private OAuth2AuthorizedClient refreshExpiredClient(Authentication authentication,
      OAuth2AuthorizedClient expiredClient) {
    OAuth2RefreshToken refreshToken = expiredClient.getRefreshToken();
    String subject = getSubject(authentication);
    if (refreshToken == null) {
      throw new OAuth2AuthenticationException(new OAuth2Error("401"),
          "User " + subject + " has no refresh token.");
    }
    if (isExpired(refreshToken)) {
      throw new OAuth2AuthenticationException(new OAuth2Error("401"),
          "The refresh token for " + subject + " has expired.");
    }

    OAuth2AccessTokenResponse freshToken = getFreshToken(expiredClient);

    OAuth2AuthorizedClient freshClient = new OAuth2AuthorizedClient(
        expiredClient.getClientRegistration(), expiredClient.getPrincipalName(),
        freshToken.getAccessToken(), freshToken.getRefreshToken());

    authorizedClientService.saveAuthorizedClient(freshClient, authentication);

    return freshClient;
  }
Returns the cluster for the user associated with the given authentication. If the user's
access token is expired, it is refreshed and the cluster is reconnected to JMX using the fresh
token. If the refresh fails, the user's cluster is disconnected from JMX and removed from the
repository.
geode-pulse/src/main/java/org/apache/geode/tools/pulse/internal/data/Repository.java