Cache access token for client credentials flow

Author: botsteve

security/providers/oidc/src/main/java/io/helidon/security/providers/oidc/OidcProvider.java

@@ -16,13 +16,16 @@
 
 package io.helidon.security.providers.oidc;
 
+import io.helidon.security.SecurityResponse;
 import java.lang.System.Logger.Level;
 import java.lang.annotation.Annotation;
+import java.time.Duration;
 import java.util.Collection;
 import java.util.HashMap;
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 import java.util.Optional;
 import java.util.ServiceLoader;
 import java.util.Set;
@@ -41,7 +44,6 @@
 import io.helidon.security.OutboundSecurityResponse;
 import io.helidon.security.ProviderRequest;
 import io.helidon.security.SecurityEnvironment;
-import io.helidon.security.SecurityResponse;
 import io.helidon.security.Subject;
 import io.helidon.security.abac.scope.ScopeValidator;
 import io.helidon.security.providers.common.OutboundConfig;
@@ -87,7 +89,10 @@ public final class OidcProvider implements AuthenticationProvider, OutboundSecur
     private final boolean propagate;
     private final OidcOutboundConfig outboundConfig;
     private final boolean useJwtGroups;
+    private final ReentrantLock tokenCacheLock = new ReentrantLock();
+    private CachedToken cachedToken;
     private final LruCache<String, TenantAuthenticationHandler> tenantAuthHandlers = LruCache.create();
+    private static final Duration DEFAULT_TOKEN_LIFETIME = Duration.ofMinutes(5);
 
     private OidcProvider(Builder builder, OidcOutboundConfig oidcOutboundConfig) {
         this.optional = builder.optional;
@@ -245,46 +250,74 @@ private OutboundSecurityResponse propagateAccessToken(ProviderRequest providerRe
         return OutboundSecurityResponse.empty();
     }
 
+    /**
+     * Obtains an access token using the client credentials flow and propagates it in the outbound request headers.
+     * <p>
+     * The client credentials flow is used to obtain an access token when the client is acting on its own behalf,
+     * not on behalf of a user. The obtained access token is then propagated in the outbound request headers using
+     * the token handler configured for the outbound target.
+     *
+     * @param providerRequest the provider request context
+     * @param outboundEnv the security environment for the outbound request
+     * @return an {@link OutboundSecurityResponse} with the propagated access token in the headers, or an empty response
+     *         if propagation is not enabled for the outbound target, or a failure response if an error occurs while
+     *         obtaining the access token
+     */
     private OutboundSecurityResponse clientCredentials(ProviderRequest providerRequest, SecurityEnvironment outboundEnv) {
         OidcOutboundTarget target = outboundConfig.findTarget(outboundEnv);
-        boolean enabled = target.propagate;
-        if (enabled) {
-            Parameters.Builder formBuilder = Parameters.builder("oidc-form-params")
-                    .add("grant_type", "client_credentials");
-
-            if (!oidcConfig.baseScopes().isEmpty()) {
-                formBuilder.add("scope", oidcConfig.baseScopes());
-            }
-
-            HttpClientRequest postRequest = oidcConfig.appWebClient()
-                    .post()
-                    .uri(oidcConfig.tokenEndpointUri());
-
-            OidcUtil.updateRequest(OidcConfig.RequestType.ID_AND_SECRET_TO_TOKEN, oidcConfig, formBuilder, postRequest);
+        if (!target.propagate) {
+            return OutboundSecurityResponse.empty();
+        }
 
-            try (var response = postRequest.submit(formBuilder.build())) {
-                if (response.status().family() == Status.Family.SUCCESSFUL) {
-                    JsonObject jsonObject = response.as(JsonObject.class);
-                    String accessToken = jsonObject.getString("access_token");
+        String accessToken;
+        tokenCacheLock.lock();
+        try {
+            if (Objects.nonNull(cachedToken) && cachedToken.isValid()) {
+                accessToken = cachedToken.token;
+            } else {
+                Parameters.Builder formBuilder = Parameters.builder("oidc-form-params")
+                                                     .add("grant_type", "client_credentials");
+
+                if (!oidcConfig.baseScopes().isEmpty()) {
+                    formBuilder.add("scope", oidcConfig.baseScopes());
+                }
 
-                    Map<String, List<String>> headers = new HashMap<>(outboundEnv.headers());
-                    target.tokenHandler.header(headers, accessToken);
-                    return OutboundSecurityResponse.withHeaders(headers);
-                } else {
+                HttpClientRequest postRequest = oidcConfig.appWebClient()
+                                                    .post()
+                                                    .uri(oidcConfig.tokenEndpointUri());
+
+                OidcUtil.updateRequest(OidcConfig.RequestType.ID_AND_SECRET_TO_TOKEN, oidcConfig, formBuilder, postRequest);
+
+                try (var response = postRequest.submit(formBuilder.build())) {
+                    if (response.status().family() == Status.Family.SUCCESSFUL) {
+                        JsonObject jsonObject = response.as(JsonObject.class);
+                        accessToken = jsonObject.getString("access_token");
+                        long expiresIn = jsonObject.containsKey("expires_in")
+                                         ? jsonObject.getJsonNumber("expires_in").longValue() * 1000
+                                         : DEFAULT_TOKEN_LIFETIME.toMillis();
+                        long expiresAt = System.currentTimeMillis() + expiresIn;
+                        cachedToken = new CachedToken(accessToken, expiresAt);
+                    } else {
+                        return OutboundSecurityResponse.builder()
+                                   .status(SecurityResponse.SecurityStatus.FAILURE)
+                                   .description("Could not obtain access token from the identity server")
+                                   .build();
+                    }
+                } catch (Exception e) {
                     return OutboundSecurityResponse.builder()
-                            .status(SecurityResponse.SecurityStatus.FAILURE)
-                            .description("Could not obtain access token from the identity server")
-                            .build();
+                               .status(SecurityResponse.SecurityStatus.FAILURE)
+                               .description("An error occurred while obtaining access token from the identity server")
+                               .throwable(e)
+                               .build();
                 }
-            } catch (Exception e) {
-                return OutboundSecurityResponse.builder()
-                        .status(SecurityResponse.SecurityStatus.FAILURE)
-                        .description("An error occurred while obtaining access token from the identity server")
-                        .throwable(e)
-                        .build();
             }
+        } finally {
+            tokenCacheLock.unlock();
         }
-        return OutboundSecurityResponse.empty();
+
+        Map<String, List<String>> headers = new HashMap<>(outboundEnv.headers());
+        target.tokenHandler.header(headers, accessToken);
+        return OutboundSecurityResponse.withHeaders(headers);
     }
 
     /**
@@ -589,5 +622,21 @@ private OidcOutboundTarget(boolean propagate, TokenHandler handler) {
             tokenHandler = handler;
         }
     }
+
+    private static final class CachedToken {
+
+        static final Duration DEFAULT_BUFFER_TIME = Duration.ofSeconds(10);
+        final String token;
+        final long expiresAtMillis;
+
+        CachedToken(String token, long expiresAtMillis) {
+            this.token = token;
+            this.expiresAtMillis = expiresAtMillis;
+        }
+
+        boolean isValid() {
+            return System.currentTimeMillis() < (expiresAtMillis - DEFAULT_BUFFER_TIME.toMillis());
+        }
+    }
 }