Package com.oracle.bmc.auth.internal

Class AbstractAsyncFederationClient

java.lang.Object

com.oracle.bmc.auth.internal.AbstractAsyncFederationClient

All Implemented Interfaces:

AsyncFederationClient, ProvidesConfigurableRefreshAsync

Direct Known Subclasses:

WorkloadIdentityFederationClient

public abstract class AbstractAsyncFederationClient
extends Object
implements AsyncFederationClient, ProvidesConfigurableRefreshAsync

Abstract base class for asynchronous federation clients that handle security token retrieval and refresh logic.

This class manages the lifecycle of security tokens, including refreshing tokens when they are about to expire, and optionally refreshing session keys. It ensures that only one token refresh operation is in progress at any time, and provides mechanisms to reuse pending refresh operations. The class is thread-safe and uses a lock to synchronize access to the refresh logic.

Async Implementation Note
This implementation provides true asynchronous behavior through CompletableFuture-based APIs. The underlying HTTP operations are handled by the OCI SDK's HttpClient abstraction, which ensures consistent non-blocking semantics regardless of the specific HTTP client implementation in use. This design enables:

• Non-blocking token retrieval and refresh operations
• Proper CompletableFuture composition and chaining
• Concurrent token operations without thread blocking
• Consistent async behavior across different HTTP client implementations

Features like buildAsync() in authentication providers rely on this async foundation to provide token pre-fetching and fail-fast authentication initialization.

Subclasses must implement getSecurityTokenFromServer() to define how security tokens are fetched from the server.

See Also:

AsyncFederationClient, ProvidesConfigurableRefreshAsync

Field Summary

Fields

Modifier and Type	Field	Description
protected OciCircuitBreaker	circuitBreaker
protected com.oracle.bmc.http.client.HttpClient	federationClient
protected SecurityTokenAdapter	securityTokenAdapter
protected SessionKeySupplier	sessionKeySupplier

Constructor Summary

Constructors

Constructor	Description
AbstractAsyncFederationClient(SessionKeySupplier sessionKeySupplier, String federationEndpoint, ClientConfigurator clientConfigurator, CircuitBreakerConfiguration circuitBreakerConfiguration, List<ClientConfigurator> additionalClientConfigurators)

Method Summary

Modifier and Type	Method	Description
protected String	getFederationEndpoint()
CompletableFuture<String>	getSecurityToken()	Gets a security token from the federation endpoint.
protected abstract CompletableFuture<SecurityTokenAdapter>	getSecurityTokenFromServer()
protected abstract void	onTokenRefreshCompleted(Duration tokenValidDuration)	Hook method called after a successful token refresh.
CompletableFuture<String>	refreshAndGetSecurityToken()	Gets a security token from the federation endpoint.
CompletableFuture<String>	refreshAndGetSecurityTokenIfExpiringWithin(Duration time)	Gets a security token from the federation endpoint if the security token expires within the provided duration.
CompletableFuture<String>	refreshAndGetSecurityTokenIfExpiringWithin(Duration time, boolean refreshKeys)	Gets a security token from the federation endpoint if the security token expires within the provided duration and allows to enable/disable refresh of keys.
protected CompletableFuture<String>	refreshAndGetSecurityTokenInnerAsync(boolean doFinalTokenValidityCheck, Duration time, boolean refreshKeys)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface com.oracle.bmc.auth.internal.AsyncFederationClient

getStringClaim

Field Detail

securityTokenAdapter

protected volatile SecurityTokenAdapter securityTokenAdapter

sessionKeySupplier

protected final SessionKeySupplier sessionKeySupplier

circuitBreaker

protected final OciCircuitBreaker circuitBreaker

federationClient

protected final com.oracle.bmc.http.client.HttpClient federationClient

Constructor Detail

AbstractAsyncFederationClient

public AbstractAsyncFederationClient(SessionKeySupplier sessionKeySupplier,
                                     String federationEndpoint,
                                     ClientConfigurator clientConfigurator,
                                     CircuitBreakerConfiguration circuitBreakerConfiguration,
                                     List<ClientConfigurator> additionalClientConfigurators)

Method Detail

getSecurityTokenFromServer

protected abstract CompletableFuture<SecurityTokenAdapter> getSecurityTokenFromServer()

refreshAndGetSecurityTokenIfExpiringWithin

public CompletableFuture<String> refreshAndGetSecurityTokenIfExpiringWithin(Duration time)

Description copied from interface: ProvidesConfigurableRefreshAsync

Gets a security token from the federation endpoint if the security token expires within the provided duration.

This will always retrieve a new token from the federation endpoint and does not use a cached token.

Specified by:

refreshAndGetSecurityTokenIfExpiringWithin in interface ProvidesConfigurableRefreshAsync

Parameters:

time - the duration to check

Returns:

A CompletableFuture that completes with a security token that can be used to authenticate requests.

refreshAndGetSecurityTokenIfExpiringWithin

public CompletableFuture<String> refreshAndGetSecurityTokenIfExpiringWithin(Duration time,
                                                                            boolean refreshKeys)

Description copied from interface: ProvidesConfigurableRefreshAsync

Gets a security token from the federation endpoint if the security token expires within the provided duration and allows to enable/disable refresh of keys.

This will always retrieve a new token from the federation endpoint and does not use a cached token.

Specified by:

refreshAndGetSecurityTokenIfExpiringWithin in interface ProvidesConfigurableRefreshAsync

Parameters:

time - the duration to check

refreshKeys - boolean value to enable/disable refresh of keys

Returns:

A CompletableFuture that completes with a security token that can be used to authenticate requests.

refreshAndGetSecurityTokenInnerAsync

protected CompletableFuture<String> refreshAndGetSecurityTokenInnerAsync(boolean doFinalTokenValidityCheck,
                                                                         Duration time,
                                                                         boolean refreshKeys)

onTokenRefreshCompleted

protected abstract void onTokenRefreshCompleted(Duration tokenValidDuration)

Hook method called after a successful token refresh.

Subclasses can override this to perform additional actions like scheduling proactive refreshes.

refreshAndGetSecurityToken

public CompletableFuture<String> refreshAndGetSecurityToken()

Description copied from interface: AsyncFederationClient

Gets a security token from the federation endpoint.

This will always retrieve a new token from the federation endpoint and does not use a cached token.

Specified by:

refreshAndGetSecurityToken in interface AsyncFederationClient

Returns:

A CompletableFuture that will complete with a security token that can be used to authenticate requests.

getSecurityToken

public CompletableFuture<String> getSecurityToken()

Gets a security token from the federation endpoint.

This will be a short-lived token used to authenticate requests to OCI services.

Specified by:

getSecurityToken in interface AsyncFederationClient

Returns:

the security token

getFederationEndpoint

protected String getFederationEndpoint()