throw new SsoLoginException("could not validate nonce", e);
        }
    }

    /**
     * Obtains an access token using a refresh token.
     * @param refreshToken The refresh token to use for token acquisition.
     * @return The authentication result containing the access token.
     */
    public IAuthenticationResult getAccessToken(final String refreshToken) {

    }

    @Test
    @DisplayName("createContext: no Kerberos in initial token and no fallback -> throws")
    void createContext_noKerberosNoFallback_throws() throws CIFSException {
        Kerb5Authenticator auth = new Kerb5Authenticator((Subject) null);

        // Build a token with an arbitrary non-kerberos mechanism OID
        ASN1ObjectIdentifier unsupported = new ASN1ObjectIdentifier("1.2.3.4.5");

{* ../../docs_src/security/tutorial001.py hl[6] *}

/// tip | 豆知識

ここで、`tokenUrl="token"`は、まだ作成していない相対URL`token`を指します。相対URLなので、`./token`と同じです。

相対URLを使っているので、APIが`https://example.com/`にある場合、`https://example.com/token`を参照します。しかし、APIが`https://example.com/api/v1/`にある場合は`https://example.com/api/v1/token`を参照することになります。

<img src="/img/tutorial/security/image11.png">

## Token JWT con scopes

Ahora, modifica la *path operation* del token para devolver los scopes solicitados.

Todavía estamos usando el mismo `OAuth2PasswordRequestForm`. Incluye una propiedad `scopes` con una `list` de `str`, con cada scope que recibió en el request.

Y devolvemos los scopes como parte del token JWT.

/// danger | Peligro

<img src="/img/tutorial/security/image11.png">

## JWT token with scopes { #jwt-token-with-scopes }

Now, modify the token *path operation* to return the scopes requested.

We are still using the same `OAuth2PasswordRequestForm`. It includes a property `scopes` with a `list` of `str`, with each scope it received in the request.

And we return the scopes as part of the JWT token.

/// danger

    }

    public void setToken_Terms(ConditionOptionCall<TermsAggregationBuilder> opLambda) {
        setToken_Terms("token", opLambda, null);
    }

    public void setToken_Terms(ConditionOptionCall<TermsAggregationBuilder> opLambda, OperatorCall<BsAccessTokenCA> aggsLambda) {
        setToken_Terms("token", opLambda, aggsLambda);
    }

 * for API endpoints including authentication, message handling, and access control.
 *
 * This class extends FessBaseAction and provides specialized behavior for API requests,
 * including token-based authentication and JSON response handling.
 */
public abstract class FessApiAction extends FessBaseAction {

    /**
     * Default constructor.
     */
    public FessApiAction() {
        super();
    }

{* ../../docs_src/security/tutorial002_an_py310.py hl[19:22,26:27]...

                            state = 0;
                            break;
                        }

                        try {
                            token = nctx.initSecContext(token, 0, token.length);
                        } catch (final SmbException se) {
                            /* We must close the transport or the server will be expecting a

	  #     value: "image/*" # match objects with 'content-type', with all values starting with 'image/'

	notify:
	  endpoint: "https://notify.endpoint" # notification endpoint to receive job status events
	  token: "Bearer xxxxx" # optional authentication token for the notification endpoint

	retry:
	  attempts: 10 # number of retries for the job before giving up
	  delay: "500ms" # least amount of delay between each retry
```