Potential token refresh timeout issue in Versions 2.91.0, 2.93.0, and 2.95.0 (Fixed in 2.97.0)

If you are using OCI Java SDK version 2.91.0, 2.93.0, or 2.95.0, you may be affected by a token refresh timeout issue. We recommend updating to version 2.97.0 or later. If you are not using an affected version, you can ignore this issue.

Description

X509FederationClient coordinates concurrent security-token refresh requests so that one request performs the refresh while other requests wait for its result.

In the affected versions, a failure while refreshing a session key or X509 certificate can leave the shared refresh operation incomplete. Later requests using the same authentication provider may continue waiting for a refresh that is no longer running and fail with:

Timed out waiting for security token refresh.

This condition may affect multiple OCI service clients when they share the same authentication provider. Recreating the authentication provider or restarting the application may provide temporary recovery, but upgrading is the recommended solution.

Affected Versions

• 2.91.0
• 2.93.0
• 2.95.0

Actions

Update the OCI Java SDK BOM or com.oracle.oci.sdk:oci-java-sdk-common to version 2.97.0 or later.

Version 2.97.0 includes the fix to clear failed refresh operations and allow later requests to attempt token refresh again.

References

• Original report and technical analysis: https://github.com/oracle/oci-java-sdk/issues/777
• Fixed release: https://github.com/oracle/oci-java-sdk/releases/tag/v2.97.0

Start with the X509FederationClient behavior described here and review the original report in issue #777. The issue states that the fix is already included in version 2.97.0; done means updating the OCI Java SDK BOM or oci-java-sdk-common to 2.97.0 or later.