Spring Security 5 Replacement for OAuth2RestTemplate: A Simple and Effective Solution

Introduction:

In recent versions of Spring Security, classes like OAuth2RestTemplate, OAuth2ProtectedResourceDetails, and ClientCredentialsAccessTokenProvider have been marked as deprecated. This has led to confusion among developers looking for a suitable replacement in the core Spring Security 5 project. In this blog post, we will explore an alternative approach to using OAuth2RestTemplate and discuss how to implement it effectively.

Understanding the Changes in Spring Security 5

OAuth2RestTemplate has been deprecated in favor of WebClient, which is the recommended HTTP client for making requests in Spring Security 5. WebClient provides a non-blocking, reactive approach and offers efficient support for both synchronous and asynchronous scenarios. While RestTemplate is still supported, it is recommended to migrate to WebClient for future-proofing your code.

Configuring WebClient for Client Credentials Flow

To replace OAuth2RestTemplate with WebClient, you need to configure the WebClient instance properly. Here’s how you can do it:

1. Define the necessary client registration details in your application configuration, either programmatically or using an application.yml file. Include the client ID, client secret, token URI, and other required properties.
2. Create a ReactiveClientRegistrationRepository bean to manage client registrations. This repository will hold the necessary configuration for OAuth2 client registration.
3. Build your WebClient instance, specifying the necessary base URL and default headers. Use the ServerOAuth2AuthorizedClientExchangeFilterFunction to handle OAuth2 authorization and token retrieval. Set the default client registration ID to identify the specific OAuth provider.

Implementing Custom ReactiveOAuth2AccessTokenResponseClient

In some cases, you may need to customize the OAuth token request by adding extra headers or modifying the request body. To achieve this, you can implement a custom ReactiveOAuth2AccessTokenResponseClient. This client will handle the token retrieval and processing based on your specific requirements.

Putting It All Together: A Sample Configuration

Here’s a sample configuration that brings all the pieces together:

code



























@Configuration
public class WebClientConfig {

    @Bean
    public ReactiveClientRegistrationRepository clientRegistrationRepository() {
        // Define your client registration details here
        ClientRegistration registration = ClientRegistration.withRegistrationId("custom")
                .clientId("your-client-id")
                .clientSecret("your-client-secret")
                .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
                .tokenUri("your-token-uri")
                .build();
        return new InMemoryReactiveClientRegistrationRepository(registration);
    }

    @Bean
    public WebClient webClient(ReactiveClientRegistrationRepository clientRegistrationRepo) {
        InMemoryReactiveOAuth2AuthorizedClientService clientService = new InMemoryReactiveOAuth2AuthorizedClientService(clientRegistrationRepo);
        AuthorizedClientServiceReactiveOAuth2AuthorizedClientManager authorizedClientManager = new AuthorizedClientServiceReactiveOAuth2AuthorizedClientManager(clientRegistrationRepo, clientService);
        ServerOAuth2AuthorizedClientExchangeFilterFunction oauthFilter = new ServerOAuth2AuthorizedClientExchangeFilterFunction(authorizedClientManager);
        oauthFilter.setDefaultClientRegistrationId("custom");

        return WebClient.builder()
                .filter(oauthFilter)
                .build();
    }

}

Conclusion

By migrating from OAuth2RestTemplate to WebClient in Spring Security 5, you can ensure future compatibility and take advantage of the non-blocking, reactive capabilities provided by WebClient. Implementing the necessary configuration and customizing the token request if required, you can easily make requests to external services protected by OAuth.

With this simple and effective replacement, you can seamlessly transition your code to Spring Security 5 and continue leveraging OAuth for secure API integrations.