Restructure OAuth2 client auto-configuration

Previously, OAuth2 client auto-configuration was managed by a single
class:

- OAuth2ClientAutoConfiguration for servlet apps
- ReactiveOAuth2ClientAutoConfiguration for reactive apps

OAuth2ClientAutoConfiguration being for servlet apps meant that
a blocking OAuth2 client was not availabile in a non-web application.

The auto-configuration classes did two things:

- Auto-configured beans that are specific to server-side web security
  that uses an OAuth2 client
- Auto-configured OAuth2 client beans that may be used client- or
  server-side

Combining these two things into a single auto-configuration class
meant that you could not choose to use one or the other. For example,
you may want to make use of an OAuth2 client in a web application
without also using OAuth2 client-based web security.

This commit restructures the auto-configuration to address these
problems. There are now two auto-configurations for non-reactive apps:

- OAuth2ClientAutoConfiguration
- OAuth2ClientWebSecurityAutoConfiguration

and two auto-configurations for reactive apps:

- ReactiveOAuth2ClientAutoConfiguration
- ReactiveOAuth2ClientWebSecurityAutoConfiguration

This separation allows one to be used without the other. Furthermore,
the conditions have been updated so that, for example, the blocking
OAuth2 client is available in a non-web application.

Closes gh-40997
Closes gh-44906

Co-authored-by: Moritz Halbritter <moritz.halbritter@broadcom.com>

spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/client/reactive/ReactiveOAuth2ClientAutoConfigurationTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2025 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,8 +17,6 @@
 package org.springframework.boot.autoconfigure.security.oauth2.client.reactive;
 
 import java.time.Duration;
-import java.util.ArrayList;
-import java.util.List;
 
 import org.junit.jupiter.api.Test;
 import reactor.core.publisher.Flux;
@@ -26,34 +24,16 @@ import reactor.core.publisher.Flux;
 import org.springframework.boot.autoconfigure.AutoConfigurations;
 import org.springframework.boot.autoconfigure.security.reactive.ReactiveSecurityAutoConfiguration;
 import org.springframework.boot.test.context.FilteredClassLoader;
-import org.springframework.boot.test.context.assertj.AssertableReactiveWebApplicationContext;
 import org.springframework.boot.test.context.runner.ApplicationContextRunner;
-import org.springframework.boot.test.context.runner.ReactiveWebApplicationContextRunner;
 import org.springframework.boot.test.context.runner.WebApplicationContextRunner;
-import org.springframework.context.ApplicationContext;
-import org.springframework.context.ApplicationContextAware;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.context.annotation.Import;
-import org.springframework.security.config.BeanIds;
-import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
-import org.springframework.security.config.web.server.ServerHttpSecurity;
-import org.springframework.security.oauth2.client.InMemoryReactiveOAuth2AuthorizedClientService;
 import org.springframework.security.oauth2.client.ReactiveOAuth2AuthorizedClientService;
 import org.springframework.security.oauth2.client.registration.ClientRegistration;
-import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
 import org.springframework.security.oauth2.client.registration.InMemoryReactiveClientRegistrationRepository;
 import org.springframework.security.oauth2.client.registration.ReactiveClientRegistrationRepository;
-import org.springframework.security.oauth2.client.web.server.AuthenticatedPrincipalServerOAuth2AuthorizedClientRepository;
-import org.springframework.security.oauth2.client.web.server.OAuth2AuthorizationCodeGrantWebFilter;
-import org.springframework.security.oauth2.client.web.server.ServerOAuth2AuthorizedClientRepository;
-import org.springframework.security.oauth2.client.web.server.authentication.OAuth2LoginAuthenticationWebFilter;
 import org.springframework.security.oauth2.core.AuthorizationGrantType;
-import org.springframework.security.web.server.SecurityWebFilterChain;
-import org.springframework.test.util.ReflectionTestUtils;
-import org.springframework.web.server.WebFilter;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.mock;
 
 /**
  * Tests for {@link ReactiveOAuth2ClientAutoConfiguration}.
@@ -62,12 +42,12 @@ import static org.assertj.core.api.Assertions.assertThat;
  */
 class ReactiveOAuth2ClientAutoConfigurationTests {
 
+	private static final String REGISTRATION_PREFIX = "spring.security.oauth2.client.registration";
+
 	private final ApplicationContextRunner contextRunner = new ApplicationContextRunner()
 		.withConfiguration(AutoConfigurations.of(ReactiveOAuth2ClientAutoConfiguration.class,
 				ReactiveSecurityAutoConfiguration.class));
 
-	private static final String REGISTRATION_PREFIX = "spring.security.oauth2.client.registration";
-
 	@Test
 	void autoConfigurationShouldBackOffForServletEnvironments() {
 		new WebApplicationContextRunner()
@@ -76,16 +56,20 @@ class ReactiveOAuth2ClientAutoConfigurationTests {
 	}
 
 	@Test
-	void clientRegistrationRepositoryBeanShouldNotBeCreatedWhenPropertiesAbsent() {
-		this.contextRunner.run((context) -> assertThat(context).doesNotHaveBean(ClientRegistrationRepository.class));
+	void beansShouldNotBeCreatedWhenPropertiesAbsent() {
+		this.contextRunner
+			.run((context) -> assertThat(context).doesNotHaveBean(ReactiveClientRegistrationRepository.class)
+				.doesNotHaveBean(ReactiveOAuth2AuthorizedClientService.class));
 	}
 
 	@Test
-	void clientRegistrationRepositoryBeanShouldBeCreatedWhenPropertiesPresent() {
+	void beansAreCreatedWhenPropertiesPresent() {
 		this.contextRunner
 			.withPropertyValues(REGISTRATION_PREFIX + ".foo.client-id=abcd",
 					REGISTRATION_PREFIX + ".foo.client-secret=secret", REGISTRATION_PREFIX + ".foo.provider=github")
 			.run((context) -> {
+				assertThat(context).hasSingleBean(ReactiveClientRegistrationRepository.class);
+				assertThat(context).hasSingleBean(ReactiveOAuth2AuthorizedClientService.class);
 				ReactiveClientRegistrationRepository repository = context
 					.getBean(ReactiveClientRegistrationRepository.class);
 				ClientRegistration registration = repository.findByRegistrationId("foo").block(Duration.ofSeconds(30));
@@ -95,24 +79,10 @@ class ReactiveOAuth2ClientAutoConfigurationTests {
 	}
 
 	@Test
-	void authorizedClientServiceAndRepositoryBeansAreConditionalOnClientRegistrationRepository() {
-		this.contextRunner.run((context) -> {
-			assertThat(context).doesNotHaveBean(ReactiveOAuth2AuthorizedClientService.class);
-			assertThat(context).doesNotHaveBean(ServerOAuth2AuthorizedClientRepository.class);
-		});
-	}
-
-	@Test
-	void configurationRegistersAuthorizedClientServiceAndRepositoryBeans() {
-		this.contextRunner.withUserConfiguration(ReactiveClientRepositoryConfiguration.class).run((context) -> {
-			assertThat(context).hasSingleBean(InMemoryReactiveOAuth2AuthorizedClientService.class);
-			assertThat(context).hasSingleBean(AuthenticatedPrincipalServerOAuth2AuthorizedClientRepository.class);
-		});
-	}
-
-	@Test
-	void authorizedClientServiceBeanIsConditionalOnMissingBean() {
-		this.contextRunner.withUserConfiguration(ReactiveOAuth2AuthorizedClientRepositoryConfiguration.class)
+	void clientServiceBeanIsConditionalOnMissingBean() {
+		this.contextRunner
+			.withBean("testAuthorizedClientService", ReactiveOAuth2AuthorizedClientService.class,
+					() -> mock(ReactiveOAuth2AuthorizedClientService.class))
 			.run((context) -> {
 				assertThat(context).hasSingleBean(ReactiveOAuth2AuthorizedClientService.class);
 				assertThat(context).hasBean("testAuthorizedClientService");
@@ -120,43 +90,11 @@ class ReactiveOAuth2ClientAutoConfigurationTests {
 	}
 
 	@Test
-	void authorizedClientRepositoryBeanIsConditionalOnAuthorizedClientService() {
+	void clientServiceBeanIsCreatedWithUserDefinedClientRegistrationRepository() {
 		this.contextRunner
-			.run((context) -> assertThat(context).doesNotHaveBean(ServerOAuth2AuthorizedClientRepository.class));
-	}
-
-	@Test
-	void configurationRegistersAuthorizedClientRepositoryBean() {
-		this.contextRunner.withUserConfiguration(ReactiveOAuth2AuthorizedClientServiceConfiguration.class)
-			.run((context) -> assertThat(context)
-				.hasSingleBean(AuthenticatedPrincipalServerOAuth2AuthorizedClientRepository.class));
-	}
-
-	@Test
-	void authorizedClientRepositoryBeanIsConditionalOnMissingBean() {
-		this.contextRunner.withUserConfiguration(ReactiveOAuth2AuthorizedClientRepositoryConfiguration.class)
-			.run((context) -> {
-				assertThat(context).hasSingleBean(ServerOAuth2AuthorizedClientRepository.class);
-				assertThat(context).hasBean("testAuthorizedClientRepository");
-			});
-	}
-
-	@Test
-	void securityWebFilterChainBeanConditionalOnWebApplication() {
-		this.contextRunner.withUserConfiguration(ReactiveOAuth2AuthorizedClientRepositoryConfiguration.class)
-			.run((context) -> assertThat(context).doesNotHaveBean(SecurityWebFilterChain.class));
-	}
-
-	@Test
-	void configurationRegistersSecurityWebFilterChainBean() { // gh-17949
-		new ReactiveWebApplicationContextRunner()
-			.withConfiguration(AutoConfigurations.of(ReactiveOAuth2ClientAutoConfiguration.class))
-			.withUserConfiguration(ReactiveOAuth2AuthorizedClientServiceConfiguration.class,
-					ServerHttpSecurityConfiguration.class)
-			.run((context) -> {
-				assertThat(hasFilter(context, OAuth2LoginAuthenticationWebFilter.class)).isTrue();
-				assertThat(hasFilter(context, OAuth2AuthorizationCodeGrantWebFilter.class)).isTrue();
-			});
+			.withBean(InMemoryReactiveClientRegistrationRepository.class,
+					() -> new InMemoryReactiveClientRegistrationRepository(getClientRegistration("test", "test")))
+			.run((context) -> assertThat(context).hasSingleBean(ReactiveOAuth2AuthorizedClientService.class));
 	}
 
 	@Test
@@ -164,11 +102,6 @@ class ReactiveOAuth2ClientAutoConfigurationTests {
 		assertWhenClassNotPresent(Flux.class);
 	}
 
-	@Test
-	void autoConfigurationConditionalOnClassEnableWebFluxSecurity() {
-		assertWhenClassNotPresent(EnableWebFluxSecurity.class);
-	}
-
 	@Test
 	void autoConfigurationConditionalOnClassClientRegistration() {
 		assertWhenClassNotPresent(ClientRegistration.class);
@@ -182,86 +115,21 @@ class ReactiveOAuth2ClientAutoConfigurationTests {
 			.run((context) -> assertThat(context).doesNotHaveBean(ReactiveOAuth2ClientAutoConfiguration.class));
 	}
 
-	@SuppressWarnings("unchecked")
-	private boolean hasFilter(AssertableReactiveWebApplicationContext context, Class<? extends WebFilter> filter) {
-		SecurityWebFilterChain filterChain = (SecurityWebFilterChain) context
-			.getBean(BeanIds.SPRING_SECURITY_FILTER_CHAIN);
-		List<WebFilter> filters = (List<WebFilter>) ReflectionTestUtils.getField(filterChain, "filters");
-		return filters.stream().anyMatch(filter::isInstance);
-	}
-
-	@Configuration(proxyBeanMethods = false)
-	static class ReactiveClientRepositoryConfiguration {
-
-		@Bean
-		ReactiveClientRegistrationRepository clientRegistrationRepository() {
-			List<ClientRegistration> registrations = new ArrayList<>();
-			registrations.add(getClientRegistration("first", "https://user-info-uri.com"));
-			registrations.add(getClientRegistration("second", "https://other-user-info"));
-			return new InMemoryReactiveClientRegistrationRepository(registrations);
-		}
-
-		private ClientRegistration getClientRegistration(String id, String userInfoUri) {
-			ClientRegistration.Builder builder = ClientRegistration.withRegistrationId(id);
-			builder.clientName("foo")
-				.clientId("foo")
-				.clientAuthenticationMethod(
-						org.springframework.security.oauth2.core.ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
-				.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
-				.scope("read")
-				.clientSecret("secret")
-				.redirectUri("https://redirect-uri.com")
-				.authorizationUri("https://authorization-uri.com")
-				.tokenUri("https://token-uri.com")
-				.userInfoUri(userInfoUri)
-				.userNameAttributeName("login");
-			return builder.build();
-		}
-
-	}
-
-	@Configuration(proxyBeanMethods = false)
-	@Import(ReactiveClientRepositoryConfiguration.class)
-	static class ReactiveOAuth2AuthorizedClientServiceConfiguration {
-
-		@Bean
-		ReactiveOAuth2AuthorizedClientService testAuthorizedClientService(
-				ReactiveClientRegistrationRepository clientRegistrationRepository) {
-			return new InMemoryReactiveOAuth2AuthorizedClientService(clientRegistrationRepository);
-		}
-
-	}
-
-	@Configuration(proxyBeanMethods = false)
-	@Import(ReactiveOAuth2AuthorizedClientServiceConfiguration.class)
-	static class ReactiveOAuth2AuthorizedClientRepositoryConfiguration {
-
-		@Bean
-		ServerOAuth2AuthorizedClientRepository testAuthorizedClientRepository(
-				ReactiveOAuth2AuthorizedClientService authorizedClientService) {
-			return new AuthenticatedPrincipalServerOAuth2AuthorizedClientRepository(authorizedClientService);
-		}
-
-	}
-
-	@Configuration(proxyBeanMethods = false)
-	static class ServerHttpSecurityConfiguration {
-
-		@Bean
-		ServerHttpSecurity http() {
-			TestServerHttpSecurity httpSecurity = new TestServerHttpSecurity();
-			return httpSecurity;
-		}
-
-		static class TestServerHttpSecurity extends ServerHttpSecurity implements ApplicationContextAware {
-
-			@Override
-			public void setApplicationContext(ApplicationContext applicationContext) {
-				super.setApplicationContext(applicationContext);
-			}
-
-		}
-
+	private ClientRegistration getClientRegistration(String id, String userInfoUri) {
+		ClientRegistration.Builder builder = ClientRegistration.withRegistrationId(id);
+		builder.clientName("foo")
+			.clientId("foo")
+			.clientAuthenticationMethod(
+					org.springframework.security.oauth2.core.ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
+			.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
+			.scope("read")
+			.clientSecret("secret")
+			.redirectUri("https://redirect-uri.com")
+			.authorizationUri("https://authorization-uri.com")
+			.tokenUri("https://token-uri.com")
+			.userInfoUri(userInfoUri)
+			.userNameAttributeName("login");
+		return builder.build();
 	}
 
 }

spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/client/reactive/ReactiveOAuth2ClientWebSecurityAutoConfigurationTests.java

@@ -0,0 +1,197 @@
+/*
+ * Copyright 2012-2025 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.boot.autoconfigure.security.oauth2.client.reactive;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.junit.jupiter.api.Test;
+
+import org.springframework.boot.autoconfigure.AutoConfigurations;
+import org.springframework.boot.autoconfigure.security.reactive.ReactiveSecurityAutoConfiguration;
+import org.springframework.boot.test.context.assertj.AssertableReactiveWebApplicationContext;
+import org.springframework.boot.test.context.runner.ApplicationContextRunner;
+import org.springframework.boot.test.context.runner.ReactiveWebApplicationContextRunner;
+import org.springframework.boot.test.context.runner.WebApplicationContextRunner;
+import org.springframework.context.ApplicationContext;
+import org.springframework.context.ApplicationContextAware;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Import;
+import org.springframework.security.config.BeanIds;
+import org.springframework.security.config.web.server.ServerHttpSecurity;
+import org.springframework.security.oauth2.client.InMemoryReactiveOAuth2AuthorizedClientService;
+import org.springframework.security.oauth2.client.ReactiveOAuth2AuthorizedClientService;
+import org.springframework.security.oauth2.client.registration.ClientRegistration;
+import org.springframework.security.oauth2.client.registration.InMemoryReactiveClientRegistrationRepository;
+import org.springframework.security.oauth2.client.registration.ReactiveClientRegistrationRepository;
+import org.springframework.security.oauth2.client.web.server.AuthenticatedPrincipalServerOAuth2AuthorizedClientRepository;
+import org.springframework.security.oauth2.client.web.server.OAuth2AuthorizationCodeGrantWebFilter;
+import org.springframework.security.oauth2.client.web.server.ServerOAuth2AuthorizedClientRepository;
+import org.springframework.security.oauth2.client.web.server.authentication.OAuth2LoginAuthenticationWebFilter;
+import org.springframework.security.oauth2.core.AuthorizationGrantType;
+import org.springframework.security.web.server.SecurityWebFilterChain;
+import org.springframework.test.util.ReflectionTestUtils;
+import org.springframework.web.server.WebFilter;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * Tests for {@link ReactiveOAuth2ClientWebSecurityAutoConfiguration}.
+ *
+ * @author Madhura Bhave
+ * @author Andy Wilkinson
+ */
+class ReactiveOAuth2ClientWebSecurityAutoConfigurationTests {
+
+	private final ReactiveWebApplicationContextRunner contextRunner = new ReactiveWebApplicationContextRunner()
+		.withConfiguration(AutoConfigurations.of(ReactiveOAuth2ClientWebSecurityAutoConfiguration.class,
+				ReactiveSecurityAutoConfiguration.class));
+
+	@Test
+	void autoConfigurationShouldBackOffForServletEnvironments() {
+		new WebApplicationContextRunner()
+			.withConfiguration(AutoConfigurations.of(ReactiveOAuth2ClientWebSecurityAutoConfiguration.class))
+			.run((context) -> assertThat(context)
+				.doesNotHaveBean(ReactiveOAuth2ClientWebSecurityAutoConfiguration.class));
+	}
+
+	@Test
+	void autoConfigurationIsConditionalOnAuthorizedClientService() {
+		this.contextRunner.run((context) -> assertThat(context)
+			.doesNotHaveBean(ReactiveOAuth2ClientWebSecurityAutoConfiguration.class));
+	}
+
+	@Test
+	void configurationRegistersAuthorizedClientRepositoryBean() {
+		this.contextRunner.withUserConfiguration(ReactiveOAuth2AuthorizedClientServiceConfiguration.class)
+			.run((context) -> assertThat(context)
+				.hasSingleBean(AuthenticatedPrincipalServerOAuth2AuthorizedClientRepository.class));
+	}
+
+	@Test
+	void authorizedClientRepositoryBeanIsConditionalOnMissingBean() {
+		this.contextRunner.withUserConfiguration(ReactiveOAuth2AuthorizedClientRepositoryConfiguration.class)
+			.run((context) -> {
+				assertThat(context).hasSingleBean(ServerOAuth2AuthorizedClientRepository.class);
+				assertThat(context).hasBean("testAuthorizedClientRepository");
+			});
+	}
+
+	@Test
+	void configurationRegistersSecurityWebFilterChainBean() { // gh-17949
+		this.contextRunner
+			.withUserConfiguration(ReactiveOAuth2AuthorizedClientServiceConfiguration.class,
+					ServerHttpSecurityConfiguration.class)
+			.run((context) -> {
+				assertThat(hasFilter(context, OAuth2LoginAuthenticationWebFilter.class)).isTrue();
+				assertThat(hasFilter(context, OAuth2AuthorizationCodeGrantWebFilter.class)).isTrue();
+			});
+	}
+
+	@Test
+	void securityWebFilterChainBeanConditionalOnWebApplication() {
+		new ApplicationContextRunner()
+			.withConfiguration(AutoConfigurations.of(ReactiveOAuth2ClientWebSecurityAutoConfiguration.class,
+					ReactiveSecurityAutoConfiguration.class))
+			.withUserConfiguration(ReactiveOAuth2AuthorizedClientRepositoryConfiguration.class)
+			.run((context) -> assertThat(context).doesNotHaveBean(SecurityWebFilterChain.class));
+	}
+
+	@SuppressWarnings("unchecked")
+	private boolean hasFilter(AssertableReactiveWebApplicationContext context, Class<? extends WebFilter> filter) {
+		SecurityWebFilterChain filterChain = (SecurityWebFilterChain) context
+			.getBean(BeanIds.SPRING_SECURITY_FILTER_CHAIN);
+		List<WebFilter> filters = (List<WebFilter>) ReflectionTestUtils.getField(filterChain, "filters");
+		return filters.stream().anyMatch(filter::isInstance);
+	}
+
+	@Configuration(proxyBeanMethods = false)
+	@Import(ReactiveClientRepositoryConfiguration.class)
+	static class ReactiveOAuth2AuthorizedClientServiceConfiguration {
+
+		@Bean
+		InMemoryReactiveOAuth2AuthorizedClientService testAuthorizedClientService(
+				ReactiveClientRegistrationRepository clientRegistrationRepository) {
+			return new InMemoryReactiveOAuth2AuthorizedClientService(clientRegistrationRepository);
+		}
+
+	}
+
+	@Configuration(proxyBeanMethods = false)
+	@Import(ReactiveOAuth2AuthorizedClientServiceConfiguration.class)
+	static class ReactiveOAuth2AuthorizedClientRepositoryConfiguration {
+
+		@Bean
+		ServerOAuth2AuthorizedClientRepository testAuthorizedClientRepository(
+				ReactiveOAuth2AuthorizedClientService authorizedClientService) {
+			return new AuthenticatedPrincipalServerOAuth2AuthorizedClientRepository(authorizedClientService);
+		}
+
+	}
+
+	@Configuration(proxyBeanMethods = false)
+	static class ReactiveClientRepositoryConfiguration {
+
+		@Bean
+		ReactiveClientRegistrationRepository clientRegistrationRepository() {
+			List<ClientRegistration> registrations = new ArrayList<>();
+			registrations.add(getClientRegistration("first", "https://user-info-uri.com"));
+			registrations.add(getClientRegistration("second", "https://other-user-info"));
+			return new InMemoryReactiveClientRegistrationRepository(registrations);
+		}
+
+		private ClientRegistration getClientRegistration(String id, String userInfoUri) {
+			ClientRegistration.Builder builder = ClientRegistration.withRegistrationId(id);
+			builder.clientName("foo")
+				.clientId("foo")
+				.clientAuthenticationMethod(
+						org.springframework.security.oauth2.core.ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
+				.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
+				.scope("read")
+				.clientSecret("secret")
+				.redirectUri("https://redirect-uri.com")
+				.authorizationUri("https://authorization-uri.com")
+				.tokenUri("https://token-uri.com")
+				.userInfoUri(userInfoUri)
+				.userNameAttributeName("login");
+			return builder.build();
+		}
+
+	}
+
+	@Configuration(proxyBeanMethods = false)
+	static class ServerHttpSecurityConfiguration {
+
+		@Bean
+		ServerHttpSecurity http() {
+			TestServerHttpSecurity httpSecurity = new TestServerHttpSecurity();
+			return httpSecurity;
+		}
+
+		static class TestServerHttpSecurity extends ServerHttpSecurity implements ApplicationContextAware {
+
+			@Override
+			public void setApplicationContext(ApplicationContext applicationContext) {
+				super.setApplicationContext(applicationContext);
+			}
+
+		}
+
+	}
+
+}

spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/client/servlet/OAuth2ClientAutoConfigurationTests.java

@@ -0,0 +1,103 @@
+/*
+ * Copyright 2012-2025 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.boot.autoconfigure.security.oauth2.client.servlet;
+
+import org.junit.jupiter.api.Test;
+
+import org.springframework.boot.autoconfigure.AutoConfigurations;
+import org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientAutoConfiguration;
+import org.springframework.boot.test.context.runner.ApplicationContextRunner;
+import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
+import org.springframework.security.oauth2.client.registration.ClientRegistration;
+import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
+import org.springframework.security.oauth2.client.registration.InMemoryClientRegistrationRepository;
+import org.springframework.security.oauth2.core.AuthorizationGrantType;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.mock;
+
+/**
+ * Tests for {@link OAuth2ClientAutoConfiguration}.
+ *
+ * @author Madhura Bhave
+ * @author Andy Wilkinson
+ */
+class OAuth2ClientAutoConfigurationTests {
+
+	private static final String REGISTRATION_PREFIX = "spring.security.oauth2.client.registration";
+
+	private final ApplicationContextRunner contextRunner = new ApplicationContextRunner()
+		.withConfiguration(AutoConfigurations.of(OAuth2ClientAutoConfiguration.class));
+
+	@Test
+	void beansShouldNotBeCreatedWhenPropertiesAbsent() {
+		this.contextRunner.run((context) -> assertThat(context).doesNotHaveBean(ClientRegistrationRepository.class)
+			.doesNotHaveBean(OAuth2AuthorizedClientService.class));
+	}
+
+	@Test
+	void beansAreCreatedWhenPropertiesPresent() {
+		this.contextRunner
+			.withPropertyValues(REGISTRATION_PREFIX + ".foo.client-id=abcd",
+					REGISTRATION_PREFIX + ".foo.client-secret=secret", REGISTRATION_PREFIX + ".foo.provider=github")
+			.run((context) -> {
+				assertThat(context).hasSingleBean(ClientRegistrationRepository.class);
+				assertThat(context).hasSingleBean(OAuth2AuthorizedClientService.class);
+				ClientRegistrationRepository repository = context.getBean(ClientRegistrationRepository.class);
+				ClientRegistration registration = repository.findByRegistrationId("foo");
+				assertThat(registration).isNotNull();
+				assertThat(registration.getClientSecret()).isEqualTo("secret");
+			});
+	}
+
+	@Test
+	void clientServiceBeanIsConditionalOnMissingBean() {
+		this.contextRunner
+			.withBean("testAuthorizedClientService", OAuth2AuthorizedClientService.class,
+					() -> mock(OAuth2AuthorizedClientService.class))
+			.run((context) -> {
+				assertThat(context).hasSingleBean(OAuth2AuthorizedClientService.class);
+				assertThat(context).hasBean("testAuthorizedClientService");
+			});
+	}
+
+	@Test
+	void clientServiceBeanIsCreatedWithUserDefinedClientRegistrationRepository() {
+		this.contextRunner
+			.withBean(ClientRegistrationRepository.class,
+					() -> new InMemoryClientRegistrationRepository(getClientRegistration("test", "test")))
+			.run((context) -> assertThat(context).hasSingleBean(OAuth2AuthorizedClientService.class));
+	}
+
+	private ClientRegistration getClientRegistration(String id, String userInfoUri) {
+		ClientRegistration.Builder builder = ClientRegistration.withRegistrationId(id);
+		builder.clientName("foo")
+			.clientId("foo")
+			.clientAuthenticationMethod(
+					org.springframework.security.oauth2.core.ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
+			.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
+			.scope("read")
+			.clientSecret("secret")
+			.redirectUri("https://redirect-uri.com")
+			.authorizationUri("https://authorization-uri.com")
+			.tokenUri("https://token-uri.com")
+			.userInfoUri(userInfoUri)
+			.userNameAttributeName("login");
+		return builder.build();
+	}
+
+}

spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/client/servlet/OAuth2ClientRegistrationRepositoryConfigurationTests.java

@@ -1,57 +0,0 @@
-/*
- * Copyright 2012-2023 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.boot.autoconfigure.security.oauth2.client.servlet;
-
-import org.junit.jupiter.api.Test;
-
-import org.springframework.boot.test.context.runner.ApplicationContextRunner;
-import org.springframework.security.oauth2.client.registration.ClientRegistration;
-import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-/**
- * Tests for {@link OAuth2ClientRegistrationRepositoryConfiguration}.
- *
- * @author Madhura Bhave
- */
-class OAuth2ClientRegistrationRepositoryConfigurationTests {
-
-	private final ApplicationContextRunner contextRunner = new ApplicationContextRunner();
-
-	private static final String REGISTRATION_PREFIX = "spring.security.oauth2.client.registration";
-
-	@Test
-	void clientRegistrationRepositoryBeanShouldNotBeCreatedWhenPropertiesAbsent() {
-		this.contextRunner.withUserConfiguration(OAuth2ClientRegistrationRepositoryConfiguration.class)
-			.run((context) -> assertThat(context).doesNotHaveBean(ClientRegistrationRepository.class));
-	}
-
-	@Test
-	void clientRegistrationRepositoryBeanShouldBeCreatedWhenPropertiesPresent() {
-		this.contextRunner.withUserConfiguration(OAuth2ClientRegistrationRepositoryConfiguration.class)
-			.withPropertyValues(REGISTRATION_PREFIX + ".foo.client-id=abcd",
-					REGISTRATION_PREFIX + ".foo.client-secret=secret", REGISTRATION_PREFIX + ".foo.provider=github")
-			.run((context) -> {
-				ClientRegistrationRepository repository = context.getBean(ClientRegistrationRepository.class);
-				ClientRegistration registration = repository.findByRegistrationId("foo");
-				assertThat(registration).isNotNull();
-				assertThat(registration.getClientSecret()).isEqualTo("secret");
-			});
-	}
-
-}

spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/oauth2/client/servlet/OAuth2ClientWebSecurityAutoConfigurationTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2025 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -53,77 +53,74 @@ import org.springframework.web.filter.CompositeFilter;
 import static org.assertj.core.api.Assertions.assertThat;
 
 /**
- * Tests for {@link OAuth2WebSecurityConfiguration}.
+ * Tests for {@link OAuth2ClientWebSecurityAutoConfiguration}.
  *
  * @author Madhura Bhave
+ * @author Andy Wilkinson
  */
-class OAuth2WebSecurityConfigurationTests {
+class OAuth2ClientWebSecurityAutoConfigurationTests {
 
-	private final WebApplicationContextRunner contextRunner = new WebApplicationContextRunner();
+	private final WebApplicationContextRunner contextRunner = new WebApplicationContextRunner()
+		.withConfiguration(AutoConfigurations.of(OAuth2ClientWebSecurityAutoConfiguration.class));
 
 	@Test
-	void securityConfigurerConfiguresOAuth2Login() {
+	void autoConfigurationIsConditionalOnAuthorizedClientService() {
 		this.contextRunner
-			.withUserConfiguration(ClientRegistrationRepositoryConfiguration.class,
-					OAuth2WebSecurityConfiguration.class)
-			.run((context) -> {
-				ClientRegistrationRepository expected = context.getBean(ClientRegistrationRepository.class);
-				ClientRegistrationRepository actual = (ClientRegistrationRepository) ReflectionTestUtils.getField(
-						getSecurityFilters(context, OAuth2LoginAuthenticationFilter.class).get(0),
-						"clientRegistrationRepository");
-				assertThat(isEqual(expected.findByRegistrationId("first"), actual.findByRegistrationId("first")))
-					.isTrue();
-				assertThat(isEqual(expected.findByRegistrationId("second"), actual.findByRegistrationId("second")))
-					.isTrue();
-			});
-	}
-
-	@Test
-	void securityConfigurerConfiguresAuthorizationCode() {
-		this.contextRunner
-			.withUserConfiguration(ClientRegistrationRepositoryConfiguration.class,
-					OAuth2WebSecurityConfiguration.class)
-			.run((context) -> {
-				ClientRegistrationRepository expected = context.getBean(ClientRegistrationRepository.class);
-				ClientRegistrationRepository actual = (ClientRegistrationRepository) ReflectionTestUtils.getField(
-						getSecurityFilters(context, OAuth2AuthorizationCodeGrantFilter.class).get(0),
-						"clientRegistrationRepository");
-				assertThat(isEqual(expected.findByRegistrationId("first"), actual.findByRegistrationId("first")))
-					.isTrue();
-				assertThat(isEqual(expected.findByRegistrationId("second"), actual.findByRegistrationId("second")))
-					.isTrue();
-			});
-	}
-
-	@Test
-	void securityConfigurerBacksOffWhenClientRegistrationBeanAbsent() {
-		this.contextRunner.withUserConfiguration(TestConfig.class, OAuth2WebSecurityConfiguration.class)
-			.run((context) -> {
-				assertThat(getSecurityFilters(context, OAuth2LoginAuthenticationFilter.class)).isEmpty();
-				assertThat(getSecurityFilters(context, OAuth2AuthorizationCodeGrantFilter.class)).isEmpty();
-			});
-	}
-
-	@Test
-	void configurationRegistersAuthorizedClientServiceBean() {
-		this.contextRunner
-			.withUserConfiguration(ClientRegistrationRepositoryConfiguration.class,
-					OAuth2WebSecurityConfiguration.class)
-			.run((context) -> assertThat(context).hasSingleBean(OAuth2AuthorizedClientService.class));
+			.run((context) -> assertThat(context).doesNotHaveBean(OAuth2ClientWebSecurityAutoConfiguration.class));
 	}
 
 	@Test
 	void configurationRegistersAuthorizedClientRepositoryBean() {
-		this.contextRunner
-			.withUserConfiguration(ClientRegistrationRepositoryConfiguration.class,
-					OAuth2WebSecurityConfiguration.class)
+		this.contextRunner.withUserConfiguration(OAuth2AuthorizedClientServiceConfiguration.class)
 			.run((context) -> assertThat(context).hasSingleBean(OAuth2AuthorizedClientRepository.class));
 	}
 
+	@Test
+	void authorizedClientRepositoryBeanIsConditionalOnMissingBean() {
+		this.contextRunner.withUserConfiguration(OAuth2AuthorizedClientRepositoryConfiguration.class).run((context) -> {
+			assertThat(context).hasSingleBean(OAuth2AuthorizedClientRepository.class);
+			assertThat(context).hasBean("testAuthorizedClientRepository");
+		});
+	}
+
+	@Test
+	void securityConfigurerConfiguresOAuth2Login() {
+		this.contextRunner.withUserConfiguration(OAuth2AuthorizedClientServiceConfiguration.class).run((context) -> {
+			ClientRegistrationRepository expected = context.getBean(ClientRegistrationRepository.class);
+			ClientRegistrationRepository actual = (ClientRegistrationRepository) ReflectionTestUtils.getField(
+					getSecurityFilters(context, OAuth2LoginAuthenticationFilter.class).get(0),
+					"clientRegistrationRepository");
+			assertThat(isEqual(expected.findByRegistrationId("first"), actual.findByRegistrationId("first"))).isTrue();
+			assertThat(isEqual(expected.findByRegistrationId("second"), actual.findByRegistrationId("second")))
+				.isTrue();
+		});
+	}
+
+	@Test
+	void securityConfigurerConfiguresAuthorizationCode() {
+		this.contextRunner.withUserConfiguration(OAuth2AuthorizedClientServiceConfiguration.class).run((context) -> {
+			ClientRegistrationRepository expected = context.getBean(ClientRegistrationRepository.class);
+			ClientRegistrationRepository actual = (ClientRegistrationRepository) ReflectionTestUtils.getField(
+					getSecurityFilters(context, OAuth2AuthorizationCodeGrantFilter.class).get(0),
+					"clientRegistrationRepository");
+			assertThat(isEqual(expected.findByRegistrationId("first"), actual.findByRegistrationId("first"))).isTrue();
+			assertThat(isEqual(expected.findByRegistrationId("second"), actual.findByRegistrationId("second")))
+				.isTrue();
+		});
+	}
+
+	@Test
+	void securityConfigurerBacksOffWhenClientRegistrationBeanAbsent() {
+		this.contextRunner.withUserConfiguration(TestConfig.class).run((context) -> {
+			assertThat(getSecurityFilters(context, OAuth2LoginAuthenticationFilter.class)).isEmpty();
+			assertThat(getSecurityFilters(context, OAuth2AuthorizationCodeGrantFilter.class)).isEmpty();
+		});
+	}
+
 	@Test
 	void securityFilterChainConfigBacksOffWhenOtherSecurityFilterChainBeanPresent() {
 		this.contextRunner.withConfiguration(AutoConfigurations.of(WebMvcAutoConfiguration.class))
-			.withUserConfiguration(TestSecurityFilterChainConfiguration.class, OAuth2WebSecurityConfiguration.class)
+			.withUserConfiguration(TestSecurityFilterChainConfiguration.class)
 			.run((context) -> {
 				assertThat(getSecurityFilters(context, OAuth2LoginAuthenticationFilter.class)).isEmpty();
 				assertThat(getSecurityFilters(context, OAuth2AuthorizationCodeGrantFilter.class)).isEmpty();
@@ -133,9 +130,7 @@ class OAuth2WebSecurityConfigurationTests {
 
 	@Test
 	void securityFilterChainConfigConditionalOnSecurityFilterChainClass() {
-		this.contextRunner
-			.withUserConfiguration(ClientRegistrationRepositoryConfiguration.class,
-					OAuth2WebSecurityConfiguration.class)
+		this.contextRunner.withUserConfiguration(ClientRegistrationRepositoryConfiguration.class)
 			.withClassLoader(new FilteredClassLoader(SecurityFilterChain.class))
 			.run((context) -> {
 				assertThat(getSecurityFilters(context, OAuth2LoginAuthenticationFilter.class)).isEmpty();
@@ -143,28 +138,6 @@ class OAuth2WebSecurityConfigurationTests {
 			});
 	}
 
-	@Test
-	void authorizedClientServiceBeanIsConditionalOnMissingBean() {
-		this.contextRunner
-			.withUserConfiguration(OAuth2AuthorizedClientServiceConfiguration.class,
-					OAuth2WebSecurityConfiguration.class)
-			.run((context) -> {
-				assertThat(context).hasSingleBean(OAuth2AuthorizedClientService.class);
-				assertThat(context).hasBean("testAuthorizedClientService");
-			});
-	}
-
-	@Test
-	void authorizedClientRepositoryBeanIsConditionalOnMissingBean() {
-		this.contextRunner
-			.withUserConfiguration(OAuth2AuthorizedClientRepositoryConfiguration.class,
-					OAuth2WebSecurityConfiguration.class)
-			.run((context) -> {
-				assertThat(context).hasSingleBean(OAuth2AuthorizedClientRepository.class);
-				assertThat(context).hasBean("testAuthorizedClientRepository");
-			});
-	}
-
 	private List<Filter> getSecurityFilters(AssertableWebApplicationContext context, Class<? extends Filter> filter) {
 		return getSecurityFilterChain(context).getFilters().stream().filter(filter::isInstance).toList();
 	}
@@ -219,6 +192,30 @@ class OAuth2WebSecurityConfigurationTests {
 
 	}
 
+	@Configuration(proxyBeanMethods = false)
+	@Import(ClientRegistrationRepositoryConfiguration.class)
+	static class OAuth2AuthorizedClientServiceConfiguration {
+
+		@Bean
+		InMemoryOAuth2AuthorizedClientService authorizedClientService(
+				ClientRegistrationRepository clientRegistrationRepository) {
+			return new InMemoryOAuth2AuthorizedClientService(clientRegistrationRepository);
+		}
+
+	}
+
+	@Configuration(proxyBeanMethods = false)
+	@Import(OAuth2AuthorizedClientServiceConfiguration.class)
+	static class OAuth2AuthorizedClientRepositoryConfiguration {
+
+		@Bean
+		OAuth2AuthorizedClientRepository testAuthorizedClientRepository(
+				OAuth2AuthorizedClientService authorizedClientService) {
+			return new AuthenticatedPrincipalOAuth2AuthorizedClientRepository(authorizedClientService);
+		}
+
+	}
+
 	@Configuration(proxyBeanMethods = false)
 	@Import(TestConfig.class)
 	static class ClientRegistrationRepositoryConfiguration {
@@ -251,7 +248,7 @@ class OAuth2WebSecurityConfigurationTests {
 	}
 
 	@Configuration(proxyBeanMethods = false)
-	@Import(ClientRegistrationRepositoryConfiguration.class)
+	@Import(OAuth2AuthorizedClientServiceConfiguration.class)
 	static class TestSecurityFilterChainConfiguration {
 
 		@Bean
@@ -264,28 +261,4 @@ class OAuth2WebSecurityConfigurationTests {
 
 	}
 
-	@Configuration(proxyBeanMethods = false)
-	@Import(ClientRegistrationRepositoryConfiguration.class)
-	static class OAuth2AuthorizedClientServiceConfiguration {
-
-		@Bean
-		OAuth2AuthorizedClientService testAuthorizedClientService(
-				ClientRegistrationRepository clientRegistrationRepository) {
-			return new InMemoryOAuth2AuthorizedClientService(clientRegistrationRepository);
-		}
-
-	}
-
-	@Configuration(proxyBeanMethods = false)
-	@Import(ClientRegistrationRepositoryConfiguration.class)
-	static class OAuth2AuthorizedClientRepositoryConfiguration {
-
-		@Bean
-		OAuth2AuthorizedClientRepository testAuthorizedClientRepository(
-				OAuth2AuthorizedClientService authorizedClientService) {
-			return new AuthenticatedPrincipalOAuth2AuthorizedClientRepository(authorizedClientService);
-		}
-
-	}
-
 }