rootpea commented on code in PR #1441:
URL: https://github.com/apache/jackrabbit-oak/pull/1441#discussion_r1604916308
##########
oak-segment-azure/src/main/java/org/apache/jackrabbit/oak/segment/azure/AzureUtilities.java:
##########
@@ -207,6 +230,61 @@ public void write(@NotNull byte[] bytes, int offset, int
length) {
}
}
+ /**
+ * This class represents a token refresher responsible for ensuring the
validity of the access token used for azure AD authentication.
+ * The access token generated by the Azure client is valid for 1 hour
only. Therefore, this class periodically checks the validity
+ * of the access token and refreshes it if necessary. The refresh is
triggered when the current access token is about to expire,
+ * defined by a threshold of 5 minutes from the current time. This
threshold is similar to what is being used in azure identity to
+ * generate a new token
+ */
+ private static class TokenRefresher implements Runnable {
+
+ private final ClientSecretCredential clientSecretCredential;
+ private AccessToken accessToken;
+ private final StorageCredentialsToken storageCredentialsToken;
+
+
+ /**
+ * Constructs a new TokenRefresher object with the specified
parameters.
+ *
+ * @param clientSecretCredential The client secret credential used to
obtain the access token.
+ * @param accessToken The current access token.
+ * @param storageCredentialsToken The storage credentials token
associated with the access token.
+ */
+ public TokenRefresher(ClientSecretCredential clientSecretCredential,
+ AccessToken accessToken,
+ StorageCredentialsToken storageCredentialsToken)
{
+ this.clientSecretCredential = clientSecretCredential;
+ this.accessToken = accessToken;
+ this.storageCredentialsToken = storageCredentialsToken;
+ }
+
+ @Override
+ public void run() {
+ try {
+ log.debug("Checking for azure access token expiry at: {}",
LocalDateTime.now());
+ OffsetDateTime tokenExpiryThreshold =
OffsetDateTime.now().plusMinutes(5);
Review Comment:
Alternatively instead of ClientSecretCredential, you can create directly a
ConfidentialClientApplication and set skipCache(true) in the parameters
```
// configure once, then store these for later use in the tokenrefresher:
ConfidentialClientApplication confidentialClientApplication =
ConfidentialClientApplication
.builder(clientId,
ClientCredentialFactory.createFromSecret(clientSecret))
.authority("https://login.microsoftonline.com/"; + tenantId +
"/")
.build();
ClientCredentialParameters clientCredentialParameters =
ClientCredentialParameters.builder(Collections.singleton(AZURE_DEFAULT_SCOPE)).skipCache(true)
.tenant(IdentityUtil
.resolveTenantId(tenantId, new
TokenRequestContext().addScopes(AZURE_DEFAULT_SCOPE), new
IdentityClientOptions())).build();
// refreshing anytime:
IAuthenticationResult authResult =
confidentialClientApplication.acquireToken(clientCredentialParameters).join();
AccessToken accessToken = new AccessToken(authResult.accessToken(),
OffsetDateTime.ofInstant(authResult.expiresOnDate().toInstant(),
ZoneOffset.UTC));
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscr...@jackrabbit.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
