Spring Web Client and OAuth2

public class IsgCloudRestUtil {
	
	@Value("${isgCloud.httpAuthHost}")
	private String httpAuthHost;
	
	@Value("${isgCloud.httpApiHost}")
	private String httpApiHost;
		
	@Value("${isgCloud.authUserName}")
	private String authUserName;
	
	@Value("${isgCloud.authPassword}")
	private String authPassword;

	// use static since WebClient is thread-safe
	private static WebClient webClient;
	
	private static final Logger logger = LoggerFactory.getLogger(IsgCloudRestUtil.class);

	public List<HashMap<?, ?>> callIsgCloudApi(String isgPath, String search, String projection) {
		UriComponentsBuilder builder = UriComponentsBuilder.newInstance()			
			.scheme("https")
			.host(httpApiHost)
			.path(isgPath)
			.queryParam("search", search)
			.queryParam("projection", projection);

		logger.info("url: " + builder.build().toUriString());
		
		// call pagable ISG Cloud API
		Mono<List<HashMap<?, ?>>> result = fetchItems(builder.build().toUri()).expand(response -> {
			if (response.getPaging() == null) {
	            return Mono.empty();
	        }
			String nextUrl = response.getPaging().getPageNext();
	        return fetchItems(URI.create(nextUrl));
		}).flatMap(response -> Flux.fromIterable(response.getResults())).collectList();
		
		return result.block();
	}
	
	private Mono<IsgCloudResponse> fetchItems(URI url){
		return webClient().get().uri(url)
				.accept(MediaType.APPLICATION_JSON)
				.attributes(clientRegistrationId("xxx-cloud"))
				.retrieve()
				.bodyToMono(IsgCloudResponse.class);
	}
	
	private WebClient webClient() {
		if (webClient == null) {
			ServletOAuth2AuthorizedClientExchangeFilterFunction filter;
			try {
				final KeyStore trustStore = createKeyStore(jksFileName, jksPassword);
				final TrustManagerFactory trustManager = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
	            trustManager.init(trustStore);
				final SslContext sslContext = SslContextBuilder.forClient().trustManager(trustManager).build();
				final HttpClient httpClient = HttpClient.create().secure(ssl -> {
	                ssl.sslContext(sslContext);
	            });
				
				filter = new ServletOAuth2AuthorizedClientExchangeFilterFunction(
						isgCloudOauthAuthorizedClientManager(isgCloudOauthClientRegistration()));
				webClient = WebClient.builder()
						.clientConnector(new ReactorClientHttpConnector(httpClient))
						.apply(filter.oauth2Configuration())
						.build();
			} catch (KeyManagementException | NoSuchAlgorithmException | KeyStoreException | CertificateException | IOException e) {
				e.printStackTrace();
				logger.error("failed to get web client", e);
			}
		}
		return webClient;
	}

    private static KeyStore createKeyStore(final String keyStoreLocation, final String keyStorePassword) 
    		throws KeyStoreException, NoSuchAlgorithmException, CertificateException, IOException {
        FileInputStream fis = new FileInputStream(keyStoreLocation);
        final KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
        ks.load(fis, keyStorePassword.toCharArray());
        return ks;
    }
	
    private ClientRegistration isgCloudOauthClientRegistration() {
        String authTokenEndpoint = UriComponentsBuilder.newInstance()
                .scheme("https")
                .host(httpAuthHost)
                .path("auth/token")
                .build()
                .toUriString();

        return ClientRegistration.withRegistrationId("xxx-cloud")
                .clientId("cloud-api")
                .authorizationGrantType(AuthorizationGrantType.PASSWORD)
                .tokenUri(authTokenEndpoint)
                .build();
    }
    
    private AuthorizedClientServiceOAuth2AuthorizedClientManager isgCloudOauthAuthorizedClientManager(ClientRegistration isgCloudOauthClientRegistration) 
    		throws KeyManagementException, NoSuchAlgorithmException, KeyStoreException, CertificateException, IOException {
        InMemoryClientRegistrationRepository clientRegistrationRepository = new InMemoryClientRegistrationRepository(isgCloudOauthClientRegistration);
        InMemoryOAuth2AuthorizedClientService authorizedClientService = new InMemoryOAuth2AuthorizedClientService(clientRegistrationRepository);
        OAuth2AuthorizedClientProvider oAuth2AuthorizedClientProvider = OAuth2AuthorizedClientProviderBuilder
                .builder()
                .password()
                .refreshToken()
                .build();
        AuthorizedClientServiceOAuth2AuthorizedClientManager authorizedClientManager = 
        		new AuthorizedClientServiceOAuth2AuthorizedClientManager(clientRegistrationRepository, authorizedClientService);
        authorizedClientManager.setAuthorizedClientProvider(oAuth2AuthorizedClientProvider);
        authorizedClientManager.setContextAttributesMapper(
        		oAuth2AuthorizeRequest -> ImmutableMap.of(OAuth2AuthorizationContext.USERNAME_ATTRIBUTE_NAME, authUserName, 
            OAuth2AuthorizationContext.PASSWORD_ATTRIBUTE_NAME, authPassword));
        return authorizedClientManager;
    }    
}

private HttpClient httpClient() {
	final HttpClient httpClient = HttpClient.create().secure(ssl -> {
		try {
		KeyStore trustStore = KeyStore.getInstance("JKS");
		trustStore.load(new FileInputStream(jksFileName), jksPassword.toCharArray());
		TrustManagerFactory trustManager = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
		trustManager.init(trustStore);
		
		KeyStore keyStore = KeyStore.getInstance("JKS");
		keyStore.load(new FileInputStream(jksFileName), jksPassword.toCharArray());
		final KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance("SunX509");
		keyManagerFactory.init(keyStore, jksPassword.toCharArray());
		
		ssl.sslContext(SslContextBuilder
				.forClient()
				.clientAuth(ClientAuth.REQUIRE)
				.trustManager(trustManager)
//		    		.keyManager(keyManagerFactory)
				.build());
		} catch(Exception e) {
			e.printStackTrace();
		}
	});
	return httpClient;
}

private WebClient webClient() {
	if (webClient == null) {
		try {
			ServerOAuth2AuthorizedClientExchangeFilterFunction filter = 
					new ServerOAuth2AuthorizedClientExchangeFilterFunction(isgCloudOauthAuthorizedClientManagerReact(isgCloudOauthClientRegistration()));
			filter.setDefaultClientRegistrationId(REGISTRATION_ID);
			
			// for Buffer
			final int size = 16 * 1024 * 1024;
			final ExchangeStrategies strategies = ExchangeStrategies.builder()
				.codecs(codecs -> codecs.defaultCodecs().maxInMemorySize(size))
				.build();
			
			webClient = WebClient.builder()
					.clientConnector(new ReactorClientHttpConnector(httpClient()))
					.exchangeStrategies(strategies)
					.filter(filter)
					.build();
		} catch (KeyManagementException | NoSuchAlgorithmException | KeyStoreException | CertificateException | IOException  e) {
			e.printStackTrace();
			logger.error("failed to get web client", e);
		}
	}
	return webClient;
}

private ReactiveOAuth2AuthorizedClientManager isgCloudOauthAuthorizedClientManagerReact(ClientRegistration isgCloudOauthClientRegistration) 
		throws KeyManagementException, NoSuchAlgorithmException, KeyStoreException, CertificateException, IOException {
	ReactiveClientRegistrationRepository clientRegistrationRepository = new InMemoryReactiveClientRegistrationRepository(isgCloudOauthClientRegistration);
	ReactiveOAuth2AuthorizedClientService authorizedClientService = new InMemoryReactiveOAuth2AuthorizedClientService(clientRegistrationRepository);
	
	// create SSL enabled webclient for provider thus can make AUTH SSL enabled.
	WebClientReactivePasswordTokenResponseClient passowrdTokenTokenResponseClient = new WebClientReactivePasswordTokenResponseClient();
	WebClientReactiveRefreshTokenTokenResponseClient refreshTokenTokenResponseClient = new WebClientReactiveRefreshTokenTokenResponseClient();
	WebClient webClient = WebClient.builder().clientConnector(new ReactorClientHttpConnector(httpClient())).build();
	passowrdTokenTokenResponseClient.setWebClient(webClient);
	refreshTokenTokenResponseClient.setWebClient(webClient);
	
	ReactiveOAuth2AuthorizedClientProvider authorizedClientProvider = ReactiveOAuth2AuthorizedClientProviderBuilder
			.builder()
			.password(c -> {
				c.accessTokenResponseClient(passowrdTokenTokenResponseClient);
			})
			.refreshToken(c -> {
				c.accessTokenResponseClient(refreshTokenTokenResponseClient);
			})
			.build();
	
	AuthorizedClientServiceReactiveOAuth2AuthorizedClientManager authorizedClientManager = 
			new AuthorizedClientServiceReactiveOAuth2AuthorizedClientManager(clientRegistrationRepository, authorizedClientService);
	
	authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);
	authorizedClientManager.setContextAttributesMapper(
			oAuth2AuthorizeRequest -> Mono.just(ImmutableMap.of(OAuth2AuthorizationContext.USERNAME_ATTRIBUTE_NAME, authUserName, OAuth2AuthorizationContext.PASSWORD_ATTRIBUTE_NAME, authPassword)));
	return authorizedClientManager;
}