Periodically refresh access token in a separate thread - spring-security

Question

This is a Spring Boot application where as part of a request an external service is contacted and that service is accessed and authorization is done by passing an access token. Spring security client 5.4.2 is used for all of these steps (and the web client is a Spring Webflux webclient).
The problem: The authentication is done as part of the actual request. The application will do a lot of requests to the external service and all those requests are using the same client id and secret (and thus they share the access token). Unfortunately retrieving a new access token is a heavy process (time-wise) and having the access token retrieval process as part of the request (even if it is the first one) will cause noticeable delays, which causes issues for the rest of the transaction flow. Ideally the access token should be retrieved and refreshed (ahead of expiry time) as a separate thread and the requests should use that access token.
Setting up the beans for the authentication and web client:
#Bean
public WebClient oAuthWebClient(ExchangeFilterFunction ourApiOauthFilter, ClientHttpConnector clientHttpConnector) {
return WebClient.builder()
.clientConnector(clientHttpConnector)
.filter(ourApiOauthFilter)
.build();
}
#Bean
public ReactiveClientRegistrationRepository clientRegistrationRepository() {
return new InMemoryReactiveClientRegistrationRepository(ClientRegistration
.withRegistrationId("our-reg-id")
.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
.clientId(clientId)
.clientSecret(clientSecret)
.tokenUri(oauth2Uri)
.scope(List.of("scope1", "scope2"))
.build());
}
#Bean
public ExchangeFilterFunction ourApiOauthFilter(ReactiveClientRegistrationRepository clientRegistrationRepo) {
InMemoryReactiveOAuth2AuthorizedClientService authorizedClientService = new InMemoryReactiveOAuth2AuthorizedClientService(clientRegistrationRepo);
ServerOAuth2AuthorizedClientExchangeFilterFunction filter = new ServerOAuth2AuthorizedClientExchangeFilterFunction(
new AuthorizedClientServiceReactiveOAuth2AuthorizedClientManager(clientRegistrationRepo, authorizedClientService));
filter.setDefaultClientRegistrationId("our-reg-id");
return filter;
}
From this I have been trying to get a configuration added that could have the token refreshed automatically well before it expires to ensure that it is always there but not been able to get further than this. The refresh is the biggest problem as we could always make a dummy call to the service before we let any transactions flow through the application to ensure we have a access token the first time.
Question: How can I get the application to refresh this access token periodically and independent from the actual transactions and at the same time make sure no transactions will need to authenticate?
EDIT: After originally asking this question I ran across this issue, where in the thread there were some good insights on how to get one step further. However I am still left with the final obstacle and that is to make sure we get all of our authentication done in the timed thread and not as part of the "transaction threads". From what I gather the token expire occurs at the same time in the timed thread and transaction thread and as such there is no guarantee the timed thread would get to it and complete the token request before any transaction deals with the same thread.

Answer 1

The following configuration should work for your use case.
Key points
ASSUMPTION: The provider is configured with access token time-to-live at 60 mins
Clock skew is configured for 5 mins to force early token renewal
At application startup, the access token is initially obtained via authorizeAtStartup()
Every 60 mins, the access token is renewed via authorizeEveryHour()
#Configuration
#EnableScheduling
public class WebClientConfig {
private static final String DEFAULT_CLIENT_REGISTRATION_ID = "our-reg-id";
private static final String DEFAULT_CLIENT_ID = "client-1";
private static final OAuth2AuthorizeRequest DEFAULT_AUTHORIZE_REQUEST =
OAuth2AuthorizeRequest.withClientRegistrationId(DEFAULT_CLIENT_REGISTRATION_ID)
.principal(DEFAULT_CLIENT_ID)
.build();;
#Autowired
private ReactiveOAuth2AuthorizedClientManager authorizedClientManager;
#Bean
public WebClient oAuthWebClient(ExchangeFilterFunction ourApiOauthFilter, ClientHttpConnector clientHttpConnector) {
return WebClient.builder()
.clientConnector(clientHttpConnector)
.filter(ourApiOauthFilter)
.build();
}
#Bean
public ReactiveClientRegistrationRepository clientRegistrationRepository() {
return new InMemoryReactiveClientRegistrationRepository(ClientRegistration.withRegistrationId(DEFAULT_CLIENT_REGISTRATION_ID)
.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
.clientId(DEFAULT_CLIENT_ID)
.clientSecret("clientSecret")
.tokenUri("oauth2Uri")
.scope(List.of("scope1", "scope2"))
.build());
}
#Bean
public ExchangeFilterFunction ourApiOauthFilter(ReactiveOAuth2AuthorizedClientManager authorizedClientManager) {
ServerOAuth2AuthorizedClientExchangeFilterFunction filter =
new ServerOAuth2AuthorizedClientExchangeFilterFunction(authorizedClientManager);
filter.setDefaultClientRegistrationId(DEFAULT_CLIENT_REGISTRATION_ID);
return filter;
}
#Bean
public ReactiveOAuth2AuthorizedClientManager authorizedClientManager(
ReactiveClientRegistrationRepository clientRegistrationRepository) {
ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider =
ReactiveOAuth2AuthorizedClientProviderBuilder.builder()
.clientCredentials(clientCredentials ->
// NOTE: Set a higher clock skew to force early token renewal
clientCredentials.clockSkew(Duration.ofMinutes(5)))
.build();
InMemoryReactiveOAuth2AuthorizedClientService authorizedClientService =
new InMemoryReactiveOAuth2AuthorizedClientService(clientRegistrationRepository);
AuthorizedClientServiceReactiveOAuth2AuthorizedClientManager authorizedClientManager =
new AuthorizedClientServiceReactiveOAuth2AuthorizedClientManager(
clientRegistrationRepository, authorizedClientService);
authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);
return authorizedClientManager;
}
#PostConstruct
public void authorizeAtStartup() {
this.authorizedClientManager.authorize(DEFAULT_AUTHORIZE_REQUEST).subscribe();
}
#Scheduled(cron = "0 0 * * * *")
public void authorizeEveryHour() {
this.authorizedClientManager.authorize(DEFAULT_AUTHORIZE_REQUEST).subscribe();
}
}
You will likely need to fine tune the #Scheduled interval and clock skew to get it more accurate based on your setup.