private Cluster reconnectedClusterForExpiredClient(OAuth2AuthenticationToken authentication,
      OAuth2AuthorizedClient expiredClient) {
    String subject = getSubject(authentication);

    logger.info("Attempting to refresh the expired access token for {}.", subject);

    OAuth2AuthorizedClient freshClient;
    try {
      freshClient = refreshExpiredClient(authentication, expiredClient);
    } catch (OAuth2AuthenticationException | OAuth2AuthorizationException authException) {
      String message = "Failed to refresh the access token for " + subject +
          ". Disconnecting and removing the user's cluster.";
      logger.info(message);
      logoutUser(subject);
      throw authException;
    }

    logger.info("Refreshed the access token for {}. Reconnecting the user's cluster.", subject);
    synchronized (clusterMap) {
      Cluster cluster = clusterMap.get(subject);
      if (cluster != null) {
        // When the cluster reconnects to JMX, it will include this access token as the
        // jmx.remote.credentials attribute in the connection environment. The JMX server will then
        // pass the access token to the security manager for authentication.
        String credentials = freshClient.getAccessToken().getTokenValue();
        cluster.reconnectToGemFire(credentials);
      }
      return cluster;
    }
  }
Refreshes the expired client's access token, reconnects the associated user's cluster using
the new token, and returns the reconnected cluster. If the access token cannot be refreshed,
the user's cluster is disconnected from JMX and removed from the repository.
geode-pulse/src/main/java/org/apache/geode/tools/pulse/internal/data/Repository.java