{"record":{"id":"b686eb5f95f02eb8","repo":"apache/beam","slug":"problems-while-refreshing-the-identification-token","errorCode":null,"errorMessage":"Problems while refreshing the identification token.","messagePattern":"Problems while refreshing the identification token\\.","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/auth/GoogleADCIdTokenProvider.java","lineNumber":72,"sourceCode":"  }\n\n  @VisibleForTesting\n  IdTokenCredentials createIdTokenWithApplicationDefaultCredentials(String audience) {\n    return IdTokenCredentials.newBuilder()\n        .setIdTokenProvider(this.idTokenProvider)\n        .setTargetAudience(audience)\n        .setOptions(Arrays.asList(Option.FORMAT_FULL, Option.LICENSES_TRUE))\n        .build();\n  }\n\n  @Override\n  public String resolveTokenValue(String audience) {\n    try {\n      return createIdTokenWithApplicationDefaultCredentials(audience)\n          .refreshAccessToken()\n          .getTokenValue();\n    } catch (IOException ex) {\n      throw new RuntimeException(\"Problems while refreshing the identification token.\", ex);\n    }\n  }\n}\n","sourceCodeStart":54,"sourceCodeEnd":76,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/auth/GoogleADCIdTokenProvider.java#L54-L76","documentation":"resolveTokenValue throws a RuntimeException wrapping an IOException when refreshing the Google id token (via IdTokenCredentials.refreshAccessToken()) fails. This is raised at token fetch time, e.g. when the AWS S3 IO needs a web identity token for STS AssumeRoleWithWebIdentity.","triggerScenarios":"Calling token()/resolveTokenValue(audience) when the underlying Google credential cannot refresh an access/id token — expired/revoked service account key, network failure to the OAuth endpoint, or misconfigured audience.","commonSituations":"Deleted or rotated service-account key referenced by ADC; outbound network blocked from worker to oauth2.googleapis.com; invalid target audience for the id token; metadata server unavailable.","solutions":["Check the wrapped IOException cause for the OAuth endpoint error detail","Verify the service-account key behind ADC still exists and is valid","Confirm workers have network access to https://oauth2.googleapis.com","Validate the audience value matches the expected OIDC provider configuration"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Pre-check network reachability of OAuth endpoint\nboolean reachable = InetAddress.getByName(\"oauth2.googleapis.com\").isReachable(3000);","typeGuard":null,"tryCatchPattern":"try {\n  String token = provider.resolveTokenValue(audience);\n} catch (RuntimeException e) {\n  logger.error(\"token refresh failed: {}\", e.getCause());\n  throw e;\n}","preventionTips":["Rotate keys without deleting the ones ADC references","Allow egress to oauth2.googleapis.com from workers","Cache tokens and refresh only near expiry"],"tags":["java","gcp","oauth","token-refresh"],"backgroundTag":"oauth-token-exchange-failed","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}