Reactive SecurityService#getUaaUrl() creates a new Mono on each
invocation, so the resolved UAA URL is not reused across calls. During
token validation, this can lead to duplicate /info requests when token
keys are fetched and the issuer is validated in the same flow.
Cache the resolved UAA URL after a successful lookup and add regression
tests that verify reuse after success and retry after failure.
Signed-off-by: LeeJiWon <dlwldnjs1009@gmail.com>
Previously, CloudFoundryActuatorAutoConfiguration required
RestTemplateBuilder, using it to create the RestTemplate that's used
the security interceptor. Following the modularization,
RestTemplateBuilder is only present when spring-boot-restclient is on
the classpath. In its absence, CloudFoundryActuatorAutoConfiguration
would fail.
This commit address this problem by using RestClient.Builder (and
RestClient) instead of RestTemplateBuilder (and RestTemplate). This
allows CloudFoundryActuatorAutoConfiguration to work without
spring-boot-restclient as RestClient.Builder and RestClient are
provided by spring-web that will always be there in an MVC webapp.
Fixes gh-48826
Andy Wilkinson
Brian Clozel
LeeJiWon
Phillip Webb
Moritz Halbritter