private Authorization refreshBearerAuth(@Nullable String wwwAuthenticate)
      throws RegistryAuthenticationFailedException, RegistryCredentialsNotSentException {
    Preconditions.checkState(isBearerAuth(authorization.get()));

    String registry = registryEndpointRequestProperties.getServerUrl();
    String repository = registryEndpointRequestProperties.getImageName();
    eventHandlers.dispatch(
        LogEvent.debug("refreshing bearer auth token for " + registry + "/" + repository + "..."));

    if (wwwAuthenticate != null) {
      Optional<RegistryAuthenticator> authenticator =
          RegistryAuthenticator.fromAuthenticationMethod(
              wwwAuthenticate, registryEndpointRequestProperties, getUserAgent(), httpClient);
      if (authenticator.isPresent()) {
        if (readOnlyBearerAuth) {
          return authenticator.get().authenticatePull(credential);
        }
        return authenticator.get().authenticatePush(credential);
      }
    }

    eventHandlers.dispatch(
        LogEvent.debug(
            "server did not return 'WWW-Authenticate: Bearer' header. Actual: " + wwwAuthenticate));
    if (readOnlyBearerAuth) {
      return Verify.verifyNotNull(initialBearerAuthenticator.get()).authenticatePull(credential);
    }
    return Verify.verifyNotNull(initialBearerAuthenticator.get()).authenticatePush(credential);
  }
Attempts bearer authentication for pull and push.

@return true if bearer authentication succeeded; false if the server expects basic
    authentication (and thus bearer authentication was not attempted)
@throws IOException if communicating with the endpoint fails
@throws RegistryException if communicating with the endpoint fails
@throws RegistryAuthenticationFailedException if authentication fails
@throws RegistryCredentialsNotSentException if authentication failed and credentials were not
    sent over plain HTTP
jib-core/src/main/java/com/google/cloud/tools/jib/registry/RegistryClient.java