Method refreshToken

auth/workloadidentity.go:169–260

(ctx context.Context, httpClient HTTPDoer)

}

func (w *WorkloadIdentityAuth) refreshToken(ctx context.Context, httpClient HTTPDoer) (string, error) {
	if httpClient == nil {
		httpClient = http.DefaultClient
	}

	subjectToken, err := w.config.Provider.GetToken(ctx, httpClient)
	if err != nil {
		return "", err
	}

	subjectTokenType := w.config.Provider.TokenType()
	var subjectTokenTypeURN string
	switch subjectTokenType {
	case SubjectTokenTypeJWT:
		subjectTokenTypeURN = JWTTokenType
	case SubjectTokenTypeID:
		subjectTokenTypeURN = IDTokenType
	default:
		return "", fmt.Errorf("unsupported subject token type %q", subjectTokenType)
	}

	requestBody := tokenExchangeRequest{
		GrantType:          TokenExchangeGrantType,
		ClientID:           w.config.ClientID,
		SubjectToken:       subjectToken,
		SubjectTokenType:   subjectTokenTypeURN,
		IdentityProviderID: w.config.IdentityProviderID,
		ServiceAccountID:   w.config.ServiceAccountID,
	}

	jsonBody, err := json.Marshal(requestBody)
	if err != nil {
		return "", fmt.Errorf("failed to marshal token exchange request: %w", err)
	}

	req, err := http.NewRequestWithContext(ctx, "POST", TokenExchangeURL, bytes.NewReader(jsonBody))
	if err != nil {
		return "", fmt.Errorf("failed to create token exchange request: %w", err)
	}
	req.Header.Set("Content-Type", "application/json")

	resp, err := httpClient.Do(req)
	if err != nil {
		return "", fmt.Errorf("failed to exchange token: %w", err)
	}
	defer resp.Body.Close()

	body, err := io.ReadAll(resp.Body)
	if err != nil {
		return "", fmt.Errorf("failed to read token exchange response: %w", err)
	}

	if resp.StatusCode == http.StatusBadRequest || resp.StatusCode == http.StatusUnauthorized || resp.StatusCode == http.StatusForbidden {
		var oauthErr struct {
			Error            string `json:"error"`
			ErrorDescription string `json:"error_description"`
		}
		if json.Unmarshal(body, &oauthErr) == nil {