*.iml
.idea
.vscode
.DS_Store
/plugins/
/modules/
/tomcat.8080/
dbflute_fess/output/doc/lastadoc-fess.html
dbflute_fess/schema/project-lastadoc-fess.json
src/main/resources/fess_indices/fess_config.access_token/access_token.bulk
src/main/resources/ga_client_secrets.p12
src/main/webapp/WEB-INF/project.properties
/.apt_generated/
/.apt_generated_tests/
/.serena

The response of the `token` endpoint must be a JSON object.

It should have a `token_type`. In our case, as we are using "Bearer" tokens, the token type should be "`bearer`".

And it should have an `access_token`, with a string containing our access token.

For this simple example, we are going to just be completely insecure and return the same `username` as the token.

/// tip

      - name: 'Cancel previous runs'
        uses: styfle/cancel-workflow-action@85880fa0301c86cca9da44039ee3bb12d3bedbfa # 0.12.1
        with:
          access_token: ${{ github.token }}
      - name: 'Check out repository'
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

        assertEquals("/admin/accesstoken/admin_accesstoken.jsp", FessHtmlPath.path_AdminAccesstoken_AdminAccesstokenJsp.getRoutingPath());
        assertEquals("/admin/accesstoken/admin_accesstoken_details.jsp",
                FessHtmlPath.path_AdminAccesstoken_AdminAccesstokenDetailsJsp.getRoutingPath());
        assertEquals("/admin/accesstoken/admin_accesstoken_edit.jsp",

            logger.debug("url: {}", url);
        }
        try (CurlResponse response = Curl.get(url)
                .header("Authorization", "Bearer " + user.getAuthenticationResult().accessToken())
                .header("Accept", "application/json")
                .execute()) {
            final Map<String, Object> contentMap = response.getContent(OpenSearchCurl.jsonParser());

		return
	}

	ctx = newContext(r, w, action)

	token := r.Form.Get(stsToken)
	if token == "" {
		token = r.Form.Get(stsWebIdentityToken)
	}

	accessToken := r.Form.Get(stsWebIdentityAccessToken)

	// RoleARN parameter processing: If a role ARN is given in the request, we
	// use that and validate the authentication request. If not, we assume this