BFF configuration token is not refreshed about spring-addons

[ch4mpy]

@glennvdv thanks for reaching out with your detailed dependencies and configuration.

Configuring a refresh-token client manager is a default not only for spring-cloud-gateway auto-configuration: spring-boot-starter-oauth2-client does it and it was intended that PerRegistrationReactiveOAuth2AuthorizedClientProvider does it too (but it was poorly implemented).

So yes, this is a bug and I think I spotted it: around line 50, the new RefreshTokenReactiveOAuth2AuthorizedClientProvider() should be added at the same time the authorization-code one is added (at least if offline_access scope is present).

Maybe, all the providers should be added in case some new client registrations are added at runtime. Let's say we have only client-credentials registrations at configuration time and add registrations with authorization-code after the app started. With current logic, the client-providers for authorization-code and refresh-token won't be registered and things will go very bad.

Will fix soon (probably within the next 24h).

[ch4mpy]

@glennvdv This should be fixed in 7.5.3 which is available from maven central already.

Would you please confirm and close?

[glennvdv]

fix confirmed