# OAuth2.0客户端

OAuth2.0客户机特性为[OAuth2.0授权框架](https://tools.ietf.org/html/rfc6749#section-1.1)中定义的客户机角色提供支持。

在高层次上，可用的核心特性是：

授权赠款支助

* [授权代码](https://tools.ietf.org/html/rfc6749#section-1.3.1)

* [刷新令牌](https://tools.ietf.org/html/rfc6749#section-6)

* [客户凭据](https://tools.ietf.org/html/rfc6749#section-1.3.4)

* [资源所有者密码凭据](https://tools.ietf.org/html/rfc6749#section-1.3.3)

* [JWT Bearer](https://datatracker.ietf.org/doc/html/rfc7523#section-2.1)

客户端身份验证支持

* [JWT Bearer](https://datatracker.ietf.org/doc/html/rfc7523#section-2.2)

HTTP客户端支持

* [`WebClient` Servlet 环境的集成]（授权-clients.html#OAuth2client-Webclient- Servlet）（用于请求受保护的资源）

`HttpSecurity.oauth2Client()`DSL为定制OAuth2.0客户端使用的核心组件提供了许多配置选项。此外，`HttpSecurity.oauth2Client().authorizationCodeGrant()`实现了对授权代码授权的定制。

以下代码显示了`HttpSecurity.oauth2Client()`DSL提供的完整配置选项：

例1. OAuth2客户端配置选项

Java

```
@EnableWebSecurity
public class OAuth2ClientSecurityConfig extends WebSecurityConfigurerAdapter {

	@Override
	protected void configure(HttpSecurity http) throws Exception {
		http
			.oauth2Client(oauth2 -> oauth2
				.clientRegistrationRepository(this.clientRegistrationRepository())
				.authorizedClientRepository(this.authorizedClientRepository())
				.authorizedClientService(this.authorizedClientService())
				.authorizationCodeGrant(codeGrant -> codeGrant
					.authorizationRequestRepository(this.authorizationRequestRepository())
					.authorizationRequestResolver(this.authorizationRequestResolver())
					.accessTokenResponseClient(this.accessTokenResponseClient())
				)
			);
	}
}
```

Kotlin

```
@EnableWebSecurity
class OAuth2ClientSecurityConfig : WebSecurityConfigurerAdapter() {

    override fun configure(http: HttpSecurity) {
        http {
            oauth2Client {
                clientRegistrationRepository = clientRegistrationRepository()
                authorizedClientRepository = authorizedClientRepository()
                authorizedClientService = authorizedClientService()
                authorizationCodeGrant {
                    authorizationRequestRepository = authorizationRequestRepository()
                    authorizationRequestResolver = authorizationRequestResolver()
                    accessTokenResponseClient = accessTokenResponseClient()
                }
            }
        }
    }
}
```

除了`HttpSecurity.oauth2Client()`DSL之外，还支持XML配置。

以下代码显示了[安全命名空间](../../appendix/namespace/http.html#nsa-oauth2-client)中可用的完整配置选项：

例2. OAuth2客户机XML配置选项

```
<http>
	<oauth2-client client-registration-repository-ref="clientRegistrationRepository"
				   authorized-client-repository-ref="authorizedClientRepository"
				   authorized-client-service-ref="authorizedClientService">
		<authorization-code-grant
				authorization-request-repository-ref="authorizationRequestRepository"
				authorization-request-resolver-ref="authorizationRequestResolver"
				access-token-response-client-ref="accessTokenResponseClient"/>
	</oauth2-client>
</http>
```

`OAuth2AuthorizedClientManager`负责与一个或多个`OAuth2AuthorizedClientProvider`协作管理OAuth2.0客户端的授权（或重新授权）。

下面的代码展示了如何注册`OAuth2AuthorizedClientManager``@Bean`并将其与`OAuth2AuthorizedClientProvider`复合相关联的示例，该复合提供对`authorization_code`、`refresh_token`、`client_credentials`和`password`授权授予类型的支持：

Java

```
@Bean
public OAuth2AuthorizedClientManager authorizedClientManager(
		ClientRegistrationRepository clientRegistrationRepository,
		OAuth2AuthorizedClientRepository authorizedClientRepository) {

	OAuth2AuthorizedClientProvider authorizedClientProvider =
			OAuth2AuthorizedClientProviderBuilder.builder()
					.authorizationCode()
					.refreshToken()
					.clientCredentials()
					.password()
					.build();

	DefaultOAuth2AuthorizedClientManager authorizedClientManager =
			new DefaultOAuth2AuthorizedClientManager(
					clientRegistrationRepository, authorizedClientRepository);
	authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);

	return authorizedClientManager;
}
```

Kotlin

```
@Bean
fun authorizedClientManager(
        clientRegistrationRepository: ClientRegistrationRepository,
        authorizedClientRepository: OAuth2AuthorizedClientRepository): OAuth2AuthorizedClientManager {
    val authorizedClientProvider: OAuth2AuthorizedClientProvider = OAuth2AuthorizedClientProviderBuilder.builder()
            .authorizationCode()
            .refreshToken()
            .clientCredentials()
            .password()
            .build()
    val authorizedClientManager = DefaultOAuth2AuthorizedClientManager(
            clientRegistrationRepository, authorizedClientRepository)
    authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider)
    return authorizedClientManager
}
```

## 章节摘要

* [核心接口和类](core.html)
* [OAuth2授权授予](authorization-grants.html)
* [OAuth2客户端身份验证](client-authentication.html)
* [OAuth2授权客户](authorized-clients.html)

[高级配置](../login/advanced.html)[核心接口和类](core.html)