Spring-security: Provide support for refresh_token grant

[jgrandja]

We need to provide WebClient support for refreshing an expired access token.

Spec references:

• OAuth 2.0 - Refreshing an Access Token

• OpenID Connect 1.0 - Using Refresh Tokens

Related #4921

[jgrandja]

Related #4509

[gregsimons]

@jgrandja is any of the refresh token repository available in a snapshot form at the moment?

[jgrandja]

@gregsimons No not at the moment. The HTTP Client integration (e.g. #4921) needs to be implemented first before we tackle this one. We're still planning on getting this in for 5.1 release.

[rwinch]

Fixed via 0116c65

Users can now use the following:

WebClient webClient = WebClient.builder()
    .filter(new ServerOAuth2AuthorizedClientExchangeFilterFunction(authorizedClientService))
    .build();
// ....
Mono<String>  response = webClient.get()
    .uri(uri)
    .attributes(oauth2AuthorizedClient(authorizedClient))
    // ...
    .retrieve()
    .bodyToMono(String.class);  

If the access token is about to expire and it has a corresponding refresh token, then it will automatically be refreshed and saved. After the refresh is complete, the original request will be made with the updated access token.