in src/main/java/org/apache/sling/auth/oauth_client/impl/TokenStore.java [246:266]
private synchronized int getActiveToken() {
if (System.currentTimeMillis() > nextUpdate
|| currentTokens.get(currentToken) == null) {
// cycle so that during a typical ttl the tokens get completely
// refreshed.
nextUpdate = System.currentTimeMillis() + ttl
/ (currentTokens.length() - 1);
byte[] b = new byte[20];
random.nextBytes(b);
SecretKey newToken = new SecretKeySpec(b, HMAC_SHA256);
int nextToken = currentToken + 1;
if (nextToken == currentTokens.length()) {
nextToken = 0;
}
currentTokens.set(nextToken, newToken);
currentToken = nextToken;
saveTokens();
}
return currentToken;
}