What is the difference between DefaultOAuth2AuthorizedClientManager and AuthorizedClientServiceOAuth2AuthorizedClientManager

user_5981797 0
Viewed 542

Looking at the documentation, the only recommendation I found is

The DefaultOAuth2AuthorizedClientManager is designed to be used within the context of a HttpServletRequest. When operating outside of a HttpServletRequest context, use AuthorizedClientServiceOAuth2AuthorizedClientManager instead.

I could test that WebClient calls hang using the DefaultOAuth2AuthorizedClientManager outside the scope of a servlet request, however, nothing weird happens if I use AuthorizedClientServiceOAuth2AuthorizedClientManager inside the context of a servlet request. Then, what's the difference between the two of them?

spring-security-oauth2 spring-boot spring-security
1 Answers

The main difference as you noted from the docs is where they would be used. This may be less obvious from the outside looking in, but would be more obvious inside the framework. But perhaps an easier way to explain why they're different is to look at what they encapsulate.

  • DefaultOAuth2AuthorizedClientManager uses a OAuth2AuthorizedClientRepository
    • which has a method signature of loadAuthorizedClient(String clientRegistrationId, Authentication principal, HttpServletRequest request)
  • AuthorizedClientServiceOAuth2AuthorizedClientManager uses a OAuth2AuthorizedClientService
    • which has a method signature of loadAuthorizedClient(String clientRegistrationId, String principalName)

So DefaultOAuth2AuthorizedClientManager is what I guess you'd call "request based" and AuthorizedClientServiceOAuth2AuthorizedClientManager is "service based", which really just means everything else.

The API docs will be helpful here:

Update:

What would be the added value to have the request as a parameter?

As an interface, declaring that the loadAuthorizedClient method accepts the request as a parameter means any future implementation can use the request to influence its decision. The default implementation (DefaultOAuth2AuthorizedClientManager) does this, since the HttpSessionOAuth2AuthorizedClientRepository utilizes the request to access the session.

user_158350390
Related