org.springframework.security.oauth2.client.web.reactive.function.client

Class ServletOAuth2AuthorizedClientExchangeFilterFunction

java.lang.Object

org.springframework.security.oauth2.client.web.reactive.function.client.ServletOAuth2AuthorizedClientExchangeFilterFunction

All Implemented Interfaces:

org.springframework.web.reactive.function.client.ExchangeFilterFunction

public final class ServletOAuth2AuthorizedClientExchangeFilterFunction
extends java.lang.Object
implements org.springframework.web.reactive.function.client.ExchangeFilterFunction

Provides an easy mechanism for using an OAuth2AuthorizedClient to make OAuth 2.0 requests by including the access token as a bearer token.

NOTE:This class is intended to be used in a Servlet environment.

Example usage:

 ServletOAuth2AuthorizedClientExchangeFilterFunction oauth2 = new ServletOAuth2AuthorizedClientExchangeFilterFunction(authorizedClientManager);
 WebClient webClient = WebClient.builder()
    .apply(oauth2.oauth2Configuration())
    .build();
 Mono<String> response = webClient
    .get()
    .uri(uri)
    .attributes(oauth2AuthorizedClient(authorizedClient))
    // ...
    .retrieve()
    .bodyToMono(String.class);
 

Authentication and Authorization Failures

Since 5.3, this filter function has the ability to forward authentication (HTTP 401 Unauthorized) and authorization (HTTP 403 Forbidden) failures from an OAuth 2.0 Resource Server to a OAuth2AuthorizationFailureHandler. A RemoveAuthorizedClientOAuth2AuthorizationFailureHandler can be used to remove the cached OAuth2AuthorizedClient, so that future requests will result in a new token being retrieved from an Authorization Server, and sent to the Resource Server.

If the ServletOAuth2AuthorizedClientExchangeFilterFunction(ClientRegistrationRepository, OAuth2AuthorizedClientRepository) constructor is used, a RemoveAuthorizedClientOAuth2AuthorizationFailureHandler will be configured automatically.

If the ServletOAuth2AuthorizedClientExchangeFilterFunction(OAuth2AuthorizedClientManager) constructor is used, a RemoveAuthorizedClientOAuth2AuthorizationFailureHandler will NOT be configured automatically. It is recommended that you configure one via setAuthorizationFailureHandler(OAuth2AuthorizationFailureHandler).

Since:

5.1

See Also:

OAuth2AuthorizedClientManager, DefaultOAuth2AuthorizedClientManager, OAuth2AuthorizedClientProvider, OAuth2AuthorizedClientProviderBuilder

Constructor Summary

Constructors

Constructor and Description
ServletOAuth2AuthorizedClientExchangeFilterFunction()
ServletOAuth2AuthorizedClientExchangeFilterFunction(ClientRegistrationRepository clientRegistrationRepository, OAuth2AuthorizedClientRepository authorizedClientRepository) Constructs a ServletOAuth2AuthorizedClientExchangeFilterFunction using the provided parameters.
ServletOAuth2AuthorizedClientExchangeFilterFunction(OAuth2AuthorizedClientManager authorizedClientManager) Constructs a ServletOAuth2AuthorizedClientExchangeFilterFunction using the provided parameters.

Method Summary

Modifier and Type	Method and Description
static java.util.function.Consumer<java.util.Map<java.lang.String,java.lang.Object>>	authentication(Authentication authentication) Modifies the ClientRequest.attributes() to include the Authentication used to look up and save the OAuth2AuthorizedClient.
static java.util.function.Consumer<java.util.Map<java.lang.String,java.lang.Object>>	clientRegistrationId(java.lang.String clientRegistrationId) Modifies the ClientRequest.attributes() to include the ClientRegistration.getRegistrationId() to be used to look up the OAuth2AuthorizedClient.
java.util.function.Consumer<org.springframework.web.reactive.function.client.WebClient.RequestHeadersSpec<?>>	defaultRequest() Provides defaults for the HttpServletRequest and the HttpServletResponse using RequestContextHolder.
reactor.core.publisher.Mono<org.springframework.web.reactive.function.client.ClientResponse>	filter(org.springframework.web.reactive.function.client.ClientRequest request, org.springframework.web.reactive.function.client.ExchangeFunction next)
static java.util.function.Consumer<java.util.Map<java.lang.String,java.lang.Object>>	httpServletRequest(javax.servlet.http.HttpServletRequest request) Modifies the ClientRequest.attributes() to include the HttpServletRequest used to look up and save the OAuth2AuthorizedClient.
static java.util.function.Consumer<java.util.Map<java.lang.String,java.lang.Object>>	httpServletResponse(javax.servlet.http.HttpServletResponse response) Modifies the ClientRequest.attributes() to include the HttpServletResponse used to save the OAuth2AuthorizedClient.
static java.util.function.Consumer<java.util.Map<java.lang.String,java.lang.Object>>	oauth2AuthorizedClient(OAuth2AuthorizedClient authorizedClient) Modifies the ClientRequest.attributes() to include the OAuth2AuthorizedClient to be used for providing the Bearer Token.
java.util.function.Consumer<org.springframework.web.reactive.function.client.WebClient.Builder>	oauth2Configuration() Configures the builder with defaultRequest() and adds this as a ExchangeFilterFunction
void	setAccessTokenExpiresSkew(java.time.Duration accessTokenExpiresSkew) Deprecated. The accessTokenExpiresSkew should be configured with the specific OAuth2AuthorizedClientProvider implementation, e.g. ClientCredentialsOAuth2AuthorizedClientProvider or RefreshTokenOAuth2AuthorizedClientProvider.
void	setAuthorizationFailureHandler(OAuth2AuthorizationFailureHandler authorizationFailureHandler) Sets the OAuth2AuthorizationFailureHandler that handles authentication and authorization failures when communicating to the OAuth 2.0 Resource Server.
void	setClientCredentialsTokenResponseClient(OAuth2AccessTokenResponseClient<OAuth2ClientCredentialsGrantRequest> clientCredentialsTokenResponseClient) Deprecated. Use ServletOAuth2AuthorizedClientExchangeFilterFunction(OAuth2AuthorizedClientManager) instead. Create an instance of ClientCredentialsOAuth2AuthorizedClientProvider configured with a DefaultClientCredentialsTokenResponseClient (or a custom one) and than supply it to DefaultOAuth2AuthorizedClientManager.
void	setDefaultClientRegistrationId(java.lang.String clientRegistrationId) If set, will be used as the default ClientRegistration.getRegistrationId().
void	setDefaultOAuth2AuthorizedClient(boolean defaultOAuth2AuthorizedClient) If true, a default OAuth2AuthorizedClient can be discovered from the current Authentication.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.springframework.web.reactive.function.client.ExchangeFilterFunction

andThen, apply, ofRequestProcessor, ofResponseProcessor

Constructor Detail

ServletOAuth2AuthorizedClientExchangeFilterFunction

public ServletOAuth2AuthorizedClientExchangeFilterFunction()

ServletOAuth2AuthorizedClientExchangeFilterFunction

public ServletOAuth2AuthorizedClientExchangeFilterFunction(OAuth2AuthorizedClientManager authorizedClientManager)

Constructs a ServletOAuth2AuthorizedClientExchangeFilterFunction using the provided parameters.

When this constructor is used, authentication (HTTP 401) and authorization (HTTP 403) failures returned from an OAuth 2.0 Resource Server will NOT be forwarded to an OAuth2AuthorizationFailureHandler. Therefore, future requests to the Resource Server will most likely use the same (likely invalid) token, resulting in the same errors returned from the Resource Server. It is recommended to configure a RemoveAuthorizedClientOAuth2AuthorizationFailureHandler via setAuthorizationFailureHandler(OAuth2AuthorizationFailureHandler) so that authentication and authorization failures returned from a Resource Server will result in removing the authorized client, so that a new token is retrieved for future requests.

Parameters:

authorizedClientManager - the OAuth2AuthorizedClientManager which manages the authorized client(s)

Since:

5.2

ServletOAuth2AuthorizedClientExchangeFilterFunction

public ServletOAuth2AuthorizedClientExchangeFilterFunction(ClientRegistrationRepository clientRegistrationRepository,
                                                           OAuth2AuthorizedClientRepository authorizedClientRepository)

Constructs a ServletOAuth2AuthorizedClientExchangeFilterFunction using the provided parameters.

Since 5.3, when this constructor is used, authentication (HTTP 401) and authorization (HTTP 403) failures returned from an OAuth 2.0 Resource Server will be forwarded to a RemoveAuthorizedClientOAuth2AuthorizationFailureHandler, which will potentially remove the OAuth2AuthorizedClient from the given OAuth2AuthorizedClientRepository, depending on the OAuth 2.0 error code returned. Authentication failures returned from an OAuth 2.0 Resource Server typically indicate that the token is invalid, and should not be used in future requests. Removing the authorized client from the repository will ensure that the existing token will not be sent for future requests to the Resource Server, and a new token is retrieved from the Authorization Server and used for future requests to the Resource Server.

Parameters:

clientRegistrationRepository - the repository of client registrations

authorizedClientRepository - the repository of authorized clients

Method Detail

setClientCredentialsTokenResponseClient

@Deprecated
public void setClientCredentialsTokenResponseClient(OAuth2AccessTokenResponseClient<OAuth2ClientCredentialsGrantRequest> clientCredentialsTokenResponseClient)

Deprecated. Use ServletOAuth2AuthorizedClientExchangeFilterFunction(OAuth2AuthorizedClientManager) instead. Create an instance of ClientCredentialsOAuth2AuthorizedClientProvider configured with a DefaultClientCredentialsTokenResponseClient (or a custom one) and than supply it to DefaultOAuth2AuthorizedClientManager.

Sets the OAuth2AccessTokenResponseClient used for getting an OAuth2AuthorizedClient for the client_credentials grant.

Parameters:

clientCredentialsTokenResponseClient - the client to use

setDefaultOAuth2AuthorizedClient

public void setDefaultOAuth2AuthorizedClient(boolean defaultOAuth2AuthorizedClient)

If true, a default OAuth2AuthorizedClient can be discovered from the current Authentication. It is recommended to be cautious with this feature since all HTTP requests will receive the access token if it can be resolved from the current Authentication.

Parameters:

defaultOAuth2AuthorizedClient - true if a default OAuth2AuthorizedClient should be used, else false. Default is false.

setDefaultClientRegistrationId

public void setDefaultClientRegistrationId(java.lang.String clientRegistrationId)

If set, will be used as the default ClientRegistration.getRegistrationId(). It is recommended to be cautious with this feature since all HTTP requests will receive the access token.

Parameters:

clientRegistrationId - the id to use

oauth2Configuration

public java.util.function.Consumer<org.springframework.web.reactive.function.client.WebClient.Builder> oauth2Configuration()

Configures the builder with defaultRequest() and adds this as a ExchangeFilterFunction

Returns:

the Consumer to configure the builder

defaultRequest

public java.util.function.Consumer<org.springframework.web.reactive.function.client.WebClient.RequestHeadersSpec<?>> defaultRequest()

Provides defaults for the HttpServletRequest and the HttpServletResponse using RequestContextHolder. It also provides defaults for the Authentication using SecurityContextHolder. It also can default the OAuth2AuthorizedClient using the clientRegistrationId(String) or the authentication(Authentication).

Returns:

the Consumer to populate the attributes

oauth2AuthorizedClient

public static java.util.function.Consumer<java.util.Map<java.lang.String,java.lang.Object>> oauth2AuthorizedClient(OAuth2AuthorizedClient authorizedClient)

Modifies the ClientRequest.attributes() to include the OAuth2AuthorizedClient to be used for providing the Bearer Token.

Parameters:

authorizedClient - the OAuth2AuthorizedClient to use.

Returns:

the Consumer to populate the attributes

clientRegistrationId

public static java.util.function.Consumer<java.util.Map<java.lang.String,java.lang.Object>> clientRegistrationId(java.lang.String clientRegistrationId)

Modifies the ClientRequest.attributes() to include the ClientRegistration.getRegistrationId() to be used to look up the OAuth2AuthorizedClient.

Parameters:

clientRegistrationId - the ClientRegistration.getRegistrationId() to be used to look up the OAuth2AuthorizedClient.

Returns:

the Consumer to populate the attributes

authentication

public static java.util.function.Consumer<java.util.Map<java.lang.String,java.lang.Object>> authentication(Authentication authentication)

Modifies the ClientRequest.attributes() to include the Authentication used to look up and save the OAuth2AuthorizedClient. The value is defaulted in defaultRequest()

Parameters:

authentication - the Authentication to use.

Returns:

the Consumer to populate the attributes

httpServletRequest

public static java.util.function.Consumer<java.util.Map<java.lang.String,java.lang.Object>> httpServletRequest(javax.servlet.http.HttpServletRequest request)

Modifies the ClientRequest.attributes() to include the HttpServletRequest used to look up and save the OAuth2AuthorizedClient. The value is defaulted in defaultRequest()

Parameters:

request - the HttpServletRequest to use.

Returns:

the Consumer to populate the attributes

httpServletResponse

public static java.util.function.Consumer<java.util.Map<java.lang.String,java.lang.Object>> httpServletResponse(javax.servlet.http.HttpServletResponse response)

Modifies the ClientRequest.attributes() to include the HttpServletResponse used to save the OAuth2AuthorizedClient. The value is defaulted in defaultRequest()

Parameters:

response - the HttpServletResponse to use.

Returns:

the Consumer to populate the attributes

setAccessTokenExpiresSkew

@Deprecated
public void setAccessTokenExpiresSkew(java.time.Duration accessTokenExpiresSkew)

Deprecated. The accessTokenExpiresSkew should be configured with the specific OAuth2AuthorizedClientProvider implementation, e.g. ClientCredentialsOAuth2AuthorizedClientProvider or RefreshTokenOAuth2AuthorizedClientProvider.

An access token will be considered expired by comparing its expiration to now + this skewed Duration. The default is 1 minute.

Parameters:

accessTokenExpiresSkew - the Duration to use.

setAuthorizationFailureHandler

public void setAuthorizationFailureHandler(OAuth2AuthorizationFailureHandler authorizationFailureHandler)

Sets the OAuth2AuthorizationFailureHandler that handles authentication and authorization failures when communicating to the OAuth 2.0 Resource Server.

For example, a RemoveAuthorizedClientOAuth2AuthorizationFailureHandler is typically used to remove the cached OAuth2AuthorizedClient, so that the same token is no longer used in future requests to the Resource Server.

The failure handler used by default depends on which constructor was used to construct this ServletOAuth2AuthorizedClientExchangeFilterFunction. See the constructors for more details.

Parameters:

authorizationFailureHandler - the OAuth2AuthorizationFailureHandler that handles authentication and authorization failures

Since:

5.3

filter

public reactor.core.publisher.Mono<org.springframework.web.reactive.function.client.ClientResponse> filter(org.springframework.web.reactive.function.client.ClientRequest request,
                                                                                                           org.springframework.web.reactive.function.client.ExchangeFunction next)

Specified by:

filter in interface org.springframework.web.reactive.function.client.ExchangeFilterFunction