apache/beam · error · RuntimeException

Problems while refreshing the identification token.

Error message

Problems while refreshing the identification token.

What it means

resolveTokenValue throws a RuntimeException wrapping an IOException when refreshing the Google id token (via IdTokenCredentials.refreshAccessToken()) fails. This is raised at token fetch time, e.g. when the AWS S3 IO needs a web identity token for STS AssumeRoleWithWebIdentity.

Solutions

1. Check the wrapped IOException cause for the OAuth endpoint error detail
2. Verify the service-account key behind ADC still exists and is valid
3. Confirm workers have network access to https://oauth2.googleapis.com
4. Validate the audience value matches the expected OIDC provider configuration

// Pre-check network reachability of OAuth endpoint
boolean reachable = InetAddress.getByName("oauth2.googleapis.com").isReachable(3000);

try {
  String token = provider.resolveTokenValue(audience);
} catch (RuntimeException e) {
  logger.error("token refresh failed: {}", e.getCause());
  throw e;
}

When it happens

Trigger: Calling token()/resolveTokenValue(audience) when the underlying Google credential cannot refresh an access/id token — expired/revoked service account key, network failure to the OAuth endpoint, or misconfigured audience.

Common situations: Deleted or rotated service-account key referenced by ADC; outbound network blocked from worker to oauth2.googleapis.com; invalid target audience for the id token; metadata server unavailable.

Related errors

• Could not find file
• Could not resolve GCP project ID
• Could not resolve table in Data Catalog
• Error constructing default value for gcpTempLocation…
• Error creating Data Catalog client

AI-assisted analysis of apache/beam@12126d8942 (2026-09-13). Data as JSON: /api/errors/b686eb5f95f02eb8. Report an issue: GitHub.

Appendix: source

Thrown at sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/auth/GoogleADCIdTokenProvider.java:72

  }

  @VisibleForTesting
  IdTokenCredentials createIdTokenWithApplicationDefaultCredentials(String audience) {
    return IdTokenCredentials.newBuilder()
        .setIdTokenProvider(this.idTokenProvider)
        .setTargetAudience(audience)
        .setOptions(Arrays.asList(Option.FORMAT_FULL, Option.LICENSES_TRUE))
        .build();
  }

  @Override
  public String resolveTokenValue(String audience) {
    try {
      return createIdTokenWithApplicationDefaultCredentials(audience)
          .refreshAccessToken()
          .getTokenValue();
    } catch (IOException ex) {
      throw new RuntimeException("Problems while refreshing the identification token.", ex);
    }
  }
}

View on GitHub (pinned to 12126d8942)