How to get oauth2 access token in a spring boot application (not a web application) using spring security 5

Question

I need to get access token (grant_type = client_credentials) in the service layer of my spring boot application to talk to other microservice (service to service interaction). There is no spring http session or auth at this layer, I just have client_id, client_secret and token url. These properties are set in application.properties as:

spring.security.oauth2.client.registration.auth1.client-id=***
spring.security.oauth2.client.registration.auth1.client-secret=***
spring.security.oauth2.client.registration.auth1.authorization-grant-type=client_credentials
spring.security.oauth2.client.provider.auth1.tokenUri=***

This seemed simple with Spring Security OAuth, but can't figure out with Spring security. Referred the documents for spring security 5, but everything seems to be in context of web interface. I understand I could just make http call to get the token with the info I have, but I wanted to utilize the framework...

Scenario: Lets call this spring boot app service A. There are other services which might call A to process updates on http or send kafka message on a topic which A listens to. When A processes the update/message, it needs to send some data to service B which requires access token for authz. This is where I need the access token. So the interaction is essentially service-service and is not specific to user.

Answer 1

When not in the context of a web interface, you'll want to look at the service layer.

From Spring Security's Javadocs for AuthorizedClientServiceOAuth2AuthorizedClientManager:

An implementation of an {@link OAuth2AuthorizedClientManager} that is capable of operating outside of a {@code HttpServletRequest} context, e.g. in a scheduled/background thread and/or in the service-tier.

Here's a @Bean definition that may help, which I'll explain below:

    @Bean
    OAuth2AuthorizedClientManager authorizedClientManager
            (ClientRegistrationRepository clients) {
        OAuth2AuthorizedClientService service = 
                new InMemoryOAuth2AuthorizedClientService(clients);
        AuthorizedClientServiceOAuth2AuthorizedClientManager manager =
                new AuthorizedClientServiceOAuth2AuthorizedClientManager(clients, service);
        OAuth2AuthorizedClientProvider authorizedClientProvider =
                OAuth2AuthorizedClientProviderBuilder.builder()
                        .clientCredentials()
                        .build();
        manager.setAuthorizedClientProvider(authorizedClientProvider);
        return manager;
    }

An OAuth2AuthorizedClientManager manages authorizing OAuth 2.0 client definitions. These definitions are stored in a ClientRegistrationRepository, and a default instance of ClientRegistrationRepository is created by Spring Boot via the properties you've already got defined.

The manager typically needs two things to function:

• The first is an OAuth2AuthorizedClientService, which is handy if you are wanting to store tokens in a database - in Spring Security 5.2, the only implementation is an in-memory one; however, it appears that 5.3 will ship with a JDBC implementation.

• The second is an OAuth2AuthorizedClientProvider, which is what actually performs the token requests, like the client credentials one you want to make.

With this manager created, you can wire it into your web client:

    @Bean
    WebClient webClient(OAuth2AuthorizedClientManager authorizedClientManager) {
        ServletOAuth2AuthorizedClientExchangeFilterFunction oauth2 =
                new ServletOAuth2AuthorizedClientExchangeFilterFunction
                        (authorizedClientManager);
        oauth2.setDefaultClientRegistrationId("auth1");
        return WebClient.builder()
                .apply(oauth2.oauth2Configuration())
                .build();
    }

The exchange filter function used above is the thing that adds the bearer token to the Authorization header. It calls the manager to ask it for a token, the manager pulls it from the service. If it's expired, the manager asks the provider to refresh it. Now, with a fresh token, the manager hands it back to the filter to get it added into the request.