Package co.ankatech.ankasecure.sdk.auth

Class ClientCredentialsExchangeException

java.lang.Object

java.lang.Throwable

java.lang.Exception

java.lang.RuntimeException

co.ankatech.ankasecure.sdk.auth.ExternalTokenException

co.ankatech.ankasecure.sdk.auth.ClientCredentialsExchangeException

All Implemented Interfaces:

Serializable

public final class ClientCredentialsExchangeException
extends ExternalTokenException

A client-credentials exchange with an external authorization server failed, and this names the PHASE it failed in.

The phase is the whole point. Every one of these failures reaches an operator as "the external token could not be obtained", and that sentence is true of a typo in the issuer URL, of a firewall, of an expired external client secret and of an authorization server that answered a discovery request with an HTML login page. Those are four different afternoons. The platform's own rejection is deliberately uniform - one opaque 401 invalid_client for every cause, so a caller cannot probe which server check failed - but that uniformity is the SERVER's property and copying it here would throw away the only diagnosis the client is entitled to give.

Nothing this exception carries came from the response body. The message names the issuer as scheme://host:port[/path], the phase, and - where the authorization server answered with a status - that status. It never carries the external client secret, the token, the discovery document, an error body, or a Location header: a redirect target is chosen by whoever answered, and echoing it into a message a CLI prints is how an attacker-supplied string reaches an operator's terminal and their logs.

See Also:

• Serialized Form

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static enum	ClientCredentialsExchangeException.Phase	Where in the exchange the failure happened.

Constructor Summary

Constructors

Constructor	Description
ClientCredentialsExchangeException(ClientCredentialsExchangeException.Phase phase, String message)
ClientCredentialsExchangeException(ClientCredentialsExchangeException.Phase phase, String message, Throwable cause)

Method Summary

Modifier and Type	Method	Description
ClientCredentialsExchangeException.Phase	phase()	The phase that failed.

Methods inherited from class java.lang.Throwable

addSuppressed, fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, getSuppressed, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Details

ClientCredentialsExchangeException

public ClientCredentialsExchangeException(ClientCredentialsExchangeException.Phase phase,
 String message)

Parameters:

phase - the phase that failed; must not be null

message - the operator-facing explanation; must name the issuer and the phase, and must carry nothing that came from a response body

ClientCredentialsExchangeException

public ClientCredentialsExchangeException(ClientCredentialsExchangeException.Phase phase,
 String message,
 Throwable cause)

Parameters:

phase - the phase that failed; must not be null

message - the operator-facing explanation

cause - the underlying transport or parse failure

Method Details

phase

public ClientCredentialsExchangeException.Phase phase()

The phase that failed.

Returns:

the phase; never null