Class OAuth2ServiceIdentityProvider

java.lang.Object
com.kingsrook.qqq.backend.core.serviceidentity.OAuth2ServiceIdentityProvider
All Implemented Interfaces:
QServiceIdentityProviderInterface
public class OAuth2ServiceIdentityProvider extends Object implements QServiceIdentityProviderInterface
Service principals under OAuth2 (docs/SERVICE-IDENTITY.md section 4.3). The principal's service account credentials (environment only) buy a real access token with client_credentials; the session is then built by the module's bearer verification and customizer (createServiceSession: same verifier, plus the token must name the configured account; never via the session store), so OAuth2 gains no new way to accept a session: issuer, signature, audience, lifetime and the customizer's policy mapping all apply. Tokens are cached per node, in memory only, for at most MAX_CACHE (and never handed out with less than MIN_REMAINING left). The cache is registered with ClusterCaches: a key-only invalidate (the principal's name, no token material) drops a principal's token on every node, e.g. after a refusal. Refusals back off (30 s doubling to 5 minutes) and raise an alert; there is never a fallback to a system session.