OAuth2 should be easier to set up without a servlet context

Context

Right now I’m spending a lot of time futzing around trying to figure out how to use spring-cloud-openfeign with the modern spring security oauth 2 because they haven’t implemented it yet. It occurs to me while working with this, that there is no reason a client_credentials workflow needs to have a servlet container. you could easily be running a non http daemon or a command line app or a number of other things, that arguably shouldn’t even require a spring security context. In this case I don’t feel like -web should be “needed” to get a quick client up and tested inside of my feign RequestInterceptor, and for testing it. I get that there’s probably a very manual way to do this (that I have yet to figure out from the documentation) but it feels like it should be as simple as configure client in spring boot, get client, grab token, refresh as necessary by just asking for the token.

org.springframework.boot:spring-boot-starter-oauth2-client:2.7.3
org.springframework.security:spring-security-oauth2-client:5.7.3
org.springframework.security:spring-security-oauth2-core:5.7.3
org.springframework.security:spring-security-oauth2-jose:5.7.3

Issue Analytics

State:
Created a year ago
Comments:6 (3 by maintainers)

Top GitHub Comments

1reaction

jzheauxcommented, Sep 26, 2022

I wonder if the documentation could benefit from a header above the paragraph that @jgrandja highlighted, for example:

Authorizing clients outside of a servlet context

The DefaultOAuth2AuthorizedClientManager is designed to be used within the context of a HttpServletRequest. When operating outside of a HttpServletRequest context…

I think the docs in general should move more towards being use-case driven, but a header like the above may help folks find what they need a little easier in the meantime.

0reactions

xenoterracidecommented, Sep 27, 2022

You know what would also help? https://docs.spring.io/spring-security/reference/servlet/index.html if client credentials (which is machine accessible, for all kinds of not servlet code) was not buried under servlet. There should be another section for it.