title: Feign and Spring Security 5 - Client Credentials
body: <p>I am trying to invoke some backend system which is secured by a client_credentials grant type from a Feign client application.</p>
  <p>The access token from the backend system can be retrieved with the following curl structure (just as an example):</p>
  <pre><code>curl --location --request POST '[SERVER URL]/oauth/grant' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --header 'Cookie: WebSessionID=172.22.72.1.1558614080219404; b8d49fdc74b7190aacd4ac9b22e85db8=2f0e4c4dbf6d4269fd3349f61c151223' \
  --data-raw 'grant_type=client_credentials' \
  --data-raw 'client_id=[CLIENT_ID]' \
  --data-raw 'client_secret=[CLIENT_SECRET]'
  
  {&quot;accessToken&quot;:&quot;V29C90D1917528E9C29795EF52EC2462D091F9DC106FAFD829D0FA537B78147E20&quot;,&quot;tokenType&quot;:&quot;Bearer&quot;,&quot;expiresSeconds&quot;:7200}
  </code></pre>
  <p>This accessToken should then be set in a header to subsequent business calls to the backend system.</p>
  <p>So now my question is, how to implement this using Feign and Spring Boot Security 5.
  After some research I come to this solution (which doesn't work):</p>
  <ol>
  <li>Define my client in the application.yml:</li>
  </ol>
  <pre><code>spring:
    security:
      oauth2:
        client:
          registration:
            backend:
              client-id:[CLIENT_ID]
              client-secret: [CLIENT_SECRET]
              authorization-grant-type: client_credentials
      
          provider:
            backend:
              token-uri: [SERVER URL]/oauth/grant
  </code></pre>
  <ol start="2">
  <li>Create a OAuth2AuthorizedClientManager Bean to be able to authorize (or re-authorize) an OAuth 2.0 client:</li>
  </ol>
  <pre class="lang-java prettyprint-override"><code>@Bean
  public OAuth2AuthorizedClientManager authorizedClientManager(
          ClientRegistrationRepository clientRegistrationRepository,
          OAuth2AuthorizedClientRepository authorizedClientRepository) {
  
      DefaultOAuth2AuthorizedClientManager authorizedClientManager =
              new DefaultOAuth2AuthorizedClientManager(
                      clientRegistrationRepository, authorizedClientRepository);
  
      return authorizedClientManager;
  }
  </code></pre>
  <ol start="3">
  <li>Create a Feign Request Interceptor that uses the OAuth2AuthorizedClientManager:</li>
  </ol>
  <pre class="lang-java prettyprint-override"><code>public class OAuthRequestInterceptor implements RequestInterceptor {
  
      private OAuth2AuthorizedClientManager manager;
  
      public OAuthRequestInterceptor(OAuth2AuthorizedClientManager manager) {
          this.manager = manager;
      }
  
      @Override
      public void apply(RequestTemplate requestTemplate) {
          OAuth2AuthorizedClient client = this.manager.authorize(OAuth2AuthorizeRequest.withClientRegistrationId(&quot;backend&quot;).principal(createPrincipal()).build());
          String accessToken = client.getAccessToken().getTokenValue();
          requestTemplate.header(HttpHeaders.AUTHORIZATION, &quot;Bearer&quot; + accessToken);
      }
  
      private Authentication createPrincipal() {
          return new Authentication() {
              @Override
              public Collection&lt;? extends GrantedAuthority&gt; getAuthorities() {
                  return Collections.emptySet();
              }
  
              @Override
              public Object getCredentials() {
                  return null;
              }
  
              @Override
              public Object getDetails() {
                  return null;
              }
  
              @Override
              public Object getPrincipal() {
                  return this;
              }
  
              @Override
              public boolean isAuthenticated() {
                  return false;
              }
  
              @Override
              public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException {
              }
  
              @Override
              public String getName() {
                  return &quot;backend&quot;;
              }
          };
      }
  }
  </code></pre>
  <ol start="3">
  <li>Create a FeignConfig that uses the Interceptor:</li>
  </ol>
  <pre class="lang-java prettyprint-override"><code>public class FeignClientConfig {
  
  
      @Bean
      public OAuthRequestInterceptor repositoryClientOAuth2Interceptor(OAuth2AuthorizedClientManager manager) {
          return new OAuthRequestInterceptor(manager);
      }
  }
  </code></pre>
  <ol start="4">
  <li>And this is my Feign client:</li>
  </ol>
  <pre class="lang-java prettyprint-override"><code>@FeignClient(name = &quot;BackendRepository&quot;, configuration = FeignClientConfig.class, url = &quot;${BACKEND_URL}&quot;)
  public interface BackendRepository {
  
      @GetMapping(path = &quot;/healthChecks&quot;, produces = MediaType.APPLICATION_JSON_VALUE)
      public Info healthCheck();
  }
  </code></pre>
  <p>When running this code, I get the error:</p>
  <pre><code>org.springframework.web.client.UnknownContentTypeException: Could not extract response: no suitable HttpMessageConverter found for response type [class org.springframework.security.oauth2.core.endpoint.OAuth2AccessTokenResponse] and content type [text/html;charset=utf-8]
  </code></pre>
  <p>Debugging the code it looks like the DefaultClientCredentialsTokenResponseClient is requesting the auth endpoint using Basic Authentication. Although I never set this up.</p>
  <p>Any advise what I can do? Maybe there is a completely different approach to do this.</p>