Class RefreshTokenReactiveOAuth2AuthorizedClientProvider

java.lang.Object

org.springframework.security.oauth2.client.RefreshTokenReactiveOAuth2AuthorizedClientProvider

All Implemented Interfaces:

ReactiveOAuth2AuthorizedClientProvider

public final class RefreshTokenReactiveOAuth2AuthorizedClientProvider
extends Object
implements ReactiveOAuth2AuthorizedClientProvider

An implementation of a ReactiveOAuth2AuthorizedClientProvider for the refresh_token grant.

Since:

5.2

See Also:

• ReactiveOAuth2AuthorizedClientProvider
• WebClientReactiveRefreshTokenTokenResponseClient

Constructor Summary

Constructors

Constructor	Description
RefreshTokenReactiveOAuth2AuthorizedClientProvider()

Method Summary

Modifier and Type	Method	Description
reactor.core.publisher.Mono<OAuth2AuthorizedClient>	authorize(OAuth2AuthorizationContext context)	Attempt to re-authorize the client in the provided context.
void	setAccessTokenResponseClient(ReactiveOAuth2AccessTokenResponseClient<OAuth2RefreshTokenGrantRequest> accessTokenResponseClient)	Sets the client used when requesting an access token credential at the Token Endpoint for the refresh_token grant.
void	setAuthorizationSuccessHandler(ReactiveOAuth2AuthorizationSuccessHandler authorizationSuccessHandler)	Sets a ReactiveOAuth2AuthorizationSuccessHandler to use for handling successful refresh token response.
void	setClock(Clock clock)	Sets the Clock used in Instant.now(Clock) when checking the access token expiry.
void	setClockSkew(Duration clockSkew)	Sets the maximum acceptable clock skew, which is used when checking the access token expiry.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

RefreshTokenReactiveOAuth2AuthorizedClientProvider

public RefreshTokenReactiveOAuth2AuthorizedClientProvider()

Method Details

authorize

public reactor.core.publisher.Mono<OAuth2AuthorizedClient> authorize(OAuth2AuthorizationContext context)

Attempt to re-authorize the client in the provided context. Returns an empty Mono if re-authorization is not supported, e.g. the client is not authorized OR the refresh token is not available for the authorized client OR the access token is not expired.

The following context attributes are supported:

1. "org.springframework.security.oauth2.client.REQUEST_SCOPE" (optional) - a String[] of scope(s) to be requested by the client

Specified by:

authorize in interface ReactiveOAuth2AuthorizedClientProvider

Parameters:

context - the context that holds authorization-specific state for the client

Returns:

the OAuth2AuthorizedClient or an empty Mono if re-authorization is not supported

setAccessTokenResponseClient

public void setAccessTokenResponseClient(ReactiveOAuth2AccessTokenResponseClient<OAuth2RefreshTokenGrantRequest> accessTokenResponseClient)

Sets the client used when requesting an access token credential at the Token Endpoint for the refresh_token grant.

Parameters:

accessTokenResponseClient - the client used when requesting an access token credential at the Token Endpoint for the refresh_token grant

setAuthorizationSuccessHandler

public void setAuthorizationSuccessHandler(ReactiveOAuth2AuthorizationSuccessHandler authorizationSuccessHandler)

Sets a ReactiveOAuth2AuthorizationSuccessHandler to use for handling successful refresh token response. Defaults to RefreshOidcUserReactiveOAuth2AuthorizationSuccessHandler, when spring-security-oauth2-jose is available on the classpath.

Parameters:

authorizationSuccessHandler - the ReactiveOAuth2AuthorizationSuccessHandler to use

Since:

7.1

setClockSkew

public void setClockSkew(Duration clockSkew)

Sets the maximum acceptable clock skew, which is used when checking the access token expiry. The default is 60 seconds.

An access token is considered expired if OAuth2AccessToken#getExpiresAt() - clockSkew is before the current time clock#instant().

Parameters:

clockSkew - the maximum acceptable clock skew

setClock

public void setClock(Clock clock)

Sets the Clock used in Instant.now(Clock) when checking the access token expiry.

Parameters:

clock - the clock