OAuth 2.0 客户端

DeepSeek V3 中英对照 OAuth2 Client OAuth 2.0 Client

OAuth 2.0 客户端特性为 OAuth 2.0 授权框架 中定义的客户端角色提供支持。

从高层次来看，核心功能主要包括：

授权授予支持

• 授权码

• 刷新令牌

• 客户端凭证

• JWT Bearer

• 令牌交换

客户端身份验证支持

• JWT Bearer

HTTP 客户端支持（用于请求受保护资源）

• RestClient 集成

• Servlet 环境下的 WebClient 集成

HttpSecurity.oauth2Client() DSL 为定制 OAuth 2.0 客户端使用的核心组件提供了多种配置选项。此外，HttpSecurity.oauth2Client().authorizationCodeGrant() 支持对授权码许可流程进行定制。

以下代码展示了 HttpSecurity.oauth2Client() DSL 提供的完整配置选项：

Java

@Configuration
@EnableWebSecurity
public class OAuth2ClientSecurityConfig {

	@Bean
	public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
		http
			.oauth2Client((oauth2) -> oauth2
				.clientRegistrationRepository(this.clientRegistrationRepository())
				.authorizedClientRepository(this.authorizedClientRepository())
				.authorizedClientService(this.authorizedClientService())
				.authorizationCodeGrant((codeGrant) -> codeGrant
					.authorizationRequestRepository(this.authorizationRequestRepository())
					.authorizationRequestResolver(this.authorizationRequestResolver())
					.accessTokenResponseClient(this.accessTokenResponseClient())
				)
			);
		return http.build();
	}
}

Kotlin

@Configuration
@EnableWebSecurity
class OAuth2ClientSecurityConfig {

    @Bean
    open fun filterChain(http: HttpSecurity): SecurityFilterChain {
        http {
            oauth2Client {
                clientRegistrationRepository = clientRegistrationRepository()
                authorizedClientRepository = authorizedClientRepository()
                authorizedClientService = authorizedClientService()
                authorizationCodeGrant {
                    authorizationRequestRepository = authorizationRequestRepository()
                    authorizationRequestResolver = authorizationRequestResolver()
                    accessTokenResponseClient = accessTokenResponseClient()
                }
            }
        }
        return http.build()
    }
}

除了 HttpSecurity.oauth2Client() DSL 之外，也支持 XML 配置。

以下代码展示了 security 命名空间 中可用的完整配置选项：

<http>
	<oauth2-client client-registration-repository-ref="clientRegistrationRepository"
				   authorized-client-repository-ref="authorizedClientRepository"
				   authorized-client-service-ref="authorizedClientService">
		<authorization-code-grant
				authorization-request-repository-ref="authorizationRequestRepository"
				authorization-request-resolver-ref="authorizationRequestResolver"
				access-token-response-client-ref="accessTokenResponseClient"/>
	</oauth2-client>
</http>

OAuth2AuthorizedClientManager 负责与一个或多个 OAuth2AuthorizedClientProvider 协作，管理 OAuth 2.0 客户端的授权（或重新授权）。

以下代码展示了如何注册一个 OAuth2AuthorizedClientManager @Bean，并将其与一个 OAuth2AuthorizedClientProvider 组合关联，该组合提供了对 authorization_code、refresh_token 和 client_credentials 授权类型的支持：

Java

@Bean
public OAuth2AuthorizedClientManager authorizedClientManager(
		ClientRegistrationRepository clientRegistrationRepository,
		OAuth2AuthorizedClientRepository authorizedClientRepository) {

	OAuth2AuthorizedClientProvider authorizedClientProvider =
			OAuth2AuthorizedClientProviderBuilder.builder()
					.authorizationCode()
					.refreshToken()
					.clientCredentials()
					.build();

	DefaultOAuth2AuthorizedClientManager authorizedClientManager =
			new DefaultOAuth2AuthorizedClientManager(
					clientRegistrationRepository, authorizedClientRepository);
	authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);

	return authorizedClientManager;
}

Kotlin

@Bean
fun authorizedClientManager(
        clientRegistrationRepository: ClientRegistrationRepository,
        authorizedClientRepository: OAuth2AuthorizedClientRepository): OAuth2AuthorizedClientManager {
    val authorizedClientProvider: OAuth2AuthorizedClientProvider = OAuth2AuthorizedClientProviderBuilder.builder()
            .authorizationCode()
            .refreshToken()
            .clientCredentials()
            .build()
    val authorizedClientManager = DefaultOAuth2AuthorizedClientManager(
            clientRegistrationRepository, authorizedClientRepository)
    authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)
    return authorizedClientManager
}

章节总结

📄️ 核心接口与类

本节介绍 Spring Security 提供的 OAuth2 核心接口与类。

📄️ OAuth2 授权许可

本节介绍 Spring Security 对授权许可的支持。

📄️ OAuth2 客户端认证

客户端通过HTTP Basic进行身份验证是开箱即用的，无需任何定制即可启用。默认实现由DefaultOAuth2TokenRequestHeadersConverter提供。

📄️ OAuth2 授权客户端

本节涵盖了 Spring Security 为 OAuth2 客户端提供的附加功能。