jiangxt2 opened a new issue, #14339: URL: https://github.com/apache/gravitino/issues/14339
### What would you like to be improved? The Python client's `DefaultOAuth2TokenProvider` already obtains tokens through the client credentials flow and fetches a new token after the expiry time decoded from the JWT payload. However, it retains only the access token from the token response and does not use `expires_in`. Renewal has no expiry safety margin and is not coordinated between concurrent callers sharing the provider. This leaves room to improve behavior near token expiry, when expiry information is missing or invalid, and when multiple requests need a new token at the same time. ### How should we improve? - Retain token-response expiry information and define its relationship with JWT expiry, including fallback behavior when information is missing, invalid, or inconsistent. - Define and document an expiry safety margin that also works for short-lived tokens. - Coordinate renewal when a provider is shared between concurrent requests, avoiding redundant token acquisition. - Define predictable renewal-failure behavior without silently sending an expired token or exposing credentials. - Add regression coverage for valid-token reuse, renewal boundaries, expiry metadata, concurrent renewal, and renewal failures. The scope is the existing OAuth2 client credentials provider. Renewal means obtaining another access token through that flow; new grant types, authentication methods, and server-side token-validation changes are outside scope. Parent epic: #14334. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
