Class OAuth2Credentials
- All Implemented Interfaces:
Serializable
- Direct Known Subclasses:
DownscopedCredentials
,GoogleCredentials
,IdTokenCredentials
,OAuth2CredentialsWithRefresh
- See Also:
-
Nested Class Summary
Nested ClassesModifier and TypeClassDescription(package private) static class
Result fromgetOrCreateRefreshTask()
.static class
(package private) static enum
static interface
Listener for changes to credentials.(package private) static class
(package private) static class
Stores an immutable snapshot of the accesstoken owned byOAuth2Credentials
(package private) class
(package private) class
-
Field Summary
FieldsModifier and TypeFieldDescription(package private) com.google.api.client.util.Clock
(package private) static final Duration
(package private) static final Duration
private final Duration
(package private) final Object
private final Duration
(package private) OAuth2Credentials.RefreshTask
private static final long
private OAuth2Credentials.OAuthValue
Fields inherited from class com.google.auth.Credentials
GOOGLE_DEFAULT_UNIVERSE
-
Constructor Summary
ConstructorsModifierConstructorDescriptionprotected
Default constructor.protected
OAuth2Credentials
(AccessToken accessToken) Constructor with explicit access token.protected
OAuth2Credentials
(AccessToken accessToken, Duration refreshMargin, Duration expirationMargin) -
Method Summary
Modifier and TypeMethodDescriptionfinal void
Adds a listener that is notified when the Credentials data changes.private com.google.common.util.concurrent.ListenableFuture
<OAuth2Credentials.OAuthValue> asyncFetch
(Executor executor) Attempts to get a fresh token.static OAuth2Credentials
create
(AccessToken accessToken) Returns the credentials instance from the given access token.boolean
private void
finishRefreshAsync
(com.google.common.util.concurrent.ListenableFuture<OAuth2Credentials.OAuthValue> finishedTask) Async callback for committing the result from a token refresh.final AccessToken
Returns the cached access token.Provide additional headers to return as request metadata.A constant string name describing the authentication technology.(package private) Duration
Returns the credentials' expiration margin.protected static <T> T
getFromServiceLoader
(Class<? extends T> clazz, T defaultInstance) Atomically creates a single flight refresh token task.(package private) Duration
Returns the credentials' refresh margin.getRequestMetadata
(URI uri) Provide the request metadata by ensuring there is a current access token and providing it as an authorization bearer token.void
getRequestMetadata
(URI uri, Executor executor, RequestMetadataCallback callback) Get the current request metadata without blocking.private OAuth2Credentials.CacheState
getState()
Computes the effective credential state in relation to the current time.int
hashCode()
boolean
Whether the credentials have metadata entries that should be added to each request.boolean
Indicates whether or not the Auth mechanism works purely by including request metadata.static OAuth2Credentials.Builder
protected static <T> T
newInstance
(String className) private void
readObject
(ObjectInputStream input) void
refresh()
Request a new token regardless of the current token state.Method to refresh the access token according to the specific type of credentials.void
Refresh these credentials only if they have expired or are expiring imminently.final void
Removes a listener that was added previously.toString()
private static <T> T
unwrapDirectFuture
(com.google.common.util.concurrent.ListenableFuture<T> future) Unwraps the value from the future.Methods inherited from class com.google.auth.Credentials
blockingGetToCallback, getMetricsCredentialType, getRequestMetadata, getUniverseDomain
-
Field Details
-
serialVersionUID
private static final long serialVersionUID- See Also:
-
DEFAULT_EXPIRATION_MARGIN
-
DEFAULT_REFRESH_MARGIN
-
EMPTY_EXTRA_HEADERS
-
expirationMargin
-
refreshMargin
-
lock
-
value
-
refreshTask
-
changeListeners
-
clock
transient com.google.api.client.util.Clock clock
-
-
Constructor Details
-
OAuth2Credentials
protected OAuth2Credentials()Default constructor. -
OAuth2Credentials
Constructor with explicit access token.- Parameters:
accessToken
- initial or temporary access token
-
OAuth2Credentials
protected OAuth2Credentials(AccessToken accessToken, Duration refreshMargin, Duration expirationMargin)
-
-
Method Details
-
create
Returns the credentials instance from the given access token.- Parameters:
accessToken
- the access token- Returns:
- the credentials instance
-
getAuthenticationType
Description copied from class:Credentials
A constant string name describing the authentication technology.E.g. “OAuth2”, “SSL”. For use by the transport layer to determine whether it supports the type of authentication in the case where
Credentials.hasRequestMetadataOnly()
is false. Also serves as a debugging helper.- Specified by:
getAuthenticationType
in classCredentials
- Returns:
- The type of authentication used.
-
hasRequestMetadata
public boolean hasRequestMetadata()Description copied from class:Credentials
Whether the credentials have metadata entries that should be added to each request.This should be called by the transport layer to see if
Credentials.getRequestMetadata()
should be used for each request.- Specified by:
hasRequestMetadata
in classCredentials
- Returns:
- Whether or not the transport layer should call
Credentials.getRequestMetadata()
-
hasRequestMetadataOnly
public boolean hasRequestMetadataOnly()Description copied from class:Credentials
Indicates whether or not the Auth mechanism works purely by including request metadata.This is meant for the transport layer. If this is true a transport does not need to take actions other than including the request metadata. If this is false, a transport must specifically know about the authentication technology to support it, and should fail to accept the credentials otherwise.
- Specified by:
hasRequestMetadataOnly
in classCredentials
- Returns:
- Whether or not the Auth mechanism works purely by including request metadata.
-
getAccessToken
Returns the cached access token.If not set, you should call
refresh()
to fetch and cache an access token.- Returns:
- The cached access token.
-
getRefreshMargin
Duration getRefreshMargin()Returns the credentials' refresh margin. -
getExpirationMargin
Duration getExpirationMargin()Returns the credentials' expiration margin. -
getRequestMetadata
Description copied from class:Credentials
Get the current request metadata without blocking.This should be called by the transport layer on each request, and the data should be populated in headers or other context. The implementation can either call the callback inline or asynchronously. Either way it should never block in this method. The executor is provided for tasks that may block.
The default implementation will just call
Credentials.getRequestMetadata(URI)
then the callback from the given executor.The convention for handling binary data is for the key in the returned map to end with
"-bin"
and for the corresponding values to be base64 encoded.- Overrides:
getRequestMetadata
in classCredentials
- Parameters:
uri
- URI of the entry point for the request.executor
- Executor to perform the request.callback
- Callback to execute when the request is finished.
-
getRequestMetadata
Provide the request metadata by ensuring there is a current access token and providing it as an authorization bearer token.- Specified by:
getRequestMetadata
in classCredentials
- Parameters:
uri
- URI of the entry point for the request.- Returns:
- The request metadata used for populating headers or other context.
- Throws:
IOException
- if there was an error getting up-to-date access. The exception should implementRetryable
andisRetryable()
will return true if the operation may be retried.
-
refresh
Request a new token regardless of the current token state. If the current token is not expired, it will still be returned during the refresh.- Specified by:
refresh
in classCredentials
- Throws:
IOException
- if there was an error getting up-to-date access.
-
refreshIfExpired
Refresh these credentials only if they have expired or are expiring imminently.- Throws:
IOException
- during token refresh.
-
asyncFetch
private com.google.common.util.concurrent.ListenableFuture<OAuth2Credentials.OAuthValue> asyncFetch(Executor executor) Attempts to get a fresh token.If a fresh token is already available, it will be immediately returned. Otherwise a refresh will be scheduled using the passed in executor. While a token is being freshed, a stale value will be returned.
-
getOrCreateRefreshTask
Atomically creates a single flight refresh token task.Only a single refresh task can be scheduled at a time. If there is an existing task, it will be returned for subsequent invocations. However if a new task is created, it is the responsibility of the caller to execute it. The task will clear the single flight slow upon completion.
-
finishRefreshAsync
private void finishRefreshAsync(com.google.common.util.concurrent.ListenableFuture<OAuth2Credentials.OAuthValue> finishedTask) Async callback for committing the result from a token refresh.The result will be stored, listeners are invoked and the single flight slot is cleared.
-
unwrapDirectFuture
private static <T> T unwrapDirectFuture(com.google.common.util.concurrent.ListenableFuture<T> future) throws IOException Unwraps the value from the future.Under most circumstances, the underlying future will already be resolved by the DirectExecutor. In those cases, the error stacktraces will be rooted in the caller's call tree. However, in some cases when async and sync usage is mixed, it's possible that a blocking call will await an async future. In those cases, the stacktrace will be orphaned and be rooted in a thread of whatever executor the async call used. This doesn't affect correctness and is extremely unlikely.
- Throws:
IOException
-
getState
Computes the effective credential state in relation to the current time. -
refreshAccessToken
Method to refresh the access token according to the specific type of credentials.Throws IllegalStateException if not overridden since direct use of OAuth2Credentials is only for temporary or non-refreshing access tokens.
- Returns:
- never
- Throws:
IllegalStateException
- always. OAuth2Credentials does not support refreshing the access token. An instance with a new access token or a derived type that supports refreshing should be used instead.IOException
-
getAdditionalHeaders
Provide additional headers to return as request metadata.- Returns:
- additional headers
-
addChangeListener
Adds a listener that is notified when the Credentials data changes.This is called when token content changes, such as when the access token is refreshed. This is typically used by code caching the access token.
- Parameters:
listener
- the listener to be added
-
removeChangeListener
Removes a listener that was added previously.- Parameters:
listener
- The listener to be removed.
-
hashCode
public int hashCode() -
getRequestMetadataInternal
-
toString
-
equals
-
readObject
- Throws:
IOException
ClassNotFoundException
-
newInstance
- Throws:
IOException
ClassNotFoundException
-
getFromServiceLoader
-
newBuilder
-
toBuilder
-