Package co.ankatech.ankasecure.sdk.auth

Class NativeSecretTokenSource

java.lang.Object

co.ankatech.ankasecure.sdk.auth.CachingTokenSource

co.ankatech.ankasecure.sdk.auth.NativeSecretTokenSource

All Implemented Interfaces:

TokenSource, AutoCloseable

public final class NativeSecretTokenSource
extends CachingTokenSource

Presents an ANKASecure-issued client_secret - the platform's own credential, and the last link of the resolution chain.

Last is a deliberate ordering, not a ranking of quality. A deployment that has configured an external identity has said something specific about how this workload proves itself; a client secret is very often left behind in a configuration file from an earlier setup. Preferring the secret would mean the external identity someone deliberately configured is quietly never used, and nothing would report it.

This source retains the secret, and it has to

A source that can re-mint after expiry or revocation must hold what it re-mints from. The caller's SecretChars is therefore COPIED at construction rather than referenced, so the caller's own try-with-resources can close theirs on the very next line without emptying this one. The copy is zeroized by close().

Constructor Summary

Constructors

Constructor	Description
NativeSecretTokenSource(co.ankatech.ankasecure.openapi.client.AnkaSecureOpenApiClient client, String clientId, SecretChars clientSecret)

Method Summary

Modifier and Type	Method	Description
void	close()	Discards the cached token.
AuthMechanism	mechanism()	Names the credential kind this source presents.
String	toString()	Names the mechanism and the actor.

Methods inherited from class co.ankatech.ankasecure.sdk.auth.CachingTokenSource

accessToken, cachedExpiry, currentTokenExpiry, hasCachedToken, invalidate

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Details

NativeSecretTokenSource

public NativeSecretTokenSource(co.ankatech.ankasecure.openapi.client.AnkaSecureOpenApiClient client,
 String clientId,
 SecretChars clientSecret)

Parameters:

client - the transport to mint against

clientId - the actor UUID the platform issued

clientSecret - the secret; copied, not retained, and not closed by this constructor

Throws:

NullPointerException - if any argument is null

Method Details

mechanism

public AuthMechanism mechanism()

Description copied from interface: TokenSource

Names the credential kind this source presents. Diagnostic only; nothing branches on it.

Returns:

the mechanism; never null

close

public void close()

Description copied from class: CachingTokenSource

Discards the cached token. Subclasses holding a credential for re-minting override this, release it, and call super.close().

It performs the discard directly rather than by calling CachingTokenSource.invalidate(). Once that method became overridable, routing close through it re-entered the override - so closing a federated source told its provider twice that its token was dead, the second time after the provider had already been closed. Closing releases; invalidating is a caller saying a credential went stale. They are different statements and only one of them belongs in a shutdown path.

Specified by:

close in interface AutoCloseable

Specified by:

close in interface TokenSource

Overrides:

close in class CachingTokenSource

toString

public String toString()

Names the mechanism and the actor. The secret has no representation here at all.

Overrides:

toString in class Object