public final class OidcRequestAuthorizer

Sends an OidcClient’s access token with the application’s requests, and renews it with the refresh token when the service refuses it.

OidcRequestAuthorizer authorizer = new OidcRequestAuthorizer(client);
authorizer.install("https://api.example.com");
authorizer.load();          // a session saved by an earlier run, if there is one

From then on every request under that base URL carries Authorization: Bearer ..., generated @RestClient clients included. The authorizer follows its client: tokens obtained by OidcClient.authorize(), OidcClient.refresh(String) or the device grant are picked up as they arrive, and OidcClient.clearStoredTokens() drops them.

When the service answers 401

The request is held and the refresh token is exchanged for a new set – once, however many requests were refused together; they all wait for the same exchange. Each is then sent again with the new access token. See RequestAuthorizer for what the caller of a request sees.

When the authorization server returns a permanent refresh error, the session is over: the tokens are dropped from memory and from the TokenStore, the held requests deliver their 401, and every SignInRequiredListener is told so the application can show its sign-in screen. Transport failures, malformed responses, and the provider’s server_error or temporarily_unavailable errors keep the tokens: nothing has said they are bad.

Before the token expires

A refusal is the fallback, not the way a token is normally renewed. When a request is queued and the access token is within setRefreshLeeway(int) of its expiry – sixty seconds unless set – the refresh token is exchanged first and the request is kept out of the queue until the exchange is done. It is then sent once, with the new token. Requests queued in the meantime wait for the same exchange.

Nothing blocks for this: the request has simply not been handed to a network thread yet. Code that waits for it – addToQueueAndWait, the blocking methods of RequestBuilder – returns the one final answer.

If that exchange is refused the session ends as described above, and the request goes out with no token for the service to answer 401. If it fails without an answer the request is sent with the token it has, which may still be good, and no exchange is tried ahead of time for the next few seconds.

A token whose response carried no expires_in has no known expiry, and is renewed only when the service refuses it.

Threads

Everything an authorizer holds – the tokens, the exchange in progress, the listeners – belongs to the event dispatch thread and is read and changed nowhere else. Nothing here is locked. A network thread never calls an authorizer: it sends the header the EDT put on the request when the request was queued. Tokens that arrive on a network thread, and a 401 seen there, are passed to the EDT before the authorizer hears of them.

Call this class on the EDT. The methods that read or change its state can also be called from another thread, and then wait for the EDT to do the work – so not from a thread the EDT is itself waiting for.