How to hot-reload JWT token (Java Client)

[ossibaer]

Hey folks,

I'm trying to set up a Pulsar Java Client with JWT Authorization following this guide: https://pulsar.apache.org/docs/3.2.x/security-jwt/#configure-jwt-authentication-in-pulsar-clients
The token used is only valid for a few hours & then is updated in the application. I thought that using a Supplier the token is fetched before sending a new message, but it seems it is only read once when creating a new client. Do I have to create new clients each time or is there a better way?

[lhotari]

This is a current gap in the client: #22314 (JWT) and #13951 (for OAuth2/OIDC). Contributions are welcome!

[tsturzl]

@lhotari So currently this token Supplier strategy does not actually pull new tokens when the previous one expires? This doesn't seem like a feature request, but rather a bug fix. I don't see any other reason to provide a Supplier than to provide the client with a way to refresh it's credentials... Also the documentation both in the Java client library and the pulsar docs themselves seems to suggest that this is the expected behavior, meanwhile it has never been implemented. I think the overwhelming user perspective on this would be that it is not the expected or understood behavior.

[lhotari]

@tsturzl I agree with you that it's overwhelming when it's in this state. The Apache Pulsar is run by volunteers and unless someone commits to improve things, it will remain in the same state. Would you be interested in helping out to make improvements in this area?