Checklist
Description
I have observed FgaApiAuthenticationError is thrown intermittently when using OAuth2 client credentials. This occurs most frequently after a period of inactivity where the OpenFgaClient is not used for a long period of time, or at an intervals roughly equal to the OAuth2 access token's expires_in value. I think there may be an issue with the way that OAuth2 tokens are refreshed before expiry.
Expectation
I expect for OAuth2 access tokens to be refreshed automatically before being sent to the openfga api. An expired token should never be sent to the openfga api and the openFgaClient does not intermittently throw FgaApiAuthenticationError
Reproduction
Given:
Given I set up an OpenFgaClient using the Oauth2 Credentials example in the README
var config = new ClientConfiguration()
.apiUrl(System.getenv("FGA_API_URL")) // If not specified, will default to "http://localhost:8080"
.storeId(System.getenv("FGA_STORE_ID")) // Not required when calling createStore() or listStores()
.authorizationModelId(System.getenv("FGA_AUTHORIZATION_MODEL_ID")) // Optional, can be overridden per request
.credentials(new Credentials(
new ClientCredentials()
.apiTokenIssuer(System.getenv("FGA_API_TOKEN_ISSUER"))
.scopes(System.getenv("FGA_API_SCOPES")) // optional space separated scopes
.clientId(System.getenv("FGA_CLIENT_ID"))
.clientSecret(System.getenv("FGA_CLIENT_SECRET"))
));
var openFgaClient = new OpenFgaClient(config);
When:
When I make an openfga check request using the openfgaClient set up using clientCredentials
openFgaClient.check(checkRequest)
Then:
- The openFgaClient always sends a fresh OAuth2 access token to the openfga server.
- The openFgaClient ensures that the OAuth2 access token is refreshed before being sent if it is expired
- The openFgaClient does not intermittently throw
FgaApiAuthenticationError
OpenFGA SDK version
0.4.1
OpenFGA version
1.3.3
SDK Configuration
OAuth2 Client Credentials
Logs
dev.openfga.sdk.errors.FgaApiAuthenticationError: check
at dev.openfga.sdk.errors.FgaError.getError(FgaError.java:49)
at dev.openfga.sdk.api.client.HttpRequestAttempt.lambda$attemptHttpRequest$2(HttpRequestAttempt.java:56)
at java.util.concurrent.CompletableFuture$UniCompose.tryFire(CompletableFuture.java:1150)
at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:510)
at java.util.concurrent.CompletableFuture.postFire(CompletableFuture.java:614)
at java.util.concurrent.CompletableFuture$UniWhenComplete.tryFire(CompletableFuture.java:844)
at java.util.concurrent.CompletableFuture$Completion.run(CompletableFuture.java:482)
at java.lang.Thread.run(Thread.java:833)
References
No response
Checklist
Description
I have observed FgaApiAuthenticationError is thrown intermittently when using OAuth2 client credentials. This occurs most frequently after a period of inactivity where the OpenFgaClient is not used for a long period of time, or at an intervals roughly equal to the OAuth2 access token's
expires_invalue. I think there may be an issue with the way that OAuth2 tokens are refreshed before expiry.Expectation
I expect for OAuth2 access tokens to be refreshed automatically before being sent to the openfga api. An expired token should never be sent to the openfga api and the openFgaClient does not intermittently throw
FgaApiAuthenticationErrorReproduction
Given:
Given I set up an OpenFgaClient using the Oauth2 Credentials example in the README
When:
When I make an openfga check request using the openfgaClient set up using clientCredentials
Then:
FgaApiAuthenticationErrorOpenFGA SDK version
0.4.1
OpenFGA version
1.3.3
SDK Configuration
OAuth2 Client Credentials
Logs
References
No response