Add MtlsTokenProvider for mTLS authentication

Implementing auto refreshing in place not using AutoRefreshToken and
TokenEndpoint for simplicity and because mtls endpoint has very
simple list of arguments and some features implemented in client
authentication may be not supported at the moment.

Relates-To: DATASDK-105

Signed-off-by: Rustam Gamidov <ext-rustam.gamidov@here.com>

Author: rustam-gamidov-here

examples/CMakeLists.txt

@@ -20,6 +20,7 @@ set(OLP_SDK_DATASERVICE_READ_EXAMPLE_TARGET dataservice-read-example)
 set(OLP_SDK_DATASERVICE_WRITE_EXAMPLE_TARGET dataservice-write-example)
 set(OLP_SDK_DATASERVICE_CACHE_EXAMPLE_TARGET dataservice-cache-example)
 set(OLP_SDK_DATASERVICE_READ_STREAM_LAYER_EXAMPLE_TARGET dataservice-read-stream-layer-example)
+set(OLP_SDK_MTLS_AUTHENTICATION_EXAMPLE_TARGET mtls-authentication-example)
 
 set(OLP_SDK_EXAMPLE_SUCCESS_STRING "Example has finished successfully")
 set(OLP_SDK_EXAMPLE_FAILURE_STRING "Example failed!")
@@ -81,6 +82,14 @@ else()
         olp-cpp-sdk-authentication
         olp-cpp-sdk-dataservice-read)
 
+    add_library(${OLP_SDK_MTLS_AUTHENTICATION_EXAMPLE_TARGET}
+        ./MtlsAuthenticationExample.cpp
+        ./Examples.h
+        ./MtlsAuthenticationExample.h)
+
+    target_link_libraries(${OLP_SDK_MTLS_AUTHENTICATION_EXAMPLE_TARGET}
+        olp-cpp-sdk-authentication)
+
     target_compile_definitions(${OLP_SDK_DATASERVICE_READ_EXAMPLE_TARGET}
         PRIVATE EXAMPLES_LIBRARY)
     target_compile_definitions(${OLP_SDK_DATASERVICE_WRITE_EXAMPLE_TARGET}
@@ -89,6 +98,8 @@ else()
         PRIVATE EXAMPLES_LIBRARY)
     target_compile_definitions(${OLP_SDK_DATASERVICE_READ_STREAM_LAYER_EXAMPLE_TARGET}
         PRIVATE EXAMPLES_LIBRARY)
+    target_compile_definitions(${OLP_SDK_MTLS_AUTHENTICATION_EXAMPLE_TARGET}
+        PRIVATE EXAMPLES_LIBRARY)
     if(BUILD_SHARED_LIBS)
         target_compile_definitions(${OLP_SDK_DATASERVICE_READ_EXAMPLE_TARGET}
             PUBLIC EXAMPLES_SHARED_LIBRARY)
@@ -98,6 +109,8 @@ else()
             PUBLIC EXAMPLES_SHARED_LIBRARY)
         target_compile_definitions(${OLP_SDK_DATASERVICE_READ_STREAM_LAYER_EXAMPLE_TARGET}
             PUBLIC EXAMPLES_SHARED_LIBRARY)
+        target_compile_definitions(${OLP_SDK_MTLS_AUTHENTICATION_EXAMPLE_TARGET}
+            PUBLIC EXAMPLES_SHARED_LIBRARY)
     endif()
 
     add_executable(${OLP_SDK_DATASERVICE_EXAMPLE_TARGET}
@@ -109,6 +122,7 @@ else()
        ${OLP_SDK_DATASERVICE_READ_EXAMPLE_TARGET}
        ${OLP_SDK_DATASERVICE_WRITE_EXAMPLE_TARGET}
        ${OLP_SDK_DATASERVICE_CACHE_EXAMPLE_TARGET}
-       ${OLP_SDK_DATASERVICE_READ_STREAM_LAYER_EXAMPLE_TARGET})
+       ${OLP_SDK_DATASERVICE_READ_STREAM_LAYER_EXAMPLE_TARGET}
+       ${OLP_SDK_MTLS_AUTHENTICATION_EXAMPLE_TARGET})
 
 endif()

examples/MtlsAuthenticationExample.cpp

@@ -0,0 +1,169 @@
+/*
+ * Copyright (C) 2026 HERE Europe B.V.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * License-Filename: LICENSE
+ */
+
+#include "MtlsAuthenticationExample.h"
+
+#include <olp/authentication/MtlsTokenProvider.h>
+#include <olp/core/client/OlpClientSettingsFactory.h>
+#include <olp/core/http/HttpStatusCode.h>
+#include <olp/core/http/Network.h>
+#include <olp/core/logging/Log.h>
+#include <olp/core/utils/Url.h>
+
+#include <fstream>
+#include <future>
+#include <map>
+#include <memory>
+#include <sstream>
+#include <string>
+#include <utility>
+
+namespace {
+constexpr auto kLogTag = "mtls-authentication-example";
+
+constexpr auto kDiscoverBaseUrl = "https://discover.search.hereapi.com";
+constexpr auto kDiscoverPath = "/v1/discover";
+
+// Only the beginning of the response body is logged, the full document can
+// be large.
+constexpr size_t kMaxLoggedResponseSize = 512;
+
+std::string ReadFile(const std::string& path) {
+  std::ifstream stream(path, std::ios::in | std::ios::binary);
+  if (!stream) {
+    return {};
+  }
+  std::ostringstream contents;
+  contents << stream.rdbuf();
+  return contents.str();
+}
+
+// Presents the client certificate during the mTLS handshake to retrieve a
+// bearer token. Returns an empty string in case of a failure.
+std::string RequestAccessToken(const std::string& cert_path,
+                               const std::string& key_path,
+                               const std::string& ca_path,
+                               const std::string& scope) {
+  const auto client_cert_pem = ReadFile(cert_path);
+  const auto client_key_pem = ReadFile(key_path);
+
+  if (client_cert_pem.empty() || client_key_pem.empty()) {
+    OLP_SDK_LOG_ERROR_F(kLogTag,
+                        "Failed to read certificate or key file, cert='%s', "
+                        "key='%s'",
+                        cert_path.c_str(), key_path.c_str());
+    return {};
+  }
+
+  olp::authentication::MtlsSettings settings;
+  settings.mtls_properties.client_cert_pem = client_cert_pem;
+  settings.mtls_properties.client_key_pem = client_key_pem;
+  if (!ca_path.empty()) {
+    settings.mtls_properties.ca_cert_pem = ReadFile(ca_path);
+  }
+  if (!scope.empty()) {
+    settings.mtls_properties.scope = scope;
+  }
+
+  const olp::authentication::MtlsTokenProviderDefault token_provider(
+      std::move(settings));
+
+  olp::client::CancellationContext context;
+  const auto token_response = token_provider(context);
+
+  if (!token_response.IsSuccessful()) {
+    OLP_SDK_LOG_ERROR_F(
+        kLogTag, "mTLS sign in - Failure(%d): %s",
+        static_cast<int>(token_response.GetError().GetErrorCode()),
+        token_response.GetError().GetMessage().c_str());
+    return {};
+  }
+
+  OLP_SDK_LOG_INFO_F(kLogTag, "mTLS sign in - Success, expires in %lld s",
+                     static_cast<long long>(
+                         token_response.GetResult().GetExpiresIn().count()));
+
+  return token_response.GetResult().GetAccessToken();
+}
+
+// Calls the HERE Discover Search API with the access token passed as the
+// bearer token.
+bool CallDiscoverApi(const std::string& access_token) {
+  std::shared_ptr<olp::http::Network> http_client = olp::client::
+      OlpClientSettingsFactory::CreateDefaultNetworkRequestHandler();
+
+  const std::multimap<std::string, std::string> query_params = {
+      {"q", "döner"},
+      {"at", "52.53083376480065,13.38469608732926"},
+      {"limit", "3"}};
+
+  const auto url =
+      olp::utils::Url::Construct(kDiscoverBaseUrl, kDiscoverPath, query_params);
+
+  auto request = olp::http::NetworkRequest(url)
+                     .WithVerb(olp::http::NetworkRequest::HttpVerb::GET)
+                     .WithHeader("Authorization", "Bearer " + access_token);
+
+  auto payload = std::make_shared<std::stringstream>();
+
+  std::promise<olp::http::NetworkResponse> promise;
+  auto future = promise.get_future();
+
+  const auto outcome =
+      http_client->Send(std::move(request), payload,
+                        [&promise](olp::http::NetworkResponse response) {
+                          promise.set_value(std::move(response));
+                        });
+
+  if (!outcome.IsSuccessful()) {
+    OLP_SDK_LOG_ERROR_F(
+        kLogTag, "Discover request was not sent - Failure: %s",
+        olp::http::ErrorCodeToString(outcome.GetErrorCode()).c_str());
+    return false;
+  }
+
+  const auto response = future.get();
+
+  if (response.GetStatus() != olp::http::HttpStatusCode::OK) {
+    OLP_SDK_LOG_ERROR_F(kLogTag, "Discover request - Failure(%d): %s",
+                        response.GetStatus(), response.GetError().c_str());
+    return false;
+  }
+
+  auto body = payload->str();
+  OLP_SDK_LOG_INFO_F(kLogTag, "Discover request - Success, response: %s%s",
+                     body.substr(0, kMaxLoggedResponseSize).c_str(),
+                     body.size() > kMaxLoggedResponseSize ? "..." : "");
+
+  return true;
+}
+}  // namespace
+
+int RunExampleMtlsAuthentication(const std::string& cert_path,
+                                 const std::string& key_path,
+                                 const std::string& ca_path,
+                                 const std::string& scope) {
+  const auto access_token =
+      RequestAccessToken(cert_path, key_path, ca_path, scope);
+  if (access_token.empty()) {
+    return -1;
+  }
+
+  return CallDiscoverApi(access_token) ? 0 : -1;
+}

examples/MtlsAuthenticationExample.h

@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2026 HERE Europe B.V.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * License-Filename: LICENSE
+ */
+
+#pragma once
+
+#include <string>
+
+#include "Examples.h"
+
+/**
+ * @brief mTLS authentication example. Presents a client X.509 certificate
+ * during the TLS handshake with the HERE mTLS token endpoint to retrieve a
+ * bearer token, then calls the HERE Discover Search API with that token.
+ * @param cert_path Path to the client certificate PEM file.
+ * @param key_path Path to the client private key PEM file.
+ * @param ca_path (Optional) Path to a CA certificate PEM file. Empty if not
+ * used.
+ * @param scope (Optional) The project HRN scope to request. Empty if not
+ * used.
+ * @return 0 if the token was retrieved and the Discover API call succeeded.
+ */
+EXAMPLES_API
+int RunExampleMtlsAuthentication(const std::string& cert_path,
+                                 const std::string& key_path,
+                                 const std::string& ca_path,
+                                 const std::string& scope);

examples/Options.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2020-2021 HERE Europe B.V.
+ * Copyright (C) 2020-2026 HERE Europe B.V.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -32,14 +32,35 @@ struct Option {
 
 const Option kHelpOption{"-h", "--help", "Print the help message and exit."};
 
-const Option kExampleOption{"-e", "--example",
-                            "Run example [=read|read_stream|write|cache]."};
+const Option kExampleOption{
+    "-e", "--example",
+    "Run example [=read|read_stream|write|cache|mtls-authentication]."};
 
 const Option kKeyIdOption{"-i", "--key-id", "Here key ID to access OLP."};
 
 const Option kKeySecretOption{"-s", "--key-secret",
                               "Here secret key to access OLP."};
 
+const Option kMtlsCertOption{
+    "--cert", "--mtls-cert",
+    "Path to the client certificate PEM file (required for the "
+    "mtls-authentication example)."};
+
+const Option kMtlsKeyOption{
+    "--key", "--mtls-key",
+    "Path to the client private key PEM file (required for the "
+    "mtls-authentication example)."};
+
+const Option kMtlsCaOption{
+    "--ca", "--mtls-ca",
+    "Path to a CA certificate PEM file (optional, used for the "
+    "mtls-authentication example)."};
+
+const Option kMtlsScopeOption{
+    "--scope", "--mtls-scope",
+    "Project HRN scope to request (optional, used for the "
+    "mtls-authentication example)."};
+
 const Option kCatalogOption{"-c", "--catalog",
                             "Catalog HRN (HERE Resource Name)."};