*       typically because the type forbids nullable type arguments: For example, {@code
 *       ImmutableList.get} returns {@code E}, but that value is never {@code null}. (Accordingly,
 *       {@code ImmutableList} is declared to forbid {@code ImmutableList<@Nullable String>}.)
 *   <li>methods whose return type is a type variable but which can return {@code null} regardless

 *       typically because the type forbids nullable type arguments: For example, {@code
 *       ImmutableList.get} returns {@code E}, but that value is never {@code null}. (Accordingly,
 *       {@code ImmutableList} is declared to forbid {@code ImmutableList<@Nullable String>}.)
 *   <li>methods whose return type is a type variable but which can return {@code null} regardless

            result.setCreatedTime(DfTypeUtil.toLong(source.get("createdTime")));
            result.setKey(DfTypeUtil.toString(source.get("key")));
            result.setValue(DfTypeUtil.toString(source.get("value")));
            return updateEntity(source, result);
        } catch (InstantiationException | IllegalAccessException e) {
            final String msg = "Cannot create a new instance: " + entityType.getName();

  std::unordered_map<tensorflow::string, tensorflow::Node*> name_map
      TF_GUARDED_BY(mu);

  // The keys of this map are all the active sessions using this graph. Each
  // value records whether the graph has been mutated since the corresponding
  // session has been run (this is detected in RecordMutation function). If the
  // string is empty, no mutation has occurred. Otherwise the string is a

	//
	//    - if baseInterval=10s, then 5s <= waitInterval() < 15s
	//
	//    - if baseInterval=10m, then 5m <= waitInterval() < 15m
	waitInterval := func() time.Duration {
		// Calculate a random value such that 0 <= value < baseInterval
		randAmt := time.Duration(r.Float64() * float64(baseInterval))
		return baseInterval/2 + randAmt
	}

	timer := time.NewTimer(waitInterval())
	defer timer.Stop()

  //   2. Signer whose configured maximum is shorter than the requested duration
  //   3. Signer whose configured minimum is longer than the requested duration
  //
  // The minimum valid value for expirationSeconds is 600, i.e. 10 minutes.
  //
  // +optional
  optional int32 expirationSeconds = 8;

  // usages specifies a set of key usages requested in the issued certificate.
  //

      if (!response.isSuccessful()) {
        Headers responseHeaders = response.headers();
        for (int i = 0; i < responseHeaders.size(); i++) {
          System.out.println(responseHeaders.name(i) + ": " + responseHeaders.value(i));
        }

        throw new IOException("Unexpected code " + response);
      }

      System.out.println(response.body().string());
    }
  }

   * except {@link Object#equals}, {@link Object#hashCode} and {@link Object#toString}. The result
   * will be returned as the proxied method's return value.
   *
   * <p>Unlike {@link #invoke}, {@code args} will never be null. When the method has no parameter,
   * an empty array is passed in.
   */
  @CheckForNull

		HTTPStatusCode: http.StatusBadRequest,
	},
	ErrSTSInvalidParameterValue: {
		Code:           "InvalidParameterValue",
		Description:    "An invalid or out-of-range value was supplied for the input parameter.",
		HTTPStatusCode: http.StatusBadRequest,
	},
	ErrSTSWebIdentityExpiredToken: {
		Code:           "ExpiredToken",

type KeycloakProvider struct {
	sync.Mutex

	oeConfig DiscoveryDoc
	client   http.Client
	adminURL string
	realm    string

	// internal value refreshed
	accessToken Token
}

// LoginWithUser authenticates username/password, not needed for Keycloak
func (k *KeycloakProvider) LoginWithUser(username, password string) error {
	return ErrNotImplemented
}