Affected >= oci-java-sdk-common:2.91.0 (not 3.xx.x): "inFlightRefresh" is stuck when Leader is exit before "try/catch" block

[k2chogori]

Suggested title

X509FederationClient leaves inFlightRefresh incomplete when the refresh leader fails before cleanup

Description

Summary

X509FederationClient can become permanently stuck after an exception during session-key or
certificate refresh.

The single-flight implementation assigns a new CompletableFuture to inFlightRefresh, but several
operations that can throw are executed before the try/catch/finally responsible for completing and
clearing that future.

If one of those operations throws:

1. The Leader exits without completing inFlightRefresh.
2. inFlightRefresh remains non-null and incomplete.
3. Every subsequent caller becomes a Follower.
4. Each Follower waits one minute and fails with Timed out waiting for security token refresh.
5. The affected X509FederationClient does not recover. Recreating the authentication provider or
   restarting the process is required.

Affected versions

Confirmed by a standalone reproducer:

• oci-java-sdk-common:2.91.0
• oci-java-sdk-common:2.93.0

Production stack traces from both observed incidents reported Oracle-JavaSDK/2.92.0.

The issue was introduced by commit
6a737779038869e1ca2948868a225736befdae0e,
which released version 2.91.0 and added the single-flight implementation.

The relevant file is unchanged between public tags v2.91.0 and v2.93.0.

This can be verified with:

git diff v2.91.0 v2.93.0 -- \
  bmc-common/src/main/java/com/oracle/bmc/auth/internal/X509FederationClient.java

The command produces no output.

Source-code evidence

In
X509FederationClient.refreshAndGetSecurityTokenInner,
the Leader publishes the incomplete future:

future = new CompletableFuture<>();
inFlightRefresh = future;
iAmTheLeader = true;

The following operations are then executed before the cleanup try/finally:

sessionKeySupplier.refreshKeys();
((Refreshable) leafCertificateSupplier).refresh();
AuthUtils.getTenantIdFromCertificate(...);
((Refreshable) supplier).refresh();

The cleanup block starts only later:

try {
    securityTokenAdapter = getSecurityTokenFromServer();
    String token = securityTokenAdapter.getSecurityToken();
    future.complete(token);
    return token;
} catch (Exception e) {
    future.completeExceptionally(e);
    throw new BmcException(false, "Error refreshing security token.", e, null);
} finally {
    inFlightRefresh = null;
}

An exception thrown before this try bypasses both:

future.completeExceptionally(e);
inFlightRefresh = null;

The leaf-certificate block catches only RefreshFailedException. In the production failures described
below, URLBasedX509CertificateSupplier exhausted its retries and threw:

java.lang.IllegalArgumentException: Open stream of certificate failed.
Caused by: java.io.FileNotFoundException:
http://169.254.169.254/opc/v2/identity/cert.pem

This exception escaped at:

URLBasedX509CertificateSupplier.refresh
X509FederationClient.refreshAndGetSecurityTokenInner:248

Before the introducing commit, refresh was performed entirely under the existing synchronized block
and there was no persistent inFlightRefresh state that could be left incomplete.

Minimal reproduction

Use this dependency:

<dependency>
  <groupId>com.oracle.oci.sdk</groupId>
  <artifactId>oci-java-sdk-common</artifactId>
  <version>2.93.0</version>
</dependency>

1. Construct an X509FederationClient with an X509CertificateSupplier that also implements
   javax.security.auth.Refreshable.
2. Make its refresh() method throw IllegalArgumentException, matching the terminal exception from
   URLBasedX509CertificateSupplier.
3. Call refreshAndGetSecurityToken(). This caller becomes the Leader and exits with the simulated
   certificate failure.
4. Inspect inFlightRefresh: it is non-null and isDone() is false.
5. Call refreshAndGetSecurityToken() from another thread. It becomes a Follower and times out after
   one minute.

Observed output using the real oci-java-sdk-common:2.93.0 artifact:

Loaded SDK artifact: .../oci-java-sdk-common/2.93.0/oci-java-sdk-common-2.93.0.jar

[EXPECTED FAILURE]
  Leader stopped with: Simulated failure reading IMDS cert.pem

[SDK STATE]
  Does inFlightRefresh still exist? YES
  Has inFlightRefresh completed?       NO

[FOLLOWER RESULT]
  Exception: com.oracle.bmc.model.BmcException
  Message:   (-1, null, false) Timed out waiting for security token refresh.

VERDICT: BUG REPRODUCED

The reproducer does not require OCI credentials or network access.

Production evidence

The same sequence was observed independently in two long-running Java processes on OCI compute
instances:

[Leader] About to refresh security token.
Refreshing session keys.
Attempt 1 to open stream of certificate failed.
Attempt 2 to open stream of certificate failed.
Attempt 3 to open stream of certificate failed.
java.lang.IllegalArgumentException: Open stream of certificate failed.
Caused by: java.io.FileNotFoundException:
http://169.254.169.254/opc/v2/identity/cert.pem

After the Leader terminated, subsequent callers repeatedly logged:

[Follower] Waiting on leader's result.
com.oracle.bmc.model.BmcException:
Timed out waiting for security token refresh.
Caused by: java.util.concurrent.TimeoutException

In one occurrence, the logs contained 62 Follower timeouts. Authenticated Monitoring operations
continued failing until the process restarted. Restarting created a new authentication provider and
immediately restored token refresh.

There is an additional timeout mismatch: the certificate supplier's three retries can take longer
than the hard-coded one-minute Follower wait, so Followers may time out even while a slow Leader is
still retrying. The persistent failure described in this issue remains after that Leader has exited
because its future is never completed or cleared.

Expected behavior

Every Leader exit path should:

1. Complete the shared future, normally or exceptionally.
2. Clear inFlightRefresh.
3. Allow a later caller to become a new Leader and retry.

Followers should receive the Leader's original exception rather than wait for a future that can never
complete.

Suggested fix

Move all Leader operations under the same try/catch/finally:

if (iAmTheLeader) {
    try {
        if (refreshKeys) {
            sessionKeySupplier.refreshKeys();
        }

        refreshLeafCertificate();
        validateTenancy();
        refreshIntermediateCertificates();

        securityTokenAdapter = getSecurityTokenFromServer();
        String token = securityTokenAdapter.getSecurityToken();
        future.complete(token);
        return token;
    } catch (Exception e) {
        future.completeExceptionally(e);
        throw new BmcException(false, "Error refreshing security token.", e, null);
    } finally {
        inFlightRefresh = null;
    }
}

(content is generated by AI, but was read by human and it makes sense)

[k2chogori]

Bug reproducer code:

package example;

import com.oracle.bmc.auth.SessionKeySupplier;
import com.oracle.bmc.auth.X509CertificateSupplier;
import com.oracle.bmc.auth.internal.X509FederationClient;
import java.lang.reflect.Field;
import java.security.GeneralSecurityException;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.cert.X509Certificate;
import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.RSAPublicKey;
import java.time.Duration;
import java.util.Collections;
import java.util.concurrent.CompletableFuture;
import java.util.concurrent.ExecutionException;
import java.util.concurrent.ExecutorService;
import java.util.concurrent.Executors;
import java.util.concurrent.Future;
import java.util.concurrent.TimeUnit;
import java.util.concurrent.TimeoutException;
import javax.security.auth.Refreshable;

/**
 * Reproduces the stale inFlightRefresh state in affected OCI Java SDK versions.
 *
 * <p>No OCI credentials or network access are needed. The certificate supplier intentionally fails
 * before the SDK reaches its cleanup block.
 */
public final class SdkRefreshBugDemo {
    private static final Duration FAST_OBSERVATION_TIME = Duration.ofSeconds(2);
    private static final String DIVIDER =
            "===============================================================================";
    private static final String STEP_DIVIDER =
            "-------------------------------------------------------------------------------";

    private SdkRefreshBugDemo() {}

    public static void main(String[] args) throws Exception {
        boolean waitForSdkTimeout =
                args.length == 1 && "--wait-for-sdk-timeout".equals(args[0]);
        boolean hasSingleFlightRefresh = hasInFlightRefreshField();

        printIntroduction(waitForSdkTimeout, hasSingleFlightRefresh);

        X509FederationClient client =
                new X509FederationClient(
                        "http://127.0.0.1:1",
                        "ocid1.tenancy.oc1..demo",
                        new FailingCertificateSupplier(),
                        new DemoSessionKeySupplier(),
                        Collections.emptySet(),
                        null,
                        Collections.emptyList(),
                        null);

        printStep(
                1,
                hasSingleFlightRefresh
                        ? "The first thread starts a token refresh and becomes the Leader"
                        : "The first thread starts a token refresh",
                "The test certificate supplier will now simulate a failure while reading cert.pem.");
        try {
            client.refreshAndGetSecurityToken();
            throw new IllegalStateException("Expected certificate refresh to fail");
        } catch (IllegalArgumentException expected) {
            System.out.println("[EXPECTED FAILURE]");
            System.out.printf(
                    "  %s stopped with: %s%n",
                    hasSingleFlightRefresh ? "Leader" : "First refresh attempt",
                    expected.getMessage());
            System.out.println(
                    hasSingleFlightRefresh
                            ? "  Human meaning: the thread responsible for producing the new token has exited."
                            : "  Human meaning: this refresh attempt failed, but no shared Future was left behind.");
        }

        CompletableFuture<?> inFlightRefresh = readInFlightRefresh(client);
        if (!hasSingleFlightRefresh) {
            runPreSingleFlightScenario(client);
            return;
        }

        printStep(
                2,
                "Inspect the SDK state left behind by the failed Leader",
                "A healthy failure path should complete or clear inFlightRefresh.");
        printRefreshState(inFlightRefresh);

        ExecutorService executor = Executors.newSingleThreadExecutor();
        printStep(
                3,
                "A second thread requests a token and becomes a Follower",
                "It sees the stale inFlightRefresh and assumes another thread is still refreshing.");
        Future<String> follower = executor.submit(client::refreshAndGetSecurityToken);

        try {
            if (waitForSdkTimeout) {
                System.out.println("[WAITING]");
                System.out.println(
                        "  Waiting for the SDK's real one-minute Follower timeout.");
                System.out.println(
                        "  There is no live Leader, so nothing can complete the Future.");
                printFollowerFailure(follower);
            } else {
                System.out.println("[OBSERVING]");
                System.out.printf(
                        "  Waiting %d seconds to confirm that the Follower does not return.%n",
                        FAST_OBSERVATION_TIME.toSeconds());
                Thread.sleep(FAST_OBSERVATION_TIME.toMillis());
                System.out.printf(
                        "  Did the Follower return? %s%n", yesNo(follower.isDone()));
                if (!follower.isDone()) {
                    System.out.println(
                            "  Human meaning: it is waiting for a Leader that has already exited.");
                    System.out.println(
                            "  Without this POC cancelling it, the SDK waits for one minute and then times out.");
                }
                follower.cancel(true);
            }
        } finally {
            executor.shutdownNow();
            executor.awaitTermination(5, TimeUnit.SECONDS);
        }

        boolean reproduced =
                inFlightRefresh != null && !inFlightRefresh.isDone();
        printVerdict(reproduced);

        if (!reproduced) {
            System.exit(1);
        }
    }

    private static void printIntroduction(
            boolean waitForSdkTimeout, boolean hasSingleFlightRefresh) {
        System.out.println();
        System.out.println(DIVIDER);
        System.out.println("OCI JAVA SDK: STUCK SECURITY TOKEN REFRESH POC");
        System.out.printf("Loaded SDK artifact: %s%n", getSdkArtifactLocation());
        System.out.println(DIVIDER);
        System.out.printf(
                "Detected refresh implementation: %s%n",
                hasSingleFlightRefresh
                        ? "Leader/Follower single-flight"
                        : "pre-single-flight (no shared inFlightRefresh)");
        System.out.println();
        if (hasSingleFlightRefresh) {
            System.out.println("Scenario:");
            System.out.println("  1. One thread becomes the Leader responsible for refreshing a token.");
            System.out.println("  2. Reading cert.pem fails before the SDK cleanup block is reached.");
            System.out.println("  3. Another thread becomes a Follower and waits for the failed Leader.");
        } else {
            System.out.println("Comparison scenario:");
            System.out.println("  1. One thread attempts to refresh a token.");
            System.out.println("  2. Reading cert.pem fails.");
            System.out.println("  3. A second thread makes its own refresh attempt without waiting.");
        }
        System.out.println();
        System.out.println("Expected healthy behavior:");
        System.out.println(
                hasSingleFlightRefresh
                        ? "  The failed refresh should be completed exceptionally and cleared."
                        : "  A failed refresh must not prevent a later independent refresh attempt.");
        System.out.println();
        System.out.printf(
                "POC mode: %s%n",
                !hasSingleFlightRefresh
                        ? "verify that the next refresh attempt returns promptly"
                        : waitForSdkTimeout
                        ? "wait for the real one-minute SDK timeout"
                        : "observe the stuck Follower for two seconds, then cancel it");
    }

    private static void printStep(int number, String title, String explanation) {
        System.out.println();
        System.out.println(STEP_DIVIDER);
        System.out.printf("STEP %d: %s%n", number, title);
        System.out.println(STEP_DIVIDER);
        System.out.println(explanation);
        System.out.println();
    }

    private static CompletableFuture<?> readInFlightRefresh(X509FederationClient client)
            throws IllegalAccessException {
        Field field = findInFlightRefreshField();
        if (field == null) {
            return null;
        }
        field.setAccessible(true);
        return (CompletableFuture<?>) field.get(client);
    }

    private static boolean hasInFlightRefreshField() {
        return findInFlightRefreshField() != null;
    }

    private static Field findInFlightRefreshField() {
        try {
            return X509FederationClient.class.getDeclaredField("inFlightRefresh");
        } catch (NoSuchFieldException ignored) {
            return null;
        }
    }

    private static void runPreSingleFlightScenario(X509FederationClient client) throws Exception {
        printStep(
                2,
                "Inspect the SDK implementation",
                "This SDK version predates the shared inFlightRefresh mechanism.");
        System.out.println("[SDK STATE]");
        System.out.println("  Does X509FederationClient contain inFlightRefresh? NO");
        System.out.println("  Human meaning: there is no shared Leader/Follower Future to become stuck.");

        printStep(
                3,
                "A second thread requests a token",
                "Without shared Leader/Follower state, this call performs its own refresh attempt.");

        ExecutorService executor = Executors.newSingleThreadExecutor();
        Future<String> secondCall = executor.submit(client::refreshAndGetSecurityToken);
        boolean completedPromptly;
        try {
            try {
                secondCall.get(FAST_OBSERVATION_TIME.toSeconds(), TimeUnit.SECONDS);
                throw new IllegalStateException("Expected certificate refresh to fail");
            } catch (ExecutionException expected) {
                Throwable cause = expected.getCause();
                completedPromptly = true;
                System.out.println("[SECOND CALL RESULT]");
                System.out.println("  Did the second call wait for a stale Leader? NO");
                System.out.printf("  It independently attempted refresh and failed with: %s%n",
                        cause.getMessage());
            } catch (TimeoutException unexpected) {
                completedPromptly = false;
                secondCall.cancel(true);
                System.out.println("[SECOND CALL RESULT]");
                System.out.println("  Did the second call finish within two seconds? NO");
            }
        } finally {
            executor.shutdownNow();
            executor.awaitTermination(5, TimeUnit.SECONDS);
        }

        printPreSingleFlightVerdict(completedPromptly);
        if (!completedPromptly) {
            System.exit(1);
        }
    }

    private static void printRefreshState(CompletableFuture<?> refresh) {
        boolean exists = refresh != null;
        boolean completed = exists && refresh.isDone();

        System.out.println("[SDK STATE]");
        System.out.printf("  Does inFlightRefresh still exist? %s%n", yesNo(exists));
        System.out.printf("  Has inFlightRefresh completed?       %s%n", yesNo(completed));

        if (exists && !completed) {
            System.out.println();
            System.out.println("[BROKEN STATE CONFIRMED]");
            System.out.println(
                    "  The SDK still advertises \"token refresh in progress\", but the Leader is gone.");
            System.out.println(
                    "  No thread remains that can complete this inFlightRefresh Future.");
        }
    }

    private static void printFollowerFailure(Future<String> follower)
            throws InterruptedException {
        try {
            follower.get(70, TimeUnit.SECONDS);
            throw new IllegalStateException("Expected the Follower call to fail");
        } catch (ExecutionException expected) {
            Throwable cause = expected.getCause();
            System.out.println();
            System.out.println("[FOLLOWER RESULT]");
            System.out.printf("  Exception: %s%n", cause.getClass().getName());
            System.out.printf("  Message:   %s%n", cause.getMessage());
            System.out.println(
                    "  Human meaning: the Follower waited one minute for a Leader that no longer exists.");
        } catch (TimeoutException unexpected) {
            throw new IllegalStateException(
                    "The outer 70-second timeout expired before the SDK timeout", unexpected);
        }
    }

    private static void printVerdict(boolean reproduced) {
        System.out.println();
        System.out.println(DIVIDER);
        if (reproduced) {
            System.out.println("VERDICT: BUG REPRODUCED");
            System.out.println(DIVIDER);
            System.out.println("The Leader exited after the certificate refresh failure.");
            System.out.println("The shared inFlightRefresh Future remained present and incomplete.");
            System.out.println("A Follower therefore waited for work that nobody was performing.");
            System.out.println();
            System.out.println("Production impact:");
            System.out.println(
                    "  Subsequent token refresh requests can pause for one minute and fail with:");
            System.out.println("  \"Timed out waiting for security token refresh.\"");
        } else {
            System.out.println("VERDICT: BUG NOT REPRODUCED");
            System.out.println(DIVIDER);
            System.out.println("The SDK did not retain an incomplete inFlightRefresh Future.");
        }
        System.out.println(DIVIDER);
    }

    private static void printPreSingleFlightVerdict(boolean completedPromptly) {
        System.out.println();
        System.out.println(DIVIDER);
        if (completedPromptly) {
            System.out.println("VERDICT: NOT AFFECTED BY THE STUCK inFlightRefresh BUG");
            System.out.println(DIVIDER);
            System.out.println("This SDK predates the Leader/Follower single-flight implementation.");
            System.out.println("After the first refresh failed, the second call did not wait one minute.");
            System.out.println("It immediately made an independent refresh attempt.");
        } else {
            System.out.println("VERDICT: INCONCLUSIVE");
            System.out.println(DIVIDER);
            System.out.println("The SDK has no inFlightRefresh field, but the second call did not finish promptly.");
        }
        System.out.println(DIVIDER);
    }

    private static String yesNo(boolean value) {
        return value ? "YES" : "NO";
    }

    private static String getSdkArtifactLocation() {
        return X509FederationClient.class
                .getProtectionDomain()
                .getCodeSource()
                .getLocation()
                .toExternalForm();
    }

    private static final class FailingCertificateSupplier
            implements X509CertificateSupplier, Refreshable {
        @Override
        public void refresh() {
            throw new IllegalArgumentException("Simulated failure reading IMDS cert.pem");
        }

        @Override
        public boolean isCurrent() {
            return false;
        }

        @Override
        @Deprecated
        public X509Certificate getCertificate() {
            throw new IllegalStateException("Certificate must not be read in this reproducer");
        }

        @Override
        @Deprecated
        public RSAPrivateKey getPrivateKey() {
            throw new IllegalStateException("Private key must not be read in this reproducer");
        }

        @Override
        public CertificateAndPrivateKeyPair getCertificateAndKeyPair() {
            throw new IllegalStateException("Certificate must not be read in this reproducer");
        }
    }

    private static final class DemoSessionKeySupplier implements SessionKeySupplier {
        private volatile KeyPair keyPair = generateKeyPair();

        @Override
        public KeyPair getKeyPair() {
            return keyPair;
        }

        @Override
        @Deprecated
        public RSAPublicKey getPublicKey() {
            return (RSAPublicKey) keyPair.getPublic();
        }

        @Override
        @Deprecated
        public RSAPrivateKey getPrivateKey() {
            return (RSAPrivateKey) keyPair.getPrivate();
        }

        @Override
        public void refreshKeys() {
            keyPair = generateKeyPair();
        }

        private static KeyPair generateKeyPair() {
            try {
                KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA");
                generator.initialize(2048);
                return generator.generateKeyPair();
            } catch (GeneralSecurityException exception) {
                throw new IllegalStateException("Unable to generate an RSA key pair", exception);
            }
        }
    }
}

BUG execution on 2.93.0

[2026/07/27 15:57:09] vianovak ~/workspace/codex/oci-sdk-refresh-reproducer [correlation_stage] $ mvn -q \
  -Doci-java-sdk.version=2.93.0 \
  clean compile exec:java \
  -Dexec.args="--wait-for-sdk-timeout"

===============================================================================
OCI JAVA SDK: STUCK SECURITY TOKEN REFRESH POC
Loaded SDK artifact: file:/Users/vianovak/.m2/repository/com/oracle/oci/sdk/oci-java-sdk-common/2.93.0/oci-java-sdk-common-2.93.0.jar
===============================================================================
Detected refresh implementation: Leader/Follower single-flight

Scenario:
  1. One thread becomes the Leader responsible for refreshing a token.
  2. Reading cert.pem fails before the SDK cleanup block is reached.
  3. Another thread becomes a Follower and waits for the failed Leader.

Expected healthy behavior:
  The failed refresh should be completed exceptionally and cleared.

POC mode: wait for the real one-minute SDK timeout

-------------------------------------------------------------------------------
STEP 1: The first thread starts a token refresh and becomes the Leader
-------------------------------------------------------------------------------
The test certificate supplier will now simulate a failure while reading cert.pem.

[EXPECTED FAILURE]
  Leader stopped with: Simulated failure reading IMDS cert.pem
  Human meaning: the thread responsible for producing the new token has exited.

-------------------------------------------------------------------------------
STEP 2: Inspect the SDK state left behind by the failed Leader
-------------------------------------------------------------------------------
A healthy failure path should complete or clear inFlightRefresh.

[SDK STATE]
  Does inFlightRefresh still exist? YES
  Has inFlightRefresh completed?       NO

[BROKEN STATE CONFIRMED]
  The SDK still advertises "token refresh in progress", but the Leader is gone.
  No thread remains that can complete this inFlightRefresh Future.

-------------------------------------------------------------------------------
STEP 3: A second thread requests a token and becomes a Follower
-------------------------------------------------------------------------------
It sees the stale inFlightRefresh and assumes another thread is still refreshing.

[WAITING]
  Waiting for the SDK's real one-minute Follower timeout.
  There is no live Leader, so nothing can complete the Future.

[FOLLOWER RESULT]
  Exception: com.oracle.bmc.model.BmcException
  Message:   (-1, null, false) Timed out waiting for security token refresh.
  Human meaning: the Follower waited one minute for a Leader that no longer exists.

===============================================================================
VERDICT: BUG REPRODUCED
===============================================================================
The Leader exited after the certificate refresh failure.
The shared inFlightRefresh Future remained present and incomplete.
A Follower therefore waited for work that nobody was performing.

Production impact:
  Subsequent token refresh requests can pause for one minute and fail with:
  "Timed out waiting for security token refresh."

BUG is not seen on 2.90.0

[2026/07/27 16:24:18] vianovak ~/workspace/codex/oci-sdk-refresh-reproducer [correlation_stage] $ mvn -q \
  -Doci-java-sdk.version=2.90.0 \
  clean compile exec:java  

===============================================================================
OCI JAVA SDK: STUCK SECURITY TOKEN REFRESH POC
Loaded SDK artifact: file:/Users/vianovak/.m2/repository/com/oracle/oci/sdk/oci-java-sdk-common/2.90.0/oci-java-sdk-common-2.90.0.jar
===============================================================================
Detected refresh implementation: pre-single-flight (no shared inFlightRefresh)

Comparison scenario:
  1. One thread attempts to refresh a token.
  2. Reading cert.pem fails.
  3. A second thread makes its own refresh attempt without waiting.

Expected healthy behavior:
  A failed refresh must not prevent a later independent refresh attempt.

POC mode: verify that the next refresh attempt returns promptly

-------------------------------------------------------------------------------
STEP 1: The first thread starts a token refresh
-------------------------------------------------------------------------------
The test certificate supplier will now simulate a failure while reading cert.pem.

[EXPECTED FAILURE]
  First refresh attempt stopped with: Simulated failure reading IMDS cert.pem
  Human meaning: this refresh attempt failed, but no shared Future was left behind.

-------------------------------------------------------------------------------
STEP 2: Inspect the SDK implementation
-------------------------------------------------------------------------------
This SDK version predates the shared inFlightRefresh mechanism.

[SDK STATE]
  Does X509FederationClient contain inFlightRefresh? NO
  Human meaning: there is no shared Leader/Follower Future to become stuck.

-------------------------------------------------------------------------------
STEP 3: A second thread requests a token
-------------------------------------------------------------------------------
Without shared Leader/Follower state, this call performs its own refresh attempt.

[SECOND CALL RESULT]
  Did the second call wait for a stale Leader? NO
  It independently attempted refresh and failed with: Simulated failure reading IMDS cert.pem

===============================================================================
VERDICT: NOT AFFECTED BY THE STUCK inFlightRefresh BUG
===============================================================================
This SDK predates the Leader/Follower single-flight implementation.
After the first refresh failed, the second call did not wait one minute.
It immediately made an independent refresh attempt.
===============================================================================

[y-chandra]

We're looking into the issue, will update once we have fixed it