Fixes from PR

Author: alextwoods

services/sso/src/main/java/software/amazon/awssdk/services/sso/auth/ExpiredTokenException.java

@@ -31,7 +31,7 @@
 @SdkPublicApi
 public final class ExpiredTokenException extends SdkClientException {
 
-    public static final String DEFAULT_MESSAGE =
+    private static final String DEFAULT_MESSAGE =
         "The SSO session associated with this profile has expired or is otherwise invalid."
         + " To refresh this SSO session run aws sso login with the corresponding profile.";
 

services/sso/src/main/java/software/amazon/awssdk/services/sso/auth/SsoProfileCredentialsProviderFactory.java

@@ -147,7 +147,7 @@ private static SdkToken resolveTokenOrThrow(SdkTokenProvider tokenProvider) {
             SdkToken token;
             try {
                 token = tokenProvider.resolveToken();
-            } catch (ExpiredTokenException | SdkServiceException e) {
+            } catch (ExpiredTokenException | SdkServiceException | IllegalArgumentException e) {
                 throw e;
             } catch (RuntimeException e) {
                 throw ExpiredTokenException.builder()

services/sso/src/main/java/software/amazon/awssdk/services/sso/internal/SsoAccessTokenProvider.java

@@ -52,6 +52,8 @@ public SdkToken resolveToken() {
         } catch (ExpiredTokenException e) {
             throw e;
         } catch (Exception e) {
+            // Any exception raised while trying to read the token file (invalid file, unable to access, does not exist, ect)
+            // should be treated as an invalid/expired token and requires the user to re-authenticate
             throw ExpiredTokenException.builder()
                                        .cause(e)
                                        .build();

services/sso/src/test/java/software/amazon/awssdk/services/sso/auth/SsoProfileCredentialsProviderFactoryTest.java

@@ -578,8 +578,8 @@ public void tokenProviderThrowsOnSecondCall_staleCachedCredentialsReturned() {
         // First call succeeds and caches credentials
         credentialsProvider.resolveCredentials();
 
-        // Second call: token provider throws InvalidTokenException, but CachedSupplier with
-        // StaleValueBehavior.ALLOW returns stale cached credentials (static stability)
+        // Second call: token provider throws, but CachedSupplier returns the previously
+        // cached credentials since they haven't reached their stale time yet.
         assertThat(credentialsProvider.resolveCredentials()).isNotNull();
     }
 

test/auth-tests/src/it/java/software/amazon/awssdk/auth/sso/ProfileCredentialProviderTest.java

@@ -40,20 +40,20 @@ private static Stream<Arguments> ssoTokenErrorValues() {
                                                  "[sso-session foo]\n" +
                                                  "sso_start_url=https//d-abc123.awsapps.com/start\n" +
                                                  "sso_region=region")
-                             , "Unable to load SSO token"),
+                             , "expired or is otherwise invalid"),
                          Arguments.of(configFile("[profile test]\n" +
                                                  "sso_account_id=accountId\n" +
                                                  "sso_role_name=roleName\n" +
                                                  "sso_session=foo\n" +
                                                  "[sso-session foo]\n" +
                                                  "sso_region=region")
-                             , "Property 'sso_start_url' was not configured for profile 'test'"),
+                             , "Property 'sso_start_url' was not configured for profile"),
                          Arguments.of(configFile("[profile test]\n" +
                                                  "sso_account_id=accountId\n" +
                                                  "sso_role_name=roleName\n" +
                                                  "sso_region=region\n" +
                                                  "sso_start_url=https//non-existing-Token/start")
-                             , "java.nio.file.NoSuchFileException")
+                             , "expired or is otherwise invalid")
 
 
         );
@@ -71,10 +71,13 @@ private static ProfileFile configFile(String configFile) {
     void validateSsoFactoryErrorWithIncorrectProfiles(ProfileFile profiles, String expectedValue) {
         assertThat(profiles.profile("test")).hasValueSatisfying(profile -> {
             SsoProfileCredentialsProviderFactory factory = new SsoProfileCredentialsProviderFactory();
-            assertThatThrownBy(() -> factory.create(ProfileProviderCredentialsContext.builder()
-                                                                                     .profile(profile)
-                                                                                     .profileFile(profiles)
-                                                                                     .build())).hasMessageContaining(expectedValue);
+            assertThatThrownBy(() -> {
+                factory.create(ProfileProviderCredentialsContext.builder()
+                                                               .profile(profile)
+                                                               .profileFile(profiles)
+                                                               .build())
+                       .resolveCredentials();
+            }).hasMessageContaining(expectedValue);
         });
     }