According documentation need use AuthorizedClientServiceOAuth2AuthorizedClientManager instead of DefaultOAuth2AuthorizedClientManager

When operating outside of the context of a HttpServletRequest, use AuthorizedClientServiceOAuth2AuthorizedClientManager instead.

If your JWT token provider is OAuth 2.0 compliant, you can configure the OAuth2FeignRequestInterceptor, with an OAuth2ProtectedResourceDetails object. This object is the base class for all OAuth 2.0 grant type information. In your case, I recommend using ResourceOwnerPasswordResourceDetails instead. This will allow you to configure an interceptor using a username and password.

@Configuration
public class OAuth2RequestInterceptorConfiguration {

    @Bean
    public OAuth2FeignRequestInterceptor requestInterceptor() {
        OAuth2ClientContext clientContext = new DefaultOAuth2ClientContext();
        OAuth2ProtectedResourceDetails resourceDetails =
            new ResourceOwnerPasswordResourceDetails();
        resourceDetails.setUsername("username");
        resourceDetails.setPassword("password");
        return new OAuth2FeignRequestInterceptor(clientContext, resourceDetails);
    }
}

For other cases, you will need to create your own RequestInterceptor

public class MyRequestInterceptor implements RequestInterceptor {

    private String jwt;
    private LocalDateTime expirationDate;

    @Override
    public void apply(RequestTemplate requestTemplate) {
        /* validate and refresh your token, this sample is not thread safe */
        if (LocalDateTime.now().isAfter(expirationDate)) {
            requestToken();
        }

        /* use the token */
        requestTemplate.header("Authorization: Bearer " + this.jwt);
    }
}

Edit

@FeignClient is now in maintenance mode, replaced by RestClient and HttpServiceProxyFactory. See below.

Authorizing @FeignClient requests

Use a RequestInterceptor to automatically add the authorization header.

With OAuth2, two strategies:

• use the token already in the security context, but this requires that the following two conditions are met:
  1. the application sending the REST call is an oauth2ResourceServer - not an app configured with oauth2Login, the security of which is based on session cookies, not on Bearer tokens
  2. the request is sent on behalf of the resource owner of the "parent" request
• configure the calling application as an OAuth2 client (additionally to OAuth2 resource server if it is a REST API with requests authorized with Bearer tokens) and use the OAuth2AuthorizedClientManager to get a new token

In Spring Boot apps, request interceptors decorated with @Component in the same package or any sub-package of the @Configuration with @EnableFeignClients are auto-detected: no need for explicit conf.

@FeignClient reusing the access token in the security context of an oauth2ResourceServer application

@Component
public class ForwardingBearerRequestInterceptor implements RequestInterceptor {

    @Override
    public void apply(RequestTemplate template) {
        final var auth = SecurityContextHolder.getContext().getAuthentication();
        if (auth instanceof JwtAuthenticationToken jwtAuth) {
            template.header(HttpHeaders.AUTHORIZATION, "Bearer %s".formatted(jwtAuth.getToken().getTokenValue()));
        }
    }
}

@FeignClient getting a new access token using an OAuth2 client registration

This applies in two scenarios:

• the calling application is configured with oauth2Login. As a reminder, such applications are OAuth2 clients and the request they receive are authorized with session cookies. So there is no access token to forward in the security context. Tokens are in session and we access them using the OAuth2AuthorizedClientManager.
• the calling application is configured with oauth2ResourceServer, but we need to use another client registration than the one used to get the token authorizing the incoming request. This happens for instance when the calling service uses the same client credentials, whoever sent the original request.

@Component
@RequiredArgsConstructor
public class OAuth2RegistrationRequestInterceptor implements RequestInterceptor {
    private final OAuth2AuthorizedClientManager authorizedClientManager;

    @Override
    public void apply(RequestTemplate template) {
        final var auth = SecurityContextHolder.getContext().getAuthentication();
        OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("some-registration-id").principal(auth).build();
        final var authorizedClient = Optional.ofNullable(authorizedClientManager.authorize(authorizeRequest));
        authorizedClient.ifPresent(ac -> template.header(HttpHeaders.AUTHORIZATION, "Bearer %s".formatted(ac.getAccessToken().getTokenValue())));
    }
}

Using RestClient and HttpServiceProxyFactory

Spring Cloud put @FeignClient in maintenance mode when Spring Core introduced the HttpServiceProxyFactory for RestClient and WebClient, which serves the same purpose for declarative REST clients.

Configuration for OAuth2 authorization is a little more verbose. For this reason, I created a tiny Boot starter for it. Sample usage:

Provided that we have the following @HttpExchange describing the REST service to consume (I have those generated from OpenAPI specs):

@HttpExchange(accept = MediaType.APPLICATION_JSON_VALUE)
public interface KeycloakAdminApi {

    @GetExchange(url = "/{realm}/users/count")
    Long getTotalUsersCount(@PathVariable(name = "realm") String realm);
}

We can have the implementation generated to consume the remote REST service with the following:

@Bean
KeycloakAdminApi keycloakAdminApi(SpringAddonsRestClientSupport restSupport) {
    return restSupport.service("keycloak-admin-api", KeycloakAdminApi.class);
}

The configuration for the endpoint base-URL, authorization (Basic or OAuth2), and optionally for HTTP proxy, is done in application properties:

com:
  c4-soft:
      rest:
        client:
          keycloak-admin-api:
            base-url: ${keycloak-base-uri}/admin/realms
            authorization:
              oauth2:
                forward-bearer: true

The above re-uses the incoming Bearer token on an oauth2ResourceServer. See the doc for using a new token issued for any registration.

It is published on maven-central:

<dependency>
    <groupId>com.c4-soft.springaddons</groupId>
    <artifactId>spring-addons-starter-rest</artifactId>
    <version>7.8.10</version>
</dependency>