If your JWT token provider is OAuth 2.0 compliant, you can configure the OAuth2FeignRequestInterceptor, with an OAuth2ProtectedResourceDetails object. This object is the base class for all OAuth 2.0 grant type information. In your case, I recommend using ResourceOwnerPasswordResourceDetails instead. This will allow you to configure an interceptor using a username and password.

@Configuration
public class OAuth2RequestInterceptorConfiguration {

    @Bean
    public OAuth2FeignRequestInterceptor requestInterceptor() {
        OAuth2ClientContext clientContext = new DefaultOAuth2ClientContext();
        OAuth2ProtectedResourceDetails resourceDetails =
            new ResourceOwnerPasswordResourceDetails();
        resourceDetails.setUsername("username");
        resourceDetails.setPassword("password");
        return new OAuth2FeignRequestInterceptor(clientContext, resourceDetails);
    }
}

For other cases, you will need to create your own RequestInterceptor

public class MyRequestInterceptor implements RequestInterceptor {

    private String jwt;
    private LocalDateTime expirationDate;

    @Override
    public void apply(RequestTemplate requestTemplate) {
        /* validate and refresh your token, this sample is not thread safe */
        if (LocalDateTime.now().isAfter(expirationDate)) {
            requestToken();
        }

        /* use the token */
        requestTemplate.header("Authorization: Bearer " + this.jwt);
    }
}

Edit

@FeignClient is now in maintenance mode, replaced by RestClient and HttpServiceProxyFactory. See below.

Authorizing @FeignClient requests

Use a RequestInterceptor to automatically add the authorization header.

With OAuth2, two strategies:

• use the token already in the security context, but this requires that the following two conditions are met:
  1. the application sending the REST call is an oauth2ResourceServer - not an app configured with oauth2Login, the security of which is based on session cookies, not on Bearer tokens
  2. the request is sent on behalf of the resource owner of the "parent" request
• configure the calling application as an OAuth2 client (additionally to OAuth2 resource server if it is a REST API with requests authorized with Bearer tokens) and use the OAuth2AuthorizedClientManager to get a new token

In Spring Boot apps, request interceptors decorated with @Component in the same package or any sub-package of the @Configuration with @EnableFeignClients are auto-detected: no need for explicit conf.

@FeignClient reusing the access token in the security context of an oauth2ResourceServer application

@Component
public class ForwardingBearerRequestInterceptor implements RequestInterceptor {

    @Override
    public void apply(RequestTemplate template) {
        final var auth = SecurityContextHolder.getContext().getAuthentication();
        if (auth instanceof JwtAuthenticationToken jwtAuth) {
            template.header(HttpHeaders.AUTHORIZATION, "Bearer %s".formatted(jwtAuth.getToken().getTokenValue()));
        }
    }
}

@FeignClient getting a new access token using an OAuth2 client registration

This applies in two scenarios:

• the calling application is configured with oauth2Login. As a reminder, such applications are OAuth2 clients and the request they receive are authorized with session cookies. So there is no access token to forward in the security context. Tokens are in session and we access them using the OAuth2AuthorizedClientManager.
• the calling application is configured with oauth2ResourceServer, but we need to use another client registration than the one used to get the token authorizing the incoming request. This happens for instance when the calling service uses the same client credentials, whoever sent the original request.

@Component
@RequiredArgsConstructor
public class OAuth2RegistrationRequestInterceptor implements RequestInterceptor {
    private final OAuth2AuthorizedClientManager authorizedClientManager;

    @Override
    public void apply(RequestTemplate template) {
        final var auth = SecurityContextHolder.getContext().getAuthentication();
        OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("some-registration-id").principal(auth).build();
        final var authorizedClient = Optional.ofNullable(authorizedClientManager.authorize(authorizeRequest));
        authorizedClient.ifPresent(ac -> template.header(HttpHeaders.AUTHORIZATION, "Bearer %s".formatted(ac.getAccessToken().getTokenValue())));
    }
}

Using RestClient and HttpServiceProxyFactory

Spring Cloud put @FeignClient in maintenance mode when Spring Core introduced the HttpServiceProxyFactory for RestClient and WebClient, which serves the same purpose for declarative REST clients.

Configuration for OAuth2 authorization is a little more verbose. For this reason, I created a tiny Boot starter for it. Sample usage:

Provided that we have the following @HttpExchange describing the REST service to consume (I have those generated from OpenAPI specs):

@HttpExchange(accept = MediaType.APPLICATION_JSON_VALUE)
public interface KeycloakAdminApi {

    @GetExchange(url = "/{realm}/users/count")
    Long getTotalUsersCount(@PathVariable(name = "realm") String realm);
}

We can have the implementation generated to consume the remote REST service with the following:

@Bean
KeycloakAdminApi keycloakAdminApi(SpringAddonsRestClientSupport restSupport) {
    return restSupport.service("keycloak-admin-api", KeycloakAdminApi.class);
}

The configuration for the endpoint base-URL, authorization (Basic or OAuth2), and optionally for HTTP proxy, is done in application properties:

com:
  c4-soft:
      rest:
        client:
          keycloak-admin-api:
            base-url: ${keycloak-base-uri}/admin/realms
            authorization:
              oauth2:
                forward-bearer: true

The above re-uses the incoming Bearer token on an oauth2ResourceServer. See the doc for using a new token issued for any registration.

It is published on maven-central:

<dependency>
    <groupId>com.c4-soft.springaddons</groupId>
    <artifactId>spring-addons-starter-rest</artifactId>
    <version>7.8.10</version>
</dependency>

Thanks to this comment, I managed to tidy up my implementation a little bit. So no more need for specifying encode/decoder nonsense, or having to manually build my Feign client.

The docs here provide some info, but as is typical they are a bit thin on concrete examples, so perhaps the below will help someone else. Note: I'm using spring boot, and including feign like so in build.gradle implementation 'org.springframework.cloud:spring-cloud-starter-openfeign'

First, create the RequestInterceptor like so:

import org.springframework.context.annotation.Bean;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.oauth2.jwt.Jwt;

import feign.RequestInterceptor;
import lombok.extern.slf4j.Slf4j;

/**
 * A Feign configuration to add the incoming Bearer token to an outgoing feign client request.
 * Only annotate this class with "@Configuration" if you want this interceptor to apply globally to all your Feign clients.
 * Otherwise you risk exposing the auth token to a third party, or adding it unnecessarily to requests that don't need it.
 */
@Slf4j
public class BearerAuthFeignConfig {

    @Bean
    public RequestInterceptor bearerAuthRequestInterceptor() {
        return requestTemplate -> {
            Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
            if (authentication != null && authentication.getPrincipal() instanceof Jwt) {
                Jwt jwt = (Jwt) authentication.getPrincipal();
                requestTemplate.header("Authorization", "Bearer " + jwt.getTokenValue());
            } else {
                log.error("Unable to add Authoriation header to Feign requestTemplate");
            }
        };
    }
}

Then when declaring your feign client, pass the configuration

@FeignClient(
    name = "my-client-that-needs-the-auth",
    configuration = BearerAuthFeignConfig.class,
    url = "http://whatever.com"
)
public interface PlayerManagementClient {
  ...

You'll also need the @EnableFeignClients annotation on your @SpringBootApplication class

You don't really need your own implementation of the FeignRequestInterceptor as there is already BasicAuthRequestInterceptor in the feign.auth package that does exactly the same.

That being said, you basically have almost everything set up already. All is left to do is to define the basicAuthRequestInterceptor bean with specific username and password:

@Bean
public RequestInterceptor basicAuthRequestInterceptor() {
    return new BasicAuthRequestInterceptor("username", "password");
}

Feign doesn't use a RestTemplate so you'd have to find a different way. If you create a @Bean of type feign.RequestInterceptor it will be applied to all requests, so maybe one of those with an OAuth2RestTemplate in it (just to manage the token acquisition) would be the best option.

According documentation need use AuthorizedClientServiceOAuth2AuthorizedClientManager instead of DefaultOAuth2AuthorizedClientManager

When operating outside of the context of a HttpServletRequest, use AuthorizedClientServiceOAuth2AuthorizedClientManager instead.

To collect the token with Feign you need the following:

import java.util.Map;
import feign.codec.Encoder;
import feign.form.spring.SpringFormEncoder;

import org.springframework.beans.factory.ObjectFactory;
import org.springframework.boot.autoconfigure.http.HttpMessageConverters;
import org.springframework.cloud.netflix.feign.FeignClient;
import org.springframework.cloud.netflix.feign.support.SpringEncoder;
import org.springframework.context.annotation.Bean;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import static org.springframework.http.MediaType.APPLICATION_FORM_URLENCODED_VALUE;

@FeignClient(name = "oauth2", url = "https://dev-XXXXXX.okta.com/oauth2/default/v1")
public interface TokenFetcher {

    @PostMapping(value = "/token", consumes = APPLICATION_FORM_URLENCODED_VALUE)
    String token(@RequestBody Map<String, ?> form);

    class Configuration {
        @Bean
        Encoder feignFormEncoder(ObjectFactory<HttpMessageConverters> converters) {
            return new SpringFormEncoder(new SpringEncoder(converters));
        }
    }
}

Use the client like this:

@Autowired
TokenFetcher tokenFetcher;

public void test() {
    Map<String, Object> form = new HashMap<>();
    form.put("client_id", "xxxxxx");
    form.put("client_secret", "xxxxxx");
    form.put("grant_type", "client_credentials");
    String jwt = tokenFetcher.token(form);
}

Dependencies are:

<dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-starter-feign</artifactId>
    <version>1.4.7.RELEASE</version>
</dependency>
<dependency>
    <groupId>io.github.openfeign.form</groupId>
    <artifactId>feign-form-spring</artifactId>
    <version>3.8.0</version>
</dependency>
<dependency>
    <groupId>org.springframework</groupId>
    <artifactId>spring-web</artifactId>
</dependency>

In order to use the token you must to add it token as the 'authorization' header with a prefix of 'Bearer ' (note the space) on each call. The easiest way to do this is be adding a RequestInterceptor to your FeignClient as follows:

public class FeignConfiguration {

@Bean
public RequestInterceptor requestInterceptor() {
    @Override
    public void apply(RequestTemplate requestTemplate) {
        String jwtTokenStoredSomewhere = null;
        if (requestTemplate.request().url().startsWith("https://site1")) {
            jwtTokenStoredSomewhere = site1JwtTokenStoredSomewhere;
        } else if (requestTemplate.request().url().startsWith("https://site2")) {
            jwtTokenStoredSomewhere = site2JwtTokenStoredSomewhere;
        } else {
            jwtTokenStoredSomewhere = site3JwtTokenStoredSomewhere;
        }
        requestTemplate.header("Authorization", "Bearer " + jwtTokenStoredSomewhere);
    }
}

}