一次排查springboot-oauth2与配置中心不兼容问题

问题描述

1.当应用引入spring-security-oauth2-autoconfigure依赖,并把security.oauth2.client.client-id配置到配置中心,比如nacos或apollo等组件
2.启动应用时,oauth2特性无法使用例如统一登录等接口完全失效,无法登陆,而把clientid配置到本地的properties中时,oauth2正常

问题排查

1.首先我们来看一下oauth2-autoconfigure的自动装配类都干了什么

# Auto Configure
org.springframework.boot.autoconfigure.EnableAutoConfiguration=\
org.springframework.boot.autoconfigure.security.oauth2.OAuth2AutoConfiguration

首先我们找到他的OAuth2AutoConfiguration类

@Configuration
@ConditionalOnClass({
   OAuth2AccessToken.class, WebMvcConfigurer.class})
@Import({
   OAuth2AuthorizationServerConfiguration.class, OAuth2MethodSecurityConfiguration.class, OAuth2ResourceServerConfiguration.class, OAuth2RestOperationsConfiguration.class})
@AutoConfigureBefore({
   WebMvcAutoConfiguration.class})
@EnableConfigurationProperties({
   OAuth2ClientProperties.class})
public class OAuth2AutoConfiguration {
   
    private final OAuth2ClientProperties credentials;

    public OAuth2AutoConfiguration(OAuth2ClientProperties credentials) {
   
        this.credentials = credentials;
    }

    @Bean
    public ResourceServerProperties resourceServerProperties() {
   
        return new ResourceServerProperties(this.credentials.getClientId(), this.credentials.getClientSecret());
    }
}

可以发现他加载了
OAuth2AuthorizationServerConfiguration.class, OAuth2MethodSecurityConfiguration.class, OAuth2ResourceServerConfiguration.class, OAuth2RestOperationsConfiguration.class
以及他自身共五个configuration类
看起来似乎是因为@AutoConfigureBefore({WebMvcAutoConfiguration.class}),他在webmvcautoconfiguration之前就进行加载,而我的配置中心client端并没有强行before在某个装配类上

@ConditionalOnProperty(prefix = Properties.PREFIX, name = "enabled", havingValue = "true", matchIfMissing = true)
public class ClientAutoConfiguration {
   

    @Bean
    @ConditionalOnMissingBean(ListenerScanner.class)
    public ListenerScanner listenerScanner(Properties properties) {
   
        return new ListenerScanner(properties);
    }

    @Bean
    @ConditionalOnMissingBean(propertiesLoaderSupport.class)