Package co.ankatech.ankasecure.sdk.auth

Class ExplicitExternalTokenProvider

java.lang.Object
co.ankatech.ankasecure.sdk.auth.ExplicitExternalTokenProvider
All Implemented Interfaces:
ExternalTokenProvider
public final class ExplicitExternalTokenProvider extends Object implements ExternalTokenProvider
The token itself, held in memory.

This is the case the platform was actually designed around: a workload that obtained a token from its own authorization server - in its own code, with its own client registration - and now wants to spend it here. It has the token in hand; there is nothing to fetch.

It is also the shortest-lived source, and that is a property rather than a defect. The token this provider holds does not refresh, so a process that outlives it will start failing. A workload that needs to keep running past one external token's lifetime configures the file or command source, or supplies its own ExternalTokenProvider that re-reads from wherever its token actually lives.

  • Constructor Details

    • ExplicitExternalTokenProvider

      public ExplicitExternalTokenProvider(SecretChars token)
      Takes a defensive copy of the supplied token so the caller's own close does not empty this provider.
      Parameters:
      token - the externally minted token; not retained, not closed, and not modified
      Throws:
      NullPointerException - if token is null
      IllegalArgumentException - if token is empty

  • Method Details

    • fetchExternalToken

      public SecretChars fetchExternalToken()
      Description copied from interface: ExternalTokenProvider
      Produces the current external token.

      How current it is belongs to the implementation, and the two answers are both correct for their case. A provider that READS an out-of-band token re-reads on every call, because something else refreshes it and a copy held here is a copy that expires without anyone noticing. A provider that OBTAINS the token itself knows the lifetime its issuer stated for it, so it may reuse one inside that lifetime - and when the issuer states no lifetime, it falls back to fetching per call rather than guessing one.

      Specified by:
      fetchExternalToken in interface ExternalTokenProvider
      Returns:
      the token; the caller takes ownership and closes it

    • kind

      public ExternalTokenSourceKind kind()
      Description copied from interface: ExternalTokenProvider
      Which of the configured source kinds this provider is, or null for a consumer-supplied provider that is none of them.
      Specified by:
      kind in interface ExternalTokenProvider
      Returns:
      the kind, or null when the provider is the consumer's own

    • describe

      public String describe()
      Description copied from interface: ExternalTokenProvider
      A short operator-facing description of WHERE the token comes from - a path, a command name, an issuer - for diagnostics. It must never contain the token.
      Specified by:
      describe in interface ExternalTokenProvider
      Returns:
      the description; never null

    • toString

      public String toString()
      Names the kind and reveals nothing, so an accidental log statement leaks nothing.
      Overrides:
      toString in class Object