private Cluster getClusterWithAuthenticationToken(OAuth2AuthenticationToken authentication) {
    OAuth2AuthorizedClient authorizedClient = getAuthorizedClient(authentication);
    if (isExpired(authorizedClient.getAccessToken())) {
      return reconnectedClusterForExpiredClient(authentication, authorizedClient);
    }

    // When the cluster connects to JMX, it will include this access token as the
    // jmx.remote.credentials attribute in the connection environment. The JMX server will then pass
    // the access token to the security manager for authentication.
    String credentials = authorizedClient.getAccessToken().getTokenValue();
    String subject = getSubject(authentication);
    return getClusterWithCredentials(subject, credentials);
  }
Returns the cluster for the user associated with the given authentication. If the user's
access token is expired, it is refreshed and the cluster is reconnected to JMX using the fresh
token. If the refresh fails, the user's cluster is disconnected from JMX and removed from the
repository.
geode-pulse/src/main/java/org/apache/geode/tools/pulse/internal/data/Repository.java