Pulse can be configured to delegate authentication to an OpenID Connect Provider (OP).
Authenticating with OpenID Connect
Pulse uses the configured OpenID Connect Provider (OP) to authenticate the user and to obtain the user's permission to access their cluster via JMX.
Authorizing With Access Tokens
During authentication, Pulse requests an access token along with the ID token. Internally, Pulse uses the access token to connect to the Geode cluster's JMX manager.
Refreshing Expired Access Tokens
If the OP issues a refresh token, Pulse attempts to refresh the user's access token when it expires.
Automatic Disconnect and Logout When Unable to Refresh
If there is no refresh token, or if the refresh token has expired, or if the OP declines to refresh the expired access token, Pulse disconnects from the JMX manager and logs the user out of the Pulse browser session.
This diagram shows only the "expired refresh token" scenario, but the flow is very similar if the refresh token is missing or the OP declines the refresh request.