenResponseClient 实现，您都可以使用 ReactiveOAuth2AuthorizedClientProviderBuilder（作为发布 bean 的替代方法）进行配置，如下所示。

通过 Builder 进行访问令牌响应配置

  • Java

  • Kotlin

// Customize
ReactiveOAuth2AccessTokenResponseClient<OAuth2ClientCredentialsGrantRequest> clientCredentialsTokenResponseClient = ...

ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
		ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
				.clientCredentials(configurer -> configurer.accessTokenResponseClient(clientCredentialsTokenResponseClient))
				.build();

// ...

authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);
// Customize
val clientCredentialsTokenResponseClient: ReactiveOAuth2AccessTokenResponseClient<OAuth2ClientCredentialsGrantRequest> = ...

val authorizedClientProvider: ReactiveOAuth2AuthorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
        .clientCredentials { it.accessTokenResponseClient(clientCredentialsTokenResponseClient) }
        .build()

// ...

authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)

ReactiveOAuth2AuthorizedClientProviderBuilder.builder().clientCredentials() 配置一个 ClientCredentialsReactiveOAuth2AuthorizedClientProvider，它是针对客户端凭据许可类型的 ReactiveOAuth2AuthorizedClientProvider 实现。

使用访问令牌

假设有以下用于 OAuth 2.0 客户端注册的 Spring Boot 属性

spring:
  security:
    oauth2:
      client:
        registration:
          okta:
            client-id: okta-client-id
            client-secret: okta-client-secret
            authorization-grant-type: client_credentials
            scope: read, write
        provider:
          okta:
            token-uri: https://dev-1234.oktapreview.com/oauth2/v1/token

...以及 ReactiveOAuth2AuthorizedClientManager 的 @Bean

  • Java

  • Kotlin

@Bean
public ReactiveOAuth2AuthorizedClientManager authorizedClientManager(
		ReactiveClientRegistrationRepository clientRegistrationRepository,
		ServerOAuth2AuthorizedClientRepository authorizedClientRepository) {

	ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
			ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
					.clientCredentials()
					.build();

	DefaultReactiveOAuth2AuthorizedClientManager authorizedClientManager =
			new DefaultReactiveOAuth2AuthorizedClientManager(
					clientRegistrationRepository, authorizedClientRepository);
	authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);

	return authorizedClientManager;
}
@Bean
fun authorizedClientManager(
        clientRegistrationRepository: ReactiveClientRegistrationRepository,
        authorizedClientRepository: ServerOAuth2AuthorizedClientRepository): ReactiveOAuth2AuthorizedClientManager {
    val authorizedClientProvider: ReactiveOAuth2AuthorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
            .clientCredentials()
            .build()
    val authorizedClientManager = DefaultReactiveOAuth2AuthorizedClientManager(
            clientRegistrationRepository, authorizedClientRepository)
    authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)
    return authorizedClientManager
}

您可以按如下方式获取 OAuth2AccessToken

  • Java

  • Kotlin

@Controller
public class OAuth2ClientController {

	@Autowired
	private ReactiveOAuth2AuthorizedClientManager authorizedClientManager;

	@GetMapping("/")
	public Mono<String> index(Authentication authentication, ServerWebExchange exchange) {
		OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("okta")
				.principal(authentication)
				.attribute(ServerWebExchange.class.getName(), exchange)
				.build();

		return this.authorizedClientManager.authorize(authorizeRequest)
				.map(OAuth2AuthorizedClient::getAccessToken)
				// ...
				.thenReturn("index");
	}
}
class OAuth2ClientController {

    @Autowired
    private lateinit var authorizedClientManager: ReactiveOAuth2AuthorizedClientManager

    @GetMapping("/")
    fun index(authentication: Authentication, exchange: ServerWebExchange): Mono<String> {
        val authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("okta")
                .principal(authentication)
                .attribute(ServerWebExchange::class.java.name, exchange)
                .build()

        return authorizedClientManager.authorize(authorizeRequest)
                .map { it.accessToken }
                // ...
                .thenReturn("index")
    }
}

ServerWebExchange 是一个可选属性。如果未提供，将通过键 ServerWebExchange.class 从Reactor 的 Context 中获取。

资源所有者密码凭据

有关资源所有者密码凭据许可类型的更多详细信息，请参阅 OAuth 2.0 授权框架。

请求访问令牌

有关资源所有者密码凭据许可类型的访问令牌请求/响应协议流程，请参阅 OAuth 2.0 授权框架。

针对资源所有者密码凭据许可类型的 ReactiveOAuth2AccessTokenResponseClient 默认实现是 WebClientReactivePasswordTokenResponseClient，它在授权服务器的令牌端点请求访问令牌时使用 WebClient。

WebClientReactivePasswordTokenResponseClient 类以及对资源所有者密码凭据许可类型的支持已被弃用。本节将在 Spring Security 7 中移除。

要定制 WebClientReactivePasswordTokenResponseClient，只需按以下示例提供一个 bean，默认的 ReactiveOAuth2AuthorizedClientManager 将自动拾取它。

访问令牌响应配置

  • Java

  • Kotlin

@Bean
public ReactiveOAuth2AccessTokenResponseClient<OAuth2PasswordGrantRequest> accessTokenResponseClient() {
	WebClientReactivePasswordTokenResponseClient accessTokenResponseClient =
		new WebClientReactivePasswordTokenResponseClient();
	// ...
	return accessTokenResponseClient;
}
@Bean
fun accessTokenResponseClient(): ReactiveOAuth2AccessTokenResponseClient<Password> {
	val accessTokenResponseClient = WebClientReactivePasswordTokenResponseClient()
	// ...
	return accessTokenResponseClient
}

WebClientReactivePasswordTokenResponseClient 非常灵活，并为定制密码许可类型的 OAuth 2.0 访问令牌请求和响应提供了多种选项。选择以下用例以了解更多信息：

定制访问令牌请求

WebClientReactivePasswordTokenResponseClient 提供了用于定制令牌请求的 HTTP 头和请求参数的钩子。

定制请求头

定制 HTTP 头有两种选项：

  • 通过调用 addHeadersConverter() 添加额外的头

  • 通过调用 setHeadersConverter() 完全定制头

您可以使用 addHeadersConverter() 添加额外的头，而不会影响添加到每个请求的默认头。以下示例在 registrationId 为 spring 时向请求添加一个 User-Agent 头。

包含额外的 HTTP 头

  • Java

  • Kotlin

WebClientReactivePasswordTokenResponseClient accessTokenResponseClient =
	new WebClientReactivePasswordTokenResponseClient();
accessTokenResponseClient.addHeadersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	HttpHeaders headers = new HttpHeaders();
	if (clientRegistration.getRegistrationId().equals("spring")) {
		headers.set(HttpHeaders.USER_AGENT, "my-user-agent");
	}
	return headers;
});
val accessTokenResponseClient = WebClientReactivePasswordTokenResponseClient()
accessTokenResponseClient.addHeadersConverter { grantRequest ->
	val clientRegistration = grantRequest.getClientRegistration()
	val headers = HttpHeaders()
	if (clientRegistration.getRegistrationId() == "spring") {
        headers[HttpHeaders.USER_AGENT] = "my-user-agent"
	}
	headers
}

您可以通过复用 DefaultOAuth2TokenRequestHeadersConverter 或使用 setHeadersConverter() 提供自定义实现来完全定制头。以下示例复用 DefaultOAuth2TokenRequestHeadersConverter 并禁用 encodeClientCredentials，以便 HTTP Basic 凭据不再使用 application/x-www-form-urlencoded 进行编码。

定制 HTTP 头

  • Java

  • Kotlin

DefaultOAuth2TokenRequestHeadersConverter headersConverter =
	new DefaultOAuth2TokenRequestHeadersConverter();
headersConverter.setEncodeClientCredentials(false);

WebClientReactivePasswordTokenResponseClient accessTokenResponseClient =
	new WebClientReactivePasswordTokenResponseClient();
accessTokenResponseClient.setHeadersConverter(headersConverter);
val headersConverter = DefaultOAuth2TokenRequestHeadersConverter()
headersConverter.setEncodeClientCredentials(false)

val accessTokenResponseClient = WebClientReactivePasswordTokenResponseClient()
accessTokenResponseClient.setHeadersConverter(headersConverter)

定制请求参数

定制请求参数有三种选项：

  • 通过调用 addParametersConverter() 添加额外参数

  • 通过调用 setParametersConverter() 覆盖参数

  • 通过调用 setParametersCustomizer() 完全定制参数

使用 setParametersConverter() 不能完全定制参数，因为它要求用户自己提供所有默认参数。默认参数总是提供的，但可以通过调用 setParametersCustomizer() 来完全定制或省略。

您可以使用 addParametersConverter() 包含额外参数，而不会影响添加到每个请求的默认参数。以下示例在 registrationId 为 keycloak 时向请求添加一个 audience 参数。

包含额外的请求参数

  • Java

  • Kotlin

WebClientReactivePasswordTokenResponseClient accessTokenResponseClient =
	new WebClientReactivePasswordTokenResponseClient();
accessTokenResponseClient.addParametersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	MultiValueMap<String, String> parameters = new LinkedMultiValueMap<String, String>();
	if (clientRegistration.getRegistrationId().equals("keycloak")) {
		parameters.set(OAuth2ParameterNames.AUDIENCE, "my-audience");
	}
	return parameters;
});
val accessTokenResponseClient = WebClientReactivePasswordTokenResponseClient()
accessTokenResponseClient.addParametersConverter { grantRequest ->
	val clientRegistration = grantRequest.getClientRegistration()
	val parameters = LinkedMultiValueMap<String, String>()
	if (clientRegistration.getRegistrationId() == "keycloak") {
        parameters[OAuth2ParameterNames.AUDIENCE] = "my-audience"
	}
	parameters
}

您可以使用 setParametersConverter() 覆盖默认参数。以下示例在 registrationId 为 okta 时覆盖 client_id 参数。

覆盖请求参数

  • Java

  • Kotlin

WebClientReactivePasswordTokenResponseClient accessTokenResponseClient =
	new WebClientReactivePasswordTokenResponseClient();
accessTokenResponseClient.setParametersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	LinkedMultiValueMap<String, String> parameters = new LinkedMultiValueMap<>();
	if (clientRegistration.getRegistrationId().equals("okta")) {
		parameters.set(OAuth2ParameterNames.CLIENT_ID, "my-client");
	}
	return parameters;
});
val accessTokenResponseClient = WebClientReactivePasswordTokenResponseClient()
accessTokenResponseClient.setParametersConverter { grantRequest ->
    val clientRegistration = grantRequest.getClientRegistration()
	val parameters = LinkedMultiValueMap<String, String>()
	if (clientRegistration.getRegistrationId() == "okta") {
        parameters[OAuth2ParameterNames.CLIENT_ID] = "my-client"
	}
	parameters
}

您可以使用 setParametersCustomizer() 完全定制参数（包括省略默认参数）。以下示例在请求中存在 client_assertion 参数时省略 client_id 参数。

省略请求参数

  • Java

  • Kotlin

WebClientReactivePasswordTokenResponseClient accessTokenResponseClient =
	new WebClientReactivePasswordTokenResponseClient();
accessTokenResponseClient.setParametersCustomizer(parameters -> {
	if (parameters.containsKey(OAuth2ParameterNames.CLIENT_ASSERTION)) {
		parameters.remove(OAuth2ParameterNames.CLIENT_ID);
	}
});
val accessTokenResponseClient = WebClientReactivePasswordTokenResponseClient()
accessTokenResponseClient.setParametersCustomizer { parameters ->
	if (parameters.containsKey(OAuth2ParameterNames.CLIENT_ASSERTION)) {
		parameters.remove(OAuth2ParameterNames.CLIENT_ID)
	}
}

定制访问令牌响应

WebClientReactivePasswordTokenResponseClient 提供了用于定制 OAuth 2.0 访问令牌响应的钩子。

定制响应参数

您可以通过调用 setBodyExtractor() 定制令牌响应参数到 OAuth2AccessTokenResponse 的转换。OAuth2BodyExtractors.oauth2AccessTokenResponse() 提供的默认实现解析响应并相应地处理错误。

以下示例提供了定制令牌响应参数到 OAuth2AccessTokenResponse 转换的起点。

定制 Body Extractor

  • Java

  • Kotlin

WebClientReactivePasswordTokenResponseClient accessTokenResponseClient =
	new WebClientReactivePasswordTokenResponseClient();

BodyExtractor<Mono<Map<String, Object>>, ReactiveHttpInputMessage> bodyExtractor =
	BodyExtractors.toMono(new ParameterizedTypeReference<>() {});
accessTokenResponseClient.setBodyExtractor((inputMessage, context) ->
	bodyExtractor.extract(inputMessage, context)
		.map(parameters -> OAuth2AccessTokenResponse.withToken("custom-token")
			// ...
			.build()
		)
);
val accessTokenResponseClient = WebClientReactivePasswordTokenResponseClient()

val bodyExtractor = BodyExtractors.toMono(object : ParameterizedTypeReference<Map<String, Any>>() {})
accessTokenResponseClient.setBodyExtractor { inputMessage, context ->
	bodyExtractor.extract(inputMessage, context).map { parameters ->
		OAuth2AccessTokenResponse.withToken("custom-token")
			// ...
			.build()
	}
}

提供自定义 BodyExtractor 时，您需要负责根据响应参数检测 OAuth 2.0 错误响应并将其转换为带有 OAuth2Error 的 Mono.error()。

定制 WebClient

或者，如果您的要求更高级，您可以通过向 setWebClient() 提供一个预配置的 WebClient 来完全控制请求和/或响应，如下例所示。

定制 WebClient

  • Java

  • Kotlin

WebClient webClient = WebClient.builder()
	// ...
	.build();

WebClientReactivePasswordTokenResponseClient accessTokenResponseClient =
	new WebClientReactivePasswordTokenResponseClient();
accessTokenResponseClient.setWebClient(webClient);
val webClient = WebClient.builder()
	// ...
	.build()

val accessTokenResponseClient = WebClientReactivePasswordTokenResponseClient()
accessTokenResponseClient.setWebClient(webClient)

使用 Builder 定制

无论您是定制 WebClientReactivePasswordTokenResponseClient 还是提供自己的 ReactiveOAuth2AccessTokenResponseClient 实现，您都可以使用 ReactiveOAuth2AuthorizedClientProviderBuilder（作为发布 bean 的替代方法）进行配置，如下所示。

通过 Builder 进行访问令牌响应配置

  • Java

  • Kotlin

// Customize
ReactiveOAuth2AccessTokenResponseClient<OAuth2PasswordGrantRequest> passwordTokenResponseClient = ...

ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
		ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
				.password(configurer -> configurer.accessTokenResponseClient(passwordTokenResponseClient))
				.refreshToken()
				.build();

// ...

authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);
val passwordTokenResponseClient: ReactiveOAuth2AccessTokenResponseClient<OAuth2PasswordGrantRequest> = ...

val authorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
        .password { it.accessTokenResponseClient(passwordTokenResponseClient) }
        .refreshToken()
        .build()

// ...

authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)

ReactiveOAuth2AuthorizedClientProviderBuilder.builder().password() 配置一个 PasswordReactiveOAuth2AuthorizedClientProvider，它是针对资源所有者密码凭据许可类型的 ReactiveOAuth2AuthorizedClientProvider 实现。

使用访问令牌

假设有以下用于 OAuth 2.0 客户端注册的 Spring Boot 属性

spring:
  security:
    oauth2:
      client:
        registration:
          okta:
            client-id: okta-client-id
            client-secret: okta-client-secret
            authorization-grant-type: password
            scope: read, write
        provider:
          okta:
            token-uri: https://dev-1234.oktapreview.com/oauth2/v1/token

...以及 ReactiveOAuth2AuthorizedClientManager 的 @Bean

  • Java

  • Kotlin

@Bean
public ReactiveOAuth2AuthorizedClientManager authorizedClientManager(
		ReactiveClientRegistrationRepository clientRegistrationRepository,
		ServerOAuth2AuthorizedClientRepository authorizedClientRepository) {

	ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
			ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
					.password()
					.refreshToken()
					.build();

	DefaultReactiveOAuth2AuthorizedClientManager authorizedClientManager =
			new DefaultReactiveOAuth2AuthorizedClientManager(
					clientRegistrationRepository, authorizedClientRepository);
	authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);

	// Assuming the `username` and `password` are supplied as `ServerHttpRequest` parameters,
	// map the `ServerHttpRequest` parameters to `OAuth2AuthorizationContext.getAttributes()`
	authorizedClientManager.setContextAttributesMapper(contextAttributesMapper());

	return authorizedClientManager;
}

private Function<OAuth2AuthorizeRequest, Mono<Map<String, Object>>> contextAttributesMapper() {
	return authorizeRequest -> {
		Map<String, Object> contextAttributes = Collections.emptyMap();
		ServerWebExchange exchange = authorizeRequest.getAttribute(ServerWebExchange.class.getName());
		ServerHttpRequest request = exchange.getRequest();
		String username = request.getQueryParams().getFirst(OAuth2ParameterNames.USERNAME);
		String password = request.getQueryParams().getFirst(OAuth2ParameterNames.PASSWORD);
		if (StringUtils.hasText(username) && StringUtils.hasText(password)) {
			contextAttributes = new HashMap<>();

			// `PasswordReactiveOAuth2AuthorizedClientProvider` requires both attributes
			contextAttributes.put(OAuth2AuthorizationContext.USERNAME_ATTRIBUTE_NAME, username);
			contextAttributes.put(OAuth2AuthorizationContext.PASSWORD_ATTRIBUTE_NAME, password);
		}
		return Mono.just(contextAttributes);
	};
}
@Bean
fun authorizedClientManager(
        clientRegistrationRepository: ReactiveClientRegistrationRepository,
        authorizedClientRepository: ServerOAuth2AuthorizedClientRepository): ReactiveOAuth2AuthorizedClientManager {
    val authorizedClientProvider: ReactiveOAuth2AuthorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
            .password()
            .refreshToken()
            .build()
    val authorizedClientManager = DefaultReactiveOAuth2AuthorizedClientManager(
            clientRegistrationRepository, authorizedClientRepository)
    authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)

    // Assuming the `username` and `password` are supplied as `ServerHttpRequest` parameters,
    // map the `ServerHttpRequest` parameters to `OAuth2AuthorizationContext.getAttributes()`
    authorizedClientManager.setContextAttributesMapper(contextAttributesMapper())
    return authorizedClientManager
}

private fun contextAttributesMapper(): Function<OAuth2AuthorizeRequest, Mono<MutableMap<String, Any>>> {
    return Function { authorizeRequest ->
        var contextAttributes: MutableMap<String, Any> = mutableMapOf()
        val exchange: ServerWebExchange = authorizeRequest.getAttribute(ServerWebExchange::class.java.name)!!
        val request: ServerHttpRequest = exchange.request
        val username: String? = request.queryParams.getFirst(OAuth2ParameterNames.USERNAME)
        val password: String? = request.queryParams.getFirst(OAuth2ParameterNames.PASSWORD)
        if (StringUtils.hasText(username) && StringUtils.hasText(password)) {
            contextAttributes = hashMapOf()

            // `PasswordReactiveOAuth2AuthorizedClientProvider` requires both attributes
            contextAttributes[OAuth2AuthorizationContext.USERNAME_ATTRIBUTE_NAME] = username!!
            contextAttributes[OAuth2AuthorizationContext.PASSWORD_ATTRIBUTE_NAME] = password!!
        }
        Mono.just(contextAttributes)
    }
}

您可以按如下方式获取 OAuth2AccessToken

  • Java

  • Kotlin

@Controller
public class OAuth2ClientController {

	@Autowired
	private ReactiveOAuth2AuthorizedClientManager authorizedClientManager;

	@GetMapping("/")
	public Mono<String> index(Authentication authentication, ServerWebExchange exchange) {
		OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("okta")
				.principal(authentication)
				.attribute(ServerWebExchange.class.getName(), exchange)
				.build();

		return this.authorizedClientManager.authorize(authorizeRequest)
				.map(OAuth2AuthorizedClient::getAccessToken)
				// ...
				.thenReturn("index");
	}
}
@Controller
class OAuth2ClientController {
    @Autowired
    private lateinit var authorizedClientManager: ReactiveOAuth2AuthorizedClientManager

    @GetMapping("/")
    fun index(authentication: Authentication, exchange: ServerWebExchange): Mono<String> {
        val authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("okta")
                .principal(authentication)
                .attribute(ServerWebExchange::class.java.name, exchange)
                .build()

        return authorizedClientManager.authorize(authorizeRequest)
                .map { it.accessToken }
                // ...
                .thenReturn("index")
    }
}

ServerWebExchange 是一个可选属性。如果未提供，将通过键 ServerWebExchange.class 从Reactor 的 Context 中获取。

JWT Bearer

有关JWT Bearer 许可类型的更多详细信息，请参阅 OAuth 2.0 客户端认证和授权许可类型的 JSON Web Token (JWT) Profile。

请求访问令牌

有关 JWT Bearer 许可类型的访问令牌请求/响应协议流程，请参阅 JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants。

针对 JWT Bearer 许可类型的 ReactiveOAuth2AccessTokenResponseClient 默认实现是 WebClientReactiveJwtBearerTokenResponseClient，它在授权服务器的令牌端点请求访问令牌时使用 WebClient。

要定制 WebClientReactiveJwtBearerTokenResponseClient，只需按以下示例提供一个 bean，默认的 ReactiveOAuth2AuthorizedClientManager 将自动拾取它。

访问令牌响应配置

  • Java

  • Kotlin

@Bean
public ReactiveOAuth2AccessTokenResponseClient<JwtBearerGrantRequest> accessTokenResponseClient() {
	WebClientReactiveJwtBearerTokenResponseClient accessTokenResponseClient =
		new WebClientReactiveJwtBearerTokenResponseClient();
	// ...
	return accessTokenResponseClient;
}
@Bean
fun accessTokenResponseClient(): ReactiveOAuth2AccessTokenResponseClient<JWT Bearer> {
	val accessTokenResponseClient = WebClientReactiveJwtBearerTokenResponseClient()
	// ...
	return accessTokenResponseClient
}

WebClientReactiveJwtBearerTokenResponseClient 非常灵活，并为定制 JWT Bearer 许可类型的 OAuth 2.0 访问令牌请求和响应提供了多种选项。选择以下用例以了解更多信息：

定制访问令牌请求

WebClientReactiveJwtBearerTokenResponseClient 提供了用于定制令牌请求的 HTTP 头和请求参数的钩子。

定制请求头

定制 HTTP 头有两种选项：

  • 通过调用 addHeadersConverter() 添加额外的头

  • 通过调用 setHeadersConverter() 完全定制头

您可以使用 addHeadersConverter() 添加额外的头，而不会影响添加到每个请求的默认头。以下示例在 registrationId 为 spring 时向请求添加一个 User-Agent 头。

包含额外的 HTTP 头

  • Java

  • Kotlin

WebClientReactiveJwtBearerTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveJwtBearerTokenResponseClient();
accessTokenResponseClient.addHeadersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	HttpHeaders headers = new HttpHeaders();
	if (clientRegistration.getRegistrationId().equals("spring")) {
		headers.set(HttpHeaders.USER_AGENT, "my-user-agent");
	}
	return headers;
});
val accessTokenResponseClient = WebClientReactiveJwtBearerTokenResponseClient()
accessTokenResponseClient.addHeadersConverter { grantRequest ->
	val clientRegistration = grantRequest.getClientRegistration()
	val headers = HttpHeaders()
	if (clientRegistration.getRegistrationId() == "spring") {
        headers[HttpHeaders.USER_AGENT] = "my-user-agent"
	}
	headers
}

您可以通过复用 DefaultOAuth2TokenRequestHeadersConverter 或使用 setHeadersConverter() 提供自定义实现来完全定制头。以下示例复用 DefaultOAuth2TokenRequestHeadersConverter 并禁用 encodeClientCredentials，以便 HTTP Basic 凭据不再使用 application/x-www-form-urlencoded 进行编码。

定制 HTTP 头

  • Java

  • Kotlin

DefaultOAuth2TokenRequestHeadersConverter headersConverter =
	new DefaultOAuth2TokenRequestHeadersConverter();
headersConverter.setEncodeClientCredentials(false);

WebClientReactiveJwtBearerTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveJwtBearerTokenResponseClient();
accessTokenResponseClient.setHeadersConverter(headersConverter);
val headersConverter = DefaultOAuth2TokenRequestHeadersConverter()
headersConverter.setEncodeClientCredentials(false)

val accessTokenResponseClient = WebClientReactiveJwtBearerTokenResponseClient()
accessTokenResponseClient.setHeadersConverter(headersConverter)

定制请求参数

定制请求参数有三种选项：

  • 通过调用 addParametersConverter() 添加额外参数

  • 通过调用 setParametersConverter() 覆盖参数

  • 通过调用 setParametersCustomizer() 完全定制参数

使用 setParametersConverter() 不能完全定制参数，因为它要求用户自己提供所有默认参数。默认参数总是提供的，但可以通过调用 setParametersCustomizer() 来完全定制或省略。

您可以使用 addParametersConverter() 包含额外参数，而不会影响添加到每个请求的默认参数。以下示例在 registrationId 为 keycloak 时向请求添加一个 audience 参数。

包含额外的请求参数

  • Java

  • Kotlin

WebClientReactiveJwtBearerTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveJwtBearerTokenResponseClient();
accessTokenResponseClient.addParametersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	MultiValueMap<String, String> parameters = new LinkedMultiValueMap<String, String>();
	if (clientRegistration.getRegistrationId().equals("keycloak")) {
		parameters.set(OAuth2ParameterNames.AUDIENCE, "my-audience");
	}
	return parameters;
});
val accessTokenResponseClient = WebClientReactiveJwtBearerTokenResponseClient()
accessTokenResponseClient.addParametersConverter { grantRequest ->
	val clientRegistration = grantRequest.getClientRegistration()
	val parameters = LinkedMultiValueMap<String, String>()
	if (clientRegistration.getRegistrationId() == "keycloak") {
        parameters[OAuth2ParameterNames.AUDIENCE] = "my-audience"
	}
	parameters
}

您可以使用 setParametersConverter() 覆盖默认参数。以下示例在 registrationId 为 okta 时覆盖 client_id 参数。

覆盖请求参数

  • Java

  • Kotlin

WebClientReactiveJwtBearerTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveJwtBearerTokenResponseClient();
accessTokenResponseClient.setParametersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	LinkedMultiValueMap<String, String> parameters = new LinkedMultiValueMap<>();
	if (clientRegistration.getRegistrationId().equals("okta")) {
		parameters.set(OAuth2ParameterNames.CLIENT_ID, "my-client");
	}
	return parameters;
});
val accessTokenResponseClient = WebClientReactiveJwtBearerTokenResponseClient()
accessTokenResponseClient.setParametersConverter { grantRequest ->
    val clientRegistration = grantRequest.getClientRegistration()
	val parameters = LinkedMultiValueMap<String, String>()
	if (clientRegistration.getRegistrationId() == "okta") {
        parameters[OAuth2ParameterNames.CLIENT_ID] = "my-client"
	}
	parameters
}

您可以使用 setParametersCustomizer() 完全定制参数（包括省略默认参数）。以下示例在请求中存在 client_assertion 参数时省略 client_id 参数。

省略请求参数

  • Java

  • Kotlin

WebClientReactiveJwtBearerTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveJwtBearerTokenResponseClient();
accessTokenResponseClient.setParametersCustomizer(parameters -> {
	if (parameters.containsKey(OAuth2ParameterNames.CLIENT_ASSERTION)) {
		parameters.remove(OAuth2ParameterNames.CLIENT_ID);
	}
});
val accessTokenResponseClient = WebClientReactiveJwtBearerTokenResponseClient()
accessTokenResponseClient.setParametersCustomizer { parameters ->
	if (parameters.containsKey(OAuth2ParameterNames.CLIENT_ASSERTION)) {
		parameters.remove(OAuth2ParameterNames.CLIENT_ID)
	}
}

定制访问令牌响应

WebClientReactiveJwtBearerTokenResponseClient 提供了用于定制 OAuth 2.0 访问令牌响应的钩子。

定制响应参数

您可以通过调用 setBodyExtractor() 定制令牌响应参数到 OAuth2AccessTokenResponse 的转换。OAuth2BodyExtractors.oauth2AccessTokenResponse() 提供的默认实现解析响应并相应地处理错误。

以下示例提供了定制令牌响应参数到 OAuth2AccessTokenResponse 转换的起点。

定制 Body Extractor

  • Java

  • Kotlin

WebClientReactiveJwtBearerTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveJwtBearerTokenResponseClient();

BodyExtractor<Mono<Map<String, Object>>, ReactiveHttpInputMessage> bodyExtractor =
	BodyExtractors.toMono(new ParameterizedTypeReference<>() {});
accessTokenResponseClient.setBodyExtractor((inputMessage, context) ->
	bodyExtractor.extract(inputMessage, context)
		.map(parameters -> OAuth2AccessTokenResponse.withToken("custom-token")
			// ...
			.build()
		)
);
val accessTokenResponseClient = WebClientReactiveJwtBearerTokenResponseClient()

val bodyExtractor = BodyExtractors.toMono(object : ParameterizedTypeReference<Map<String, Any>>() {})
accessTokenResponseClient.setBodyExtractor { inputMessage, context ->
	bodyExtractor.extract(inputMessage, context).map { parameters ->
		OAuth2AccessTokenResponse.withToken("custom-token")
			// ...
			.build()
	}
}

提供自定义 BodyExtractor 时，您需要负责根据响应参数检测 OAuth 2.0 错误响应并将其转换为带有 OAuth2Error 的 Mono.error()。

定制 WebClient

或者，如果您的要求更高级，您可以通过向 setWebClient() 提供一个预配置的 WebClient 来完全控制请求和/或响应，如下例所示。

定制 WebClient

  • Java

  • Kotlin

WebClient webClient = WebClient.builder()
	// ...
	.build();

WebClientReactiveJwtBearerTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveJwtBearerTokenResponseClient();
accessTokenResponseClient.setWebClient(webClient);
val webClient = WebClient.builder()
	// ...
	.build()

val accessTokenResponseClient = WebClientReactiveJwtBearerTokenResponseClient()
accessTokenResponseClient.setWebClient(webClient)

使用 Builder 定制

无论您是定制 WebClientReactiveJwtBearerTokenResponseClient 还是提供自己的 ReactiveOAuth2AccessTokenResponseClient 实现，您都可以使用 ReactiveOAuth2AuthorizedClientProviderBuilder（作为发布 bean 的替代方法）进行配置，如下所示。

通过 Builder 进行访问令牌响应配置

  • Java

  • Kotlin

// Customize
ReactiveOAuth2AccessTokenResponseClient<JwtBearerGrantRequest> jwtBearerTokenResponseClient = ...

JwtBearerReactiveOAuth2AuthorizedClientProvider jwtBearerAuthorizedClientProvider = new JwtBearerReactiveOAuth2AuthorizedClientProvider();
jwtBearerAuthorizedClientProvider.setAccessTokenResponseClient(jwtBearerTokenResponseClient);

ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
		ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
				.provider(jwtBearerAuthorizedClientProvider)
				.build();

// ...

authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);
// Customize
val jwtBearerTokenResponseClient: ReactiveOAuth2AccessTokenResponseClient<JwtBearerGrantRequest> = ...

val jwtBearerAuthorizedClientProvider = JwtBearerReactiveOAuth2AuthorizedClientProvider()
jwtBearerAuthorizedClientProvider.setAccessTokenResponseClient(jwtBearerTokenResponseClient)

val authorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
        .provider(jwtBearerAuthorizedClientProvider)
        .build()

// ...

authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)

使用访问令牌

假设有以下用于 OAuth 2.0 客户端注册的 Spring Boot 属性

spring:
  security:
    oauth2:
      client:
        registration:
          okta:
            client-id: okta-client-id
            client-secret: okta-client-secret
            authorization-grant-type: urn:ietf:params:oauth:grant-type:jwt-bearer
            scope: read
        provider:
          okta:
            token-uri: https://dev-1234.oktapreview.com/oauth2/v1/token

...以及 OAuth2AuthorizedClientManager 的 @Bean

  • Java

  • Kotlin

@Bean
public ReactiveOAuth2AuthorizedClientManager authorizedClientManager(
		ReactiveClientRegistrationRepository clientRegistrationRepository,
		ServerOAuth2AuthorizedClientRepository authorizedClientRepository) {

	JwtBearerReactiveOAuth2AuthorizedClientProvider jwtBearerAuthorizedClientProvider =
			new JwtBearerReactiveOAuth2AuthorizedClientProvider();

	ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
			ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
					.provider(jwtBearerAuthorizedClientProvider)
					.build();

	DefaultReactiveOAuth2AuthorizedClientManager authorizedClientManager =
			new DefaultReactiveOAuth2AuthorizedClientManager(
					clientRegistrationRepository, authorizedClientRepository);
	authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);

	return authorizedClientManager;
}
@Bean
fun authorizedClientManager(
        clientRegistrationRepository: ReactiveClientRegistrationRepository,
        authorizedClientRepository: ServerOAuth2AuthorizedClientRepository): ReactiveOAuth2AuthorizedClientManager {
    val jwtBearerAuthorizedClientProvider = JwtBearerReactiveOAuth2AuthorizedClientProvider()
    val authorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
            .provider(jwtBearerAuthorizedClientProvider)
            .build()
    val authorizedClientManager = DefaultReactiveOAuth2AuthorizedClientManager(
            clientRegistrationRepository, authorizedClientRepository)
    authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)
    return authorizedClientManager
}

您可以按如下方式获取 OAuth2AccessToken

  • Java

  • Kotlin

@RestController
public class OAuth2ResourceServerController {

	@Autowired
	private ReactiveOAuth2AuthorizedClientManager authorizedClientManager;

	@GetMapping("/resource")
	public Mono<String> resource(JwtAuthenticationToken jwtAuthentication, ServerWebExchange exchange) {
		OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("okta")
				.principal(jwtAuthentication)
				.build();

		return this.authorizedClientManager.authorize(authorizeRequest)
				.map(OAuth2AuthorizedClient::getAccessToken)
				// ...
				.thenReturn("index");
	}
}
class OAuth2ResourceServerController {

    @Autowired
    private lateinit var authorizedClientManager: ReactiveOAuth2AuthorizedClientManager

    @GetMapping("/resource")
    fun resource(jwtAuthentication: JwtAuthenticationToken, exchange: ServerWebExchange): Mono<String> {
        val authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("okta")
                .principal(jwtAuthentication)
                .build()
        return authorizedClientManager.authorize(authorizeRequest)
                .map { it.accessToken }
                // ...
                .thenReturn("index")
    }
}

JwtBearerReactiveOAuth2AuthorizedClientProvider 默认通过 OAuth2AuthorizationContext.getPrincipal().getPrincipal() 解析 Jwt 断言，因此在前例中使用了 JwtAuthenticationToken。

如果您需要从不同来源解析 Jwt 断言，可以使用自定义的 Function<OAuth2AuthorizationContext, Mono<Jwt>> 为 JwtBearerReactiveOAuth2AuthorizedClientProvider.setJwtAssertionResolver() 提供实现。

令牌交换

有关令牌交换许可类型的更多详细信息，请参阅 OAuth 2.0 Token Exchange。

请求访问令牌

有关令牌交换许可类型的令牌交换请求和响应协议流程，请参阅 OAuth 2.0 Token Exchange。

令牌交换（Token Exchange）授权模式的默认实现是 ReactiveOAuth2AccessTokenResponseClient，它在向授权服务器（Authorization Server）的令牌端点（Token Endpoint）请求访问令牌（Access Token）时使用 WebClient。

要定制 WebClientReactiveTokenExchangeTokenResponseClient，只需提供一个 bean，如下例所示，它将被默认的 ReactiveOAuth2AuthorizedClientManager 自动拾取。

访问令牌响应配置

  • Java

  • Kotlin

@Bean
public ReactiveOAuth2AccessTokenResponseClient<TokenExchangeGrantRequest> accessTokenResponseClient() {
	WebClientReactiveTokenExchangeTokenResponseClient accessTokenResponseClient =
		new WebClientReactiveTokenExchangeTokenResponseClient();
	// ...
	return accessTokenResponseClient;
}
@Bean
fun accessTokenResponseClient(): ReactiveOAuth2AccessTokenResponseClient<Token Exchange> {
	val accessTokenResponseClient = WebClientReactiveTokenExchangeTokenResponseClient()
	// ...
	return accessTokenResponseClient
}

WebClientReactiveTokenExchangeTokenResponseClient 非常灵活，为令牌交换（Token Exchange）授权模式的 OAuth 2.0 访问令牌（Access Token）请求和响应提供了多种定制选项。从以下用例中选择以了解更多信息：

定制访问令牌（Access Token）请求

WebClientReactiveTokenExchangeTokenResponseClient 提供了用于定制令牌请求（Token Request）的 HTTP 头部和请求参数的钩子。

定制请求头部

定制 HTTP 头有两种选项：

  • 通过调用 addHeadersConverter() 添加额外的头

  • 通过调用 setHeadersConverter() 完全定制头

您可以使用 addHeadersConverter() 添加额外的头，而不会影响添加到每个请求的默认头。以下示例在 registrationId 为 spring 时向请求添加一个 User-Agent 头。

包含额外的 HTTP 头

  • Java

  • Kotlin

WebClientReactiveTokenExchangeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveTokenExchangeTokenResponseClient();
accessTokenResponseClient.addHeadersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	HttpHeaders headers = new HttpHeaders();
	if (clientRegistration.getRegistrationId().equals("spring")) {
		headers.set(HttpHeaders.USER_AGENT, "my-user-agent");
	}
	return headers;
});
val accessTokenResponseClient = WebClientReactiveTokenExchangeTokenResponseClient()
accessTokenResponseClient.addHeadersConverter { grantRequest ->
	val clientRegistration = grantRequest.getClientRegistration()
	val headers = HttpHeaders()
	if (clientRegistration.getRegistrationId() == "spring") {
        headers[HttpHeaders.USER_AGENT] = "my-user-agent"
	}
	headers
}

您可以通过复用 DefaultOAuth2TokenRequestHeadersConverter 或使用 setHeadersConverter() 提供自定义实现来完全定制头。以下示例复用 DefaultOAuth2TokenRequestHeadersConverter 并禁用 encodeClientCredentials，以便 HTTP Basic 凭据不再使用 application/x-www-form-urlencoded 进行编码。

定制 HTTP 头

  • Java

  • Kotlin

DefaultOAuth2TokenRequestHeadersConverter headersConverter =
	new DefaultOAuth2TokenRequestHeadersConverter();
headersConverter.setEncodeClientCredentials(false);

WebClientReactiveTokenExchangeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveTokenExchangeTokenResponseClient();
accessTokenResponseClient.setHeadersConverter(headersConverter);
val headersConverter = DefaultOAuth2TokenRequestHeadersConverter()
headersConverter.setEncodeClientCredentials(false)

val accessTokenResponseClient = WebClientReactiveTokenExchangeTokenResponseClient()
accessTokenResponseClient.setHeadersConverter(headersConverter)

定制请求参数

定制请求参数有三种选项：

  • 通过调用 addParametersConverter() 添加额外参数

  • 通过调用 setParametersConverter() 覆盖参数

  • 通过调用 setParametersCustomizer() 完全定制参数

使用 setParametersConverter() 不能完全定制参数，因为它要求用户自己提供所有默认参数。默认参数总是提供的，但可以通过调用 setParametersCustomizer() 来完全定制或省略。

您可以使用 addParametersConverter() 包含额外参数，而不会影响添加到每个请求的默认参数。以下示例在 registrationId 为 keycloak 时向请求添加一个 audience 参数。

包含额外的请求参数

  • Java

  • Kotlin

WebClientReactiveTokenExchangeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveTokenExchangeTokenResponseClient();
accessTokenResponseClient.addParametersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	MultiValueMap<String, String> parameters = new LinkedMultiValueMap<String, String>();
	if (clientRegistration.getRegistrationId().equals("keycloak")) {
		parameters.set(OAuth2ParameterNames.AUDIENCE, "my-audience");
	}
	return parameters;
});
val accessTokenResponseClient = WebClientReactiveTokenExchangeTokenResponseClient()
accessTokenResponseClient.addParametersConverter { grantRequest ->
	val clientRegistration = grantRequest.getClientRegistration()
	val parameters = LinkedMultiValueMap<String, String>()
	if (clientRegistration.getRegistrationId() == "keycloak") {
        parameters[OAuth2ParameterNames.AUDIENCE] = "my-audience"
	}
	parameters
}

您可以使用 setParametersConverter() 覆盖默认参数。以下示例在 registrationId 为 okta 时覆盖 client_id 参数。

覆盖请求参数

  • Java

  • Kotlin

WebClientReactiveTokenExchangeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveTokenExchangeTokenResponseClient();
accessTokenResponseClient.setParametersConverter(grantRequest -> {
	ClientRegistration clientRegistration = grantRequest.getClientRegistration();
	LinkedMultiValueMap<String, String> parameters = new LinkedMultiValueMap<>();
	if (clientRegistration.getRegistrationId().equals("okta")) {
		parameters.set(OAuth2ParameterNames.CLIENT_ID, "my-client");
	}
	return parameters;
});
val accessTokenResponseClient = WebClientReactiveTokenExchangeTokenResponseClient()
accessTokenResponseClient.setParametersConverter { grantRequest ->
    val clientRegistration = grantRequest.getClientRegistration()
	val parameters = LinkedMultiValueMap<String, String>()
	if (clientRegistration.getRegistrationId() == "okta") {
        parameters[OAuth2ParameterNames.CLIENT_ID] = "my-client"
	}
	parameters
}

您可以使用 setParametersCustomizer() 完全定制参数（包括省略默认参数）。以下示例在请求中存在 client_assertion 参数时省略 client_id 参数。

省略请求参数

  • Java

  • Kotlin

WebClientReactiveTokenExchangeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveTokenExchangeTokenResponseClient();
accessTokenResponseClient.setParametersCustomizer(parameters -> {
	if (parameters.containsKey(OAuth2ParameterNames.CLIENT_ASSERTION)) {
		parameters.remove(OAuth2ParameterNames.CLIENT_ID);
	}
});
val accessTokenResponseClient = WebClientReactiveTokenExchangeTokenResponseClient()
accessTokenResponseClient.setParametersCustomizer { parameters ->
	if (parameters.containsKey(OAuth2ParameterNames.CLIENT_ASSERTION)) {
		parameters.remove(OAuth2ParameterNames.CLIENT_ID)
	}
}

定制访问令牌（Access Token）响应

WebClientReactiveTokenExchangeTokenResponseClient 提供了用于定制 OAuth 2.0 访问令牌（Access Token）响应的钩子。

定制响应参数

您可以通过调用 setBodyExtractor() 定制令牌响应参数到 OAuth2AccessTokenResponse 的转换。OAuth2BodyExtractors.oauth2AccessTokenResponse() 提供的默认实现解析响应并相应地处理错误。

以下示例提供了定制令牌响应参数到 OAuth2AccessTokenResponse 转换的起点。

定制 Body Extractor

  • Java

  • Kotlin

WebClientReactiveTokenExchangeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveTokenExchangeTokenResponseClient();

BodyExtractor<Mono<Map<String, Object>>, ReactiveHttpInputMessage> bodyExtractor =
	BodyExtractors.toMono(new ParameterizedTypeReference<>() {});
accessTokenResponseClient.setBodyExtractor((inputMessage, context) ->
	bodyExtractor.extract(inputMessage, context)
		.map(parameters -> OAuth2AccessTokenResponse.withToken("custom-token")
			// ...
			.build()
		)
);
val accessTokenResponseClient = WebClientReactiveTokenExchangeTokenResponseClient()

val bodyExtractor = BodyExtractors.toMono(object : ParameterizedTypeReference<Map<String, Any>>() {})
accessTokenResponseClient.setBodyExtractor { inputMessage, context ->
	bodyExtractor.extract(inputMessage, context).map { parameters ->
		OAuth2AccessTokenResponse.withToken("custom-token")
			// ...
			.build()
	}
}

提供自定义 BodyExtractor 时，您需要负责根据响应参数检测 OAuth 2.0 错误响应并将其转换为带有 OAuth2Error 的 Mono.error()。

定制 WebClient

或者，如果您的要求更高级，您可以通过向 setWebClient() 提供一个预配置的 WebClient 来完全控制请求和/或响应，如下例所示。

定制 WebClient

  • Java

  • Kotlin

WebClient webClient = WebClient.builder()
	// ...
	.build();

WebClientReactiveTokenExchangeTokenResponseClient accessTokenResponseClient =
	new WebClientReactiveTokenExchangeTokenResponseClient();
accessTokenResponseClient.setWebClient(webClient);
val webClient = WebClient.builder()
	// ...
	.build()

val accessTokenResponseClient = WebClientReactiveTokenExchangeTokenResponseClient()
accessTokenResponseClient.setWebClient(webClient)

使用构建器（Builder）定制

无论您是定制 WebClientReactiveTokenExchangeTokenResponseClient 还是提供自己的 ReactiveOAuth2AccessTokenResponseClient 实现，都可以使用 ReactiveOAuth2AuthorizedClientProviderBuilder（作为发布 Bean 的替代方案）进行配置，如下所示：

通过 Builder 进行访问令牌响应配置

  • Java

  • Kotlin

// Customize
ReactiveOAuth2AccessTokenResponseClient<TokenExchangeGrantRequest> tokenExchangeTokenResponseClient = ...

TokenExchangeReactiveOAuth2AuthorizedClientProvider tokenExchangeAuthorizedClientProvider = new TokenExchangeReactiveOAuth2AuthorizedClientProvider();
tokenExchangeAuthorizedClientProvider.setAccessTokenResponseClient(tokenExchangeTokenResponseClient);

ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
		ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
				.provider(tokenExchangeAuthorizedClientProvider)
				.build();

// ...

authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);
// Customize
val tokenExchangeTokenResponseClient: ReactiveOAuth2AccessTokenResponseClient<TokenExchangeGrantRequest> = ...

val tokenExchangeAuthorizedClientProvider = TokenExchangeReactiveOAuth2AuthorizedClientProvider()
tokenExchangeAuthorizedClientProvider.setAccessTokenResponseClient(tokenExchangeTokenResponseClient)

val authorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
        .provider(tokenExchangeAuthorizedClientProvider)
        .build()

// ...

authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)

使用访问令牌（Access Token）

假设有以下用于 OAuth 2.0 客户端注册的 Spring Boot 属性

spring:
  security:
    oauth2:
      client:
        registration:
          okta:
            client-id: okta-client-id
            client-secret: okta-client-secret
            authorization-grant-type: urn:ietf:params:oauth:grant-type:token-exchange
            scope: read
        provider:
          okta:
            token-uri: https://dev-1234.oktapreview.com/oauth2/v1/token

...以及 OAuth2AuthorizedClientManager 的 @Bean

  • Java

  • Kotlin

@Bean
public ReactiveOAuth2AuthorizedClientManager authorizedClientManager(
		ReactiveClientRegistrationRepository clientRegistrationRepository,
		ServerOAuth2AuthorizedClientRepository authorizedClientRepository) {

	TokenExchangeReactiveOAuth2AuthorizedClientProvider tokenExchangeAuthorizedClientProvider =
			new TokenExchangeReactiveOAuth2AuthorizedClientProvider();

	ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
			ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
					.provider(tokenExchangeAuthorizedClientProvider)
					.build();

	DefaultReactiveOAuth2AuthorizedClientManager authorizedClientManager =
			new DefaultReactiveOAuth2AuthorizedClientManager(
					clientRegistrationRepository, authorizedClientRepository);
	authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);

	return authorizedClientManager;
}
@Bean
fun authorizedClientManager(
        clientRegistrationRepository: ReactiveClientRegistrationRepository,
        authorizedClientRepository: ServerOAuth2AuthorizedClientRepository): ReactiveOAuth2AuthorizedClientManager {
    val tokenExchangeAuthorizedClientProvider = TokenExchangeReactiveOAuth2AuthorizedClientProvider()
    val authorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
            .provider(tokenExchangeAuthorizedClientProvider)
            .build()
    val authorizedClientManager = DefaultReactiveOAuth2AuthorizedClientManager(
            clientRegistrationRepository, authorizedClientRepository)
    authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)
    return authorizedClientManager
}

您可以按如下方式获取 OAuth2AccessToken

  • Java

  • Kotlin

@RestController
public class OAuth2ResourceServerController {

	@Autowired
	private ReactiveOAuth2AuthorizedClientManager authorizedClientManager;

	@GetMapping("/resource")
	public Mono<String> resource(JwtAuthenticationToken jwtAuthentication) {
		OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("okta")
				.principal(jwtAuthentication)
				.build();

		return this.authorizedClientManager.authorize(authorizeRequest)
				.map(OAuth2AuthorizedClient::getAccessToken)
				// ...
				.thenReturn("index");
	}
}
class OAuth2ResourceServerController {

    @Autowired
    private lateinit var authorizedClientManager: ReactiveOAuth2AuthorizedClientManager

    @GetMapping("/resource")
    fun resource(jwtAuthentication: JwtAuthenticationToken): Mono<String> {
        val authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("okta")
                .principal(jwtAuthentication)
                .build()
        return authorizedClientManager.authorize(authorizeRequest)
                .map { it.accessToken }
                // ...
                .thenReturn("index")
    }
}

默认情况下，TokenExchangeReactiveOAuth2AuthorizedClientProvider 通过 OAuth2AuthorizationContext.getPrincipal().getPrincipal() 解析主体令牌（Subject Token）（作为 OAuth2Token），因此在上例中使用了 JwtAuthenticationToken。默认情况下不解析行为者令牌（Actor Token）。

如果您需要从不同来源解析主体令牌，可以为 TokenExchangeReactiveOAuth2AuthorizedClientProvider.setSubjectTokenResolver() 提供一个自定义的 Function<OAuth2AuthorizationContext, Mono<OAuth2Token>>。

如果您需要解析行为者令牌，可以为 TokenExchangeReactiveOAuth2AuthorizedClientProvider.setActorTokenResolver() 提供一个自定义的 Function<OAuth2AuthorizationContext, Mono<OAuth2Token>>。