Authentication Flow

Relevant source files

The following files were used as context for generating this wiki page:

• src/flext_tap_oracle_oic/_models/_auth_config.py
• src/flext_tap_oracle_oic/tap.py
• src/flext_tap_oracle_oic/settings.py
• src/flext_tap_oracle_oic/models.py
• src/flext_tap_oracle_oic/constants.py
• tests/unit/test_auth.py

The Authentication Flow in flext-tap-oracle-oic is designed to provide secure access to Oracle Integration Cloud (OIC) APIs using the OAuth2 Client Credentials grant type. This system handles the acquisition, validation, and refresh of access tokens from the Identity Cloud Service (IDCS) or OIC identity provider, ensuring that all subsequent API requests are appropriately authorized.

The architecture relies on a centralized FlextOracleOicAuthenticator which uses configuration defined in OicAuthenticationConfig and FlextTapOracleOicSettings. It manages the interaction with the IDCS token endpoint and provides Bearer tokens for use in the Authorization header of OIC service requests.

Sources: src/flext_tap_oracle_oic/tap.py:30-35, src/flext_tap_oracle_oic/_models/_auth_config.py:15-20

Authentication Components

The authentication system consists of several key classes and data models that coordinate to secure API communication.

Authenticator Implementation

The FlextOracleOicAuthenticator is the primary engine for the flow. It utilizes a FlextApi client to perform POST requests against the configured oauth_token_url. The payload for this request is constructed from credentials stored in the tap's settings.

Sources: src/flext_tap_oracle_oic/tap.py:30-42

Configuration Models

Authentication settings are strictly validated using Pydantic models to ensure security best practices, such as requiring HTTPS for all URLs.

• OicAuthenticationConfig: Defines the structure for OAuth2 parameters including Client ID, Client Secret, and Audience.
• FlextTapOracleOicSettings: Extends base settings to include tap-specific defaults like token_expiry_buffer and max_retry_attempts.

Sources: src/flext_tap_oracle_oic/_models/_auth_config.py:34-55, src/flext_tap_oracle_oic/settings.py:27-45

Authentication Data Flow

The flow follows a standard OAuth2 client_credentials pattern. The authenticator retrieves a token, which is then cached and injected into the headers of the FlextTapOracleOicClient.

The sequence above illustrates the successful retrieval and usage of an OAuth2 token for OIC API access.
Sources: src/flext_tap_oracle_oic/tap.py:44-78, src/flext_tap_oracle_oic/tap.py:102-120

Configuration and Validation

Authentication configuration must adhere to specific constraints defined in the models and constants.

Parameter	Type	Default	Description
oauth_client_id	str	N/A	OAuth2 client ID for OIC API
oauth_client_secret	SecretStr	N/A	OAuth2 client secret (sensitive)
oauth_token_url	str	N/A	IDCS OAuth2 token endpoint URL (Must be HTTPS)
oauth_audience	str	N/A	OAuth2 audience (often urn:opc:resource:consumer:all)
token_expiry_buffer	int	300	Seconds before expiry to refresh (Min 60)

Sources: src/flext_tap_oracle_oic/_models/_auth_config.py:34-70, src/flext_tap_oracle_oic/settings.py:27-40, src/flext_tap_oracle_oic/constants.py:59

Validation Logic

The system enforces strict validation on authentication parameters:

1. Protocol Enforcement: Both oauth_token_url and base_url MUST start with https://.
2. Buffer Bounds: The token_expiry_buffer must be at least 60 seconds (defined by MIN_TOKEN_EXPIRY_BUFFER).
3. Required Fields: Client ID, Client Secret, and Audience are mandatory.

Sources: src/flext_tap_oracle_oic/_models/_auth_config.py:100-112, src/flext_tap_oracle_oic/settings.py:91-100

Token Request Structure

The authenticator builds the token request using application/x-www-form-urlencoded encoding. The data structure includes:

# From src/flext_tap_oracle_oic/settings.py:75-81
def get_token_request_data(self) -> t.StrMapping:
    """Return OAuth2 client credentials payload."""
    return {
        "grant_type": "client_credentials",
        "client_id": self.oauth_client_id,
        "client_secret": self.oauth_client_secret.get_secret_value(),
        "audience": self.oauth_audience,
    }

Sources: src/flext_tap_oracle_oic/settings.py:75-81, src/flext_tap_oracle_oic/tap.py:47-51

Error Handling

The authentication flow categorizes failures to support resilient extraction processes.

• HTTP 401 (Unauthorized): Indicates that the provided credentials or token are invalid/expired.
• HTTP 403 (Forbidden): Indicates the authenticated user lacks permissions for the specific OIC resource.
• HTTP 429 (Rate Limited): Triggers logic to handle OIC API throttling.

If a response status code meets or exceeds the HTTP_ERROR_STATUS_THRESHOLD (400), the flow returns a failure Result.

Sources: src/flext_tap_oracle_oic/constants.py:54-57, src/flext_tap_oracle_oic/tap.py:58-61, src/flext_tap_oracle_oic/models.py:335-350

Summary

The Authentication Flow provides a robust implementation of OAuth2 for OIC. By centralizing logic in the FlextOracleOicAuthenticator and enforcing strict Pydantic validation on credentials, the tap ensures secure and automated connectivity to Oracle Integration Cloud environments.