User need
A Python client must authenticate to an authentication-enabled Chronicle kernel without making callers manage bearer-token refresh for each call.
Desired behavior
Provide an async token provider for Chronicle's OAuth client-credentials endpoint and an internal gRPC metadata path that obtains the current token for each new call.
Acceptance evidence
- Sends
application/x-www-form-urlencoded fields grant_type=client_credentials, client_id, and client_secret to /connect/token.
- Parses
access_token and handles an absent expires_in conservatively.
- Caches and refreshes tokens before expiry without duplicate concurrent refreshes.
- Adds
authorization: Bearer <token> to each new gRPC call.
- Never logs or includes secrets or tokens in exceptions and representations.
- Separates development self-signed-certificate handling from production certificate validation.
- Tests cover success, malformed responses, authorization failure, expiry, refresh, cancellation, and concurrent callers.
Non-goals
- Defining deployment-specific scopes, audiences, authorities, or credentials.
- Disabling production certificate or hostname validation by default.
User need
A Python client must authenticate to an authentication-enabled Chronicle kernel without making callers manage bearer-token refresh for each call.
Desired behavior
Provide an async token provider for Chronicle's OAuth client-credentials endpoint and an internal gRPC metadata path that obtains the current token for each new call.
Acceptance evidence
application/x-www-form-urlencodedfieldsgrant_type=client_credentials,client_id, andclient_secretto/connect/token.access_tokenand handles an absentexpires_inconservatively.authorization: Bearer <token>to each new gRPC call.Non-goals