Support invalidating client's OAuth2 token after receiving an authentication exception

[michaeljmarshall]

Search before asking

• I searched in the issues and found nothing similar.

Motivation

The AuthenticationOAuth2 provider only retrieves a new token when the current one has expired.

pulsar/pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/oauth2/AuthenticationOAuth2.java

Lines 99 to 106 in 82237d3

	@Override
	public synchronized AuthenticationDataProvider getAuthData() throws PulsarClientException {
	if (this.cachedToken == null || this.cachedToken.isExpired()) {
	TokenResult tr = this.flow.authenticate();
	this.cachedToken = new CachedToken(tr);
	}
	return this.cachedToken.getAuthData();
	}

However, when there is an unexpected signing key rotation, which can happen for several reasons, a client will fail to authenticate until the token expires.

Solution

The client could invalidate the cached token and retrieve a new one. Note that this is happening when authentication has already failed, so the current token is already known to be invalid.

Alternatives

No response

Anything else?

No response

Are you willing to submit a PR?

• I'm willing to submit a PR!

[github-actions]

The issue had no activity for 30 days, mark with Stale label.

[MMirelli]

I am trying to solve this one.

[github-actions]

The issue had no activity for 30 days, mark with Stale label.