WebClient support should get new access token when expired and client_credentials

[rwinch]

Summary

WebClient support should get new access token when an access token is expired and client_credentials is used

[vpavic]

I don't think this behavior should be enabled by default since the OAuth 2.0 spec actually discourages the issuing/use of refresh tokens with client credentials grant - see https://tools.ietf.org/html/rfc6749#section-4.4.3.

This should probably be made as opt-in feature.

[dlesnef1]

@rwinch I think there was a misunderstanding of my original question.

My Authentication Server does not return a refresh_token, only the standard response outlined by https://tools.ietf.org/html/rfc6749#section-4.4.3.

What I am attempting to do is configure WebClient (make a Bean) such that it makes the access request to the Authentication Server under the hood and remembers the access_token. Then I can autowire in the Bean and make requests to a protected resource server without having to provide the access_token directly.

Here is the old configuration for a RestTemplate Bean.

@Bean
	@Qualifier("blah")
	public RestTemplate oAuthRestTemplate() {
		ClientCredentialsResourceDetails resourceDetails = new ClientCredentialsResourceDetails();
		resourceDetails.setClientId(clientId);
		resourceDetails.setClientSecret(clientSecret);
		resourceDetails.setAccessTokenUri(accessTokenUri);
		resourceDetails.setScope(scopes);
		resourceDetails.setGrantType("client_credentials");

		RestTemplate restTemplate = new OAuth2RestTemplate(resourceDetails, new DefaultOAuth2ClientContext());
		restTemplate.setErrorHandler(new DefaultResponseErrorHandler());
		return restTemplate;
	}

By refreshing the token, I mean it will be the configured WebClient's job to notice the access_token is expiring (the response includes the default "expires_in" field) and make a request to the Authentication Server to reset the token.

[rwinch]

@dlesnef1 You have described what I view this feature as doing. I have updated the title to make it more clear that it isn't using a refresh token. Any interest in submitting a PR for this?

[dlesnef1]

Hey @rwinch I will definitely give it a go. I read the contributing guide and peaked at some other PRs.

Any advice on getting started would be appreciated, but I will begin looking at the code soon.