我可以让 Spring Boot 创建一个使用 OAuth2 的 WebClient 而不尝试将 OAuth 流应用到我的端点吗？

Question

I want to have a WebClient which uses a client_credentials OAuth2 flow to authorize with an API. I've followed various sets of instructions from the documentation to several tutorials.

I feel like I'm pretty close to getting Spring Boot to do what I want, but the default behaviour is doing something I don't want - I get redirected to /login when I make a request to any of my controllers. I want to be able to (at the moment) do an unauthorized request to my API, and have the service-to-service call use the configured OAuth2 flow.

spring:
  main:
    web-application-type: reactive
  security:
    oauth2:
      client:
        registration:
          my-private-api:
            client-id: <foo>
            client-secret: <bar>
            authorization-grant-type: client_credentials
        provider:
          my-private-api:
            token-uri: <uri>

    @Bean
    WebClient webClient( final ReactiveClientRegistrationRepository clientRegistrations,
        final ReactiveOAuth2AuthorizedClientService authorizedClientService )
    {
        ServerOAuth2AuthorizedClientExchangeFilterFunction oauth =
            new ServerOAuth2AuthorizedClientExchangeFilterFunction( new AuthorizedClientServiceReactiveOAuth2AuthorizedClientManager(
                clientRegistrations,
                authorizedClientService ) );
        oauth.setDefaultClientRegistrationId( "my-private-api" );
        return WebClient.builder().filter( oauth ).build();
    }

Do I need to do lots of manual configuration in order to avoid this default behaviour I don't want?

Answer 1

So turns out my OAuth configuration was fine, what I was actually asking for was "how do I disable the default behaviour of Spring Security's SecurityWebFilterChain" - which is to add a bean overriding the behaviour:

    @Bean
    SecurityWebFilterChain springWebFilterChain( final ServerHttpSecurity http )
    {
        http.httpBasic().disable().formLogin().disable().csrf().disable().logout().disable();
        return http.build();
    }