Spring Reactive OAuth2: Proxy client_credentials Token Requests

A proxied resource WebClient can still fail before its API call if token acquisition uses another connector. For Spring Security 6.5's reactive client-credentials flow, connect all three pieces:

HttpClient route = HttpClient.create()
    .proxy(p -> p.type(ProxyProvider.Proxy.HTTP)
        .host("proxy.example").port(8080));
WebClient tokenHttp = WebClient.builder()
    .clientConnector(new ReactorClientHttpConnector(route))
    .build();

var tokens = new WebClientReactiveClientCredentialsTokenResponseClient();
tokens.setWebClient(tokenHttp);

var provider = new ClientCredentialsReactiveOAuth2AuthorizedClientProvider();
provider.setAccessTokenResponseClient(tokens);

var manager = new AuthorizedClientServiceReactiveOAuth2AuthorizedClientManager(
    registrations, authorizedClients);
manager.setAuthorizedClientProvider(provider);

tokens.setWebClient assigns the token HTTP client; provider.setAccessTokenResponseClient assigns it to the grant provider; manager.setAuthorizedClientProvider installs that provider. Use this manager in the actual OAuth filter or authorized-client workflow.

HttpClient and ProxyProvider are Reactor Netty types. WebClient and its connector are Spring WebFlux types. Supply the existing ReactiveClientRegistrationRepository as registrations and ReactiveOAuth2AuthorizedClientService as authorizedClients.

This provider handles client_credentials; preserve a suitable provider chain if other grants are required. The example has no proxy account, which would belong to the transport rather than the OAuth client ID/secret. For a public token endpoint allowed through a public intermediary, select host and port candidates from the HTTP proxy list.

Configure the protected-resource connector too when those API requests need the route. Token and API success are separate outcomes.