What is the correct way of retrieving an OAuth2 Bearer token in Spring

Question

I am making service to service requests using Spring's WebClient that require an OAuth2 bearer token to be added as a header to the request. I Can do this relatively easily by creating an ExchangeFilterFunction that intercepts the request, retrieves an access token, adds it to the header, and continues on. Since this is not a user request, the SecurityContextHolder does not contain an Authentication that would hold an access token for me, so instead of retrieving from that, I would like to get an access token based on my Spring security configuration (currently defined in the spring.security.oauth2.client.registration and provider properties).

The way I'm doing this now is by Autowiring an OAuth2ClientContext and then getting the AccessToken from it. Reducing the code only to what I care about for this question, I have:

@Component
public class OAuth2WebClientFilter implements ExchangeFilterFunction {

    @Autowired
    private OAuth2ClientContext oAuth2ClientContext;

    public Mono<ClientResponse> filter(ClientRequest request, ExchangeFunction next) {
        // simple retrieval of the token
        String oAuth2Token = oAuth2ClientContext.getAccessToken().getValue();

        // adding the token to the header of the request
        request = ClientRequest.from(request).header(HttpHeaders.AUTHORIZATION, "Bearer " + oAuth2Token).build();
    
        return next.exchange(request);
    }
}

This does exactly what I want it to. However, I have recently upgraded spring-security-oauth2 to 2.5.0.RELEASE, and it is saying the OAuth2ClientContext is deprecated, but I haven't found a simple replacement for this process. So is there still a way to get an access token in a relatively simple fashion like above, and if so, how?

Also note: this concept is used elsewhere in the project and not just for the WebClient, so I'm looking to see how to properly replace an injected OAuth2ClientContext. Thanks!

Answer 1

Spring Security provides an exchange filter function called ServletOAuth2AuthorizedClientExchangeFilterFunction.

The ServletOAuth2AuthorizedClientExchangeFilterFunction provides a simple mechanism for requesting protected resources by using an OAuth2AuthorizedClient and including the associated OAuth2AccessToken as a Bearer Token. It directly uses an OAuth2AuthorizedClientManager and therefore inherits the following capabilities:

An OAuth2AccessToken will be requested if the client has not yet been authorized.

authorization_code - triggers the Authorization Request redirect to initiate the flow

client_credentials - the access token is obtained directly from the Token Endpoint

password - the access token is obtained directly from the Token Endpoint

If the OAuth2AccessToken is expired, it will be refreshed (or renewed) if an OAuth2AuthorizedClientProvider is available to perform the authorization

See https://docs.spring.io/spring-security/reference/servlet/oauth2/client/authorized-clients.html#oauth2Client-webclient-servlet for details.