Package io.camunda.client.impl.oauth

Class OAuthCredentialsProviderBuilder

java.lang.Object

io.camunda.client.impl.oauth.OAuthCredentialsProviderBuilder

public final class OAuthCredentialsProviderBuilder
extends Object

Field Summary

Fields

Modifier and Type	Field	Description
static final String	DEFAULT_AUTHZ_SERVER
static final Duration	DEFAULT_CONNECT_TIMEOUT
static final String	DEFAULT_CREDENTIALS_CACHE_PATH	Historical default path for the persistent credentials cache file.
static final Duration	DEFAULT_PROACTIVE_TOKEN_REFRESH_THRESHOLD
static final Duration	DEFAULT_READ_TIMEOUT
static final double	DEFAULT_TOKEN_FETCH_BACKOFF_MULTIPLIER
static final Duration	DEFAULT_TOKEN_FETCH_INITIAL_BACKOFF
static final int	DEFAULT_TOKEN_FETCH_MAX_RETRIES
static final Duration	DEFAULT_TOKEN_FETCH_NON_RETRYABLE_COOLDOWN
static final Set<Integer>	DEFAULT_TOKEN_FETCH_RETRYABLE_STATUS_CODES	HTTP status codes from the token endpoint that should trigger a retry with backoff.
static final String	INVALID_ARGUMENT_MSG

Constructor Summary

Constructors

Constructor	Description
OAuthCredentialsProviderBuilder()

Method Summary

Modifier and Type	Method	Description
OAuthCredentialsProviderBuilder	applyEnvironmentOverrides(boolean applyEnvironmentOverrides)
OAuthCredentialsProviderBuilder	audience(String audience)	The resource for which the access token should be valid.
OAuthCredentialsProviderBuilder	authorizationServerUrl(String authorizationServerUrl)	The authorization server's URL, from which the access token will be requested.
OAuthCredentialsProvider	build()
boolean	clientAssertionEnabled()
OAuthCredentialsProviderBuilder	clientAssertionKeystoreKeyAlias(String clientAssertionKeystoreKeyAlias)
OAuthCredentialsProviderBuilder	clientAssertionKeystoreKeyPassword(String clientAssertionKeystoreKeyPassword)
OAuthCredentialsProviderBuilder	clientAssertionKeystorePassword(String clientAssertionKeystorePassword)
OAuthCredentialsProviderBuilder	clientAssertionKeystorePath(String clientAssertionKeystorePath)
OAuthCredentialsProviderBuilder	clientAssertionKeystorePath(Path clientAssertionKeystorePath)
OAuthCredentialsProviderBuilder	clientId(String clientId)	Client id to be used when requesting access token from OAuth authorization server.
OAuthCredentialsProviderBuilder	clientSecret(String clientSecret)	Client secret to be used when requesting access token from OAuth authorization server.
OAuthCredentialsProviderBuilder	connectTimeout(Duration connectTimeout)	The connection timeout of requests to the OAuth credentials provider.
OAuthCredentialsProviderBuilder	credentialsCachePath(String cachePath)	The location for the persistent credentials cache file.
URL	getAuthorizationServer()
String	getClientAssertionKeystoreKeyAlias()
String	getClientAssertionKeystoreKeyPassword()
String	getClientAssertionKeystorePassword()
Path	getClientAssertionKeystorePath()
Duration	getConnectTimeout()
File	getCredentialsCache()
Duration	getProactiveTokenRefreshThreshold()
Duration	getReadTimeout()
String	getResource()
double	getTokenFetchBackoffMultiplier()
Duration	getTokenFetchInitialBackoff()
int	getTokenFetchMaxRetries()
Duration	getTokenFetchNonRetryableCooldown()
Set<Integer>	getTokenFetchRetryableStatusCodes()
OAuthCredentialsProviderBuilder	issuerUrl(String issuerUrl)	The URL of the issuer that will issue the access token.
OAuthCredentialsProviderBuilder	keystoreKeyPassword(String keystoreKeyPassword)	Keystore key password used for OAuth identity provider
OAuthCredentialsProviderBuilder	keystorePassword(String keystorePassword)	Password to keystore used for OAuth identity provider
OAuthCredentialsProviderBuilder	keystorePath(Path keystorePath)	Path to keystore used for OAuth identity provider
OAuthCredentialsProviderBuilder	proactiveTokenRefreshThreshold(Duration proactiveTokenRefreshThreshold)	Window before actual token expiry during which a background refresh is triggered eagerly.
OAuthCredentialsProviderBuilder	readTimeout(Duration readTimeout)	The data read timeout of requests to the OAuth credentials provider.
OAuthCredentialsProviderBuilder	resource(String resource)	The resource for which the access token should be valid.
OAuthCredentialsProviderBuilder	scope(String scope)	The scopes of the access token.
OAuthCredentialsProviderBuilder	tokenFetchBackoffMultiplier(double tokenFetchBackoffMultiplier)	The multiplier applied to the backoff duration between successive token fetch retry attempts.
OAuthCredentialsProviderBuilder	tokenFetchInitialBackoff(Duration tokenFetchInitialBackoff)	The initial backoff duration applied between token fetch retry attempts.
OAuthCredentialsProviderBuilder	tokenFetchMaxRetries(int tokenFetchMaxRetries)	The maximum number of attempts (including the initial one) when fetching a token from the OAuth authorization server.
OAuthCredentialsProviderBuilder	tokenFetchNonRetryableCooldown(Duration tokenFetchNonRetryableCooldown)	The cooldown duration applied after the token endpoint returns a non-retryable response.
OAuthCredentialsProviderBuilder	tokenFetchRetryableStatusCodes(Set<Integer> tokenFetchRetryableStatusCodes)	The set of HTTP status codes from the token endpoint that should be retried with backoff.
OAuthCredentialsProviderBuilder	truststorePassword(String truststorePassword)	Password to truststore used for OAuth identity provider
OAuthCredentialsProviderBuilder	truststorePath(Path truststorePath)	Path to truststore used for OAuth identity provider
OAuthCredentialsProviderBuilder	wellKnownConfigurationUrl(String wellKnownConfigurationUrl)	The well known configuration URL of the issuer that will issue the access token.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

INVALID_ARGUMENT_MSG

public static final String INVALID_ARGUMENT_MSG

See Also:

• Constant Field Values

DEFAULT_CONNECT_TIMEOUT

public static final Duration DEFAULT_CONNECT_TIMEOUT

DEFAULT_READ_TIMEOUT

public static final Duration DEFAULT_READ_TIMEOUT

DEFAULT_PROACTIVE_TOKEN_REFRESH_THRESHOLD

public static final Duration DEFAULT_PROACTIVE_TOKEN_REFRESH_THRESHOLD

DEFAULT_CREDENTIALS_CACHE_PATH

public static final String DEFAULT_CREDENTIALS_CACHE_PATH

Historical default path for the persistent credentials cache file. This path is not applied automatically; file-based caching is opt-in and activates only when credentialsCachePath(String) is set to a non-empty value (directly, via Spring property, or via CAMUNDA_CLIENT_CONFIG_PATH). Callers wanting to reproduce the pre-8.10 default behavior can reference this constant explicitly.

DEFAULT_AUTHZ_SERVER

public static final String DEFAULT_AUTHZ_SERVER

See Also:

• Constant Field Values

DEFAULT_TOKEN_FETCH_MAX_RETRIES

public static final int DEFAULT_TOKEN_FETCH_MAX_RETRIES

See Also:

• Constant Field Values

DEFAULT_TOKEN_FETCH_INITIAL_BACKOFF

public static final Duration DEFAULT_TOKEN_FETCH_INITIAL_BACKOFF

DEFAULT_TOKEN_FETCH_BACKOFF_MULTIPLIER

public static final double DEFAULT_TOKEN_FETCH_BACKOFF_MULTIPLIER

See Also:

• Constant Field Values

DEFAULT_TOKEN_FETCH_NON_RETRYABLE_COOLDOWN

public static final Duration DEFAULT_TOKEN_FETCH_NON_RETRYABLE_COOLDOWN

DEFAULT_TOKEN_FETCH_RETRYABLE_STATUS_CODES

public static final Set<Integer> DEFAULT_TOKEN_FETCH_RETRYABLE_STATUS_CODES

HTTP status codes from the token endpoint that should trigger a retry with backoff. Any other non-200 status code is treated as a non-retryable failure and trips the latch. IOException (network/timeout) is always retried independently of this set.

Constructor Details

OAuthCredentialsProviderBuilder

public OAuthCredentialsProviderBuilder()

Method Details

clientId

public OAuthCredentialsProviderBuilder clientId(String clientId)

Client id to be used when requesting access token from OAuth authorization server.

clientSecret

public OAuthCredentialsProviderBuilder clientSecret(String clientSecret)

Client secret to be used when requesting access token from OAuth authorization server.

audience

public OAuthCredentialsProviderBuilder audience(String audience)

The resource for which the access token should be valid.

scope

public OAuthCredentialsProviderBuilder scope(String scope)

The scopes of the access token.

resource

public OAuthCredentialsProviderBuilder resource(String resource)

The resource for which the access token should be valid.

getResource

public String getResource()

See Also:

• resource(String)

authorizationServerUrl

public OAuthCredentialsProviderBuilder authorizationServerUrl(String authorizationServerUrl)

The authorization server's URL, from which the access token will be requested.

wellKnownConfigurationUrl

public OAuthCredentialsProviderBuilder wellKnownConfigurationUrl(String wellKnownConfigurationUrl)

The well known configuration URL of the issuer that will issue the access token.

issuerUrl

public OAuthCredentialsProviderBuilder issuerUrl(String issuerUrl)

The URL of the issuer that will issue the access token.

getAuthorizationServer

public URL getAuthorizationServer()

See Also:

• authorizationServerUrl(String)

keystorePath

public OAuthCredentialsProviderBuilder keystorePath(Path keystorePath)

Path to keystore used for OAuth identity provider

keystorePassword

public OAuthCredentialsProviderBuilder keystorePassword(String keystorePassword)

Password to keystore used for OAuth identity provider

keystoreKeyPassword

public OAuthCredentialsProviderBuilder keystoreKeyPassword(String keystoreKeyPassword)

Keystore key password used for OAuth identity provider

truststorePath

public OAuthCredentialsProviderBuilder truststorePath(Path truststorePath)

Path to truststore used for OAuth identity provider

truststorePassword

public OAuthCredentialsProviderBuilder truststorePassword(String truststorePassword)

Password to truststore used for OAuth identity provider

credentialsCachePath

public OAuthCredentialsProviderBuilder credentialsCachePath(String cachePath)

The location for the persistent credentials cache file. If unset or empty, the provider caches credentials only in memory and does not persist them across restarts — this is the default. Set this to a writable path to opt in to file-based caching; the path must be writable or the first cache write will fail.

getCredentialsCache

public File getCredentialsCache()

See Also:

• credentialsCachePath(String)

connectTimeout

public OAuthCredentialsProviderBuilder connectTimeout(Duration connectTimeout)

The connection timeout of requests to the OAuth credentials provider. The default value is 5 seconds. Max value is Integer.MAX_VALUE milliseconds.

getConnectTimeout

public Duration getConnectTimeout()

See Also:

• connectTimeout(Duration)

readTimeout

public OAuthCredentialsProviderBuilder readTimeout(Duration readTimeout)

The data read timeout of requests to the OAuth credentials provider. The default value is 5 seconds. Max value is Integer.MAX_VALUE milliseconds.

getReadTimeout

public Duration getReadTimeout()

See Also:

• readTimeout(Duration)

proactiveTokenRefreshThreshold

public OAuthCredentialsProviderBuilder proactiveTokenRefreshThreshold(Duration proactiveTokenRefreshThreshold)

Window before actual token expiry during which a background refresh is triggered eagerly. The token remains valid inside this window; this is purely a policy knob controlling how early refresh kicks in, so concurrent callers don't have to block on a synchronous refresh at the cliff edge. Must be strictly larger than CamundaClientCredentials.EXPIRY_GRACE_PERIOD. The default is 30 seconds.

getProactiveTokenRefreshThreshold

public Duration getProactiveTokenRefreshThreshold()

See Also:

• proactiveTokenRefreshThreshold(Duration)

tokenFetchMaxRetries

public OAuthCredentialsProviderBuilder tokenFetchMaxRetries(int tokenFetchMaxRetries)

The maximum number of attempts (including the initial one) when fetching a token from the OAuth authorization server. Retries are only attempted on IOException or HTTP status codes configured via tokenFetchRetryableStatusCodes(Set). The default value is 5.

getTokenFetchMaxRetries

public int getTokenFetchMaxRetries()

See Also:

• tokenFetchMaxRetries(int)

tokenFetchInitialBackoff

public OAuthCredentialsProviderBuilder tokenFetchInitialBackoff(Duration tokenFetchInitialBackoff)

The initial backoff duration applied between token fetch retry attempts. Subsequent delays grow geometrically by tokenFetchBackoffMultiplier(double). The default value is 1 second.

If the token endpoint replies with a Retry-After header, the server-specified delay always takes precedence over the computed backoff, regardless of whether it is shorter or longer. The total retry duration may therefore differ from what the initialBackoff * multiplier^n progression alone would suggest.

getTokenFetchInitialBackoff

public Duration getTokenFetchInitialBackoff()

See Also:

• tokenFetchInitialBackoff(Duration)

tokenFetchBackoffMultiplier

public OAuthCredentialsProviderBuilder tokenFetchBackoffMultiplier(double tokenFetchBackoffMultiplier)

The multiplier applied to the backoff duration between successive token fetch retry attempts. Must be greater than or equal to 1.0. The default value is 2.0.

getTokenFetchBackoffMultiplier

public double getTokenFetchBackoffMultiplier()

See Also:

• tokenFetchBackoffMultiplier(double)

tokenFetchRetryableStatusCodes

public OAuthCredentialsProviderBuilder tokenFetchRetryableStatusCodes(Set<Integer> tokenFetchRetryableStatusCodes)

The set of HTTP status codes from the token endpoint that should be retried with backoff. Any non-200 status code outside this set trips the non-retryable-failure cooldown: token fetches fail fast for the duration configured via tokenFetchNonRetryableCooldown(Duration) (default 5 minutes), after which the provider automatically probes again. The default is DEFAULT_TOKEN_FETCH_RETRYABLE_STATUS_CODES. Setting this fully replaces the default; callers wanting to extend or shrink the default should derive from DEFAULT_TOKEN_FETCH_RETRYABLE_STATUS_CODES.

getTokenFetchRetryableStatusCodes

public Set<Integer> getTokenFetchRetryableStatusCodes()

See Also:

• tokenFetchRetryableStatusCodes(Set)

tokenFetchNonRetryableCooldown

public OAuthCredentialsProviderBuilder tokenFetchNonRetryableCooldown(Duration tokenFetchNonRetryableCooldown)

The cooldown duration applied after the token endpoint returns a non-retryable response. For the length of this cooldown, all subsequent token fetches fail immediately without contacting the OIDC provider. After the cooldown elapses, the next call clears the latch and attempts a fresh fetch; if it fails again non-retryably, the latch re-arms with a new cooldown. This prevents hammering the OIDC provider during misconfiguration while still allowing automatic recovery from transient non-retryable-looking failures (e.g. credential rotation in-flight, load balancer flaps). The default is DEFAULT_TOKEN_FETCH_NON_RETRYABLE_COOLDOWN.

getTokenFetchNonRetryableCooldown

public Duration getTokenFetchNonRetryableCooldown()

See Also:

• tokenFetchNonRetryableCooldown(Duration)

clientAssertionKeystorePath

public OAuthCredentialsProviderBuilder clientAssertionKeystorePath(String clientAssertionKeystorePath)

clientAssertionKeystorePath

public OAuthCredentialsProviderBuilder clientAssertionKeystorePath(Path clientAssertionKeystorePath)

clientAssertionKeystorePassword

public OAuthCredentialsProviderBuilder clientAssertionKeystorePassword(String clientAssertionKeystorePassword)

clientAssertionKeystoreKeyPassword

public OAuthCredentialsProviderBuilder clientAssertionKeystoreKeyPassword(String clientAssertionKeystoreKeyPassword)

clientAssertionKeystoreKeyAlias

public OAuthCredentialsProviderBuilder clientAssertionKeystoreKeyAlias(String clientAssertionKeystoreKeyAlias)

getClientAssertionKeystorePath

public Path getClientAssertionKeystorePath()

getClientAssertionKeystorePassword

public String getClientAssertionKeystorePassword()

getClientAssertionKeystoreKeyAlias

public String getClientAssertionKeystoreKeyAlias()

getClientAssertionKeystoreKeyPassword

public String getClientAssertionKeystoreKeyPassword()

clientAssertionEnabled

public boolean clientAssertionEnabled()

applyEnvironmentOverrides

public OAuthCredentialsProviderBuilder applyEnvironmentOverrides(boolean applyEnvironmentOverrides)

build

public OAuthCredentialsProvider build()

Returns:

a new OAuthCredentialsProvider with the provided configuration options.