Skip to content

fix: S2A gRPC flow creates ComputeEngineCredentials via newBuilder. #3651

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Feb 24, 2025
Merged

fix: S2A gRPC flow creates ComputeEngineCredentials via newBuilder. #3651

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
1f3cdc9
create new ComputeEngineCredentials via newBuilder.
rmehta19 Feb 22, 2025
f26b07b
set parameter values.
rmehta19 Feb 22, 2025
cf27512
return cred.
rmehta19 Feb 22, 2025
dbe590f
update comment.
rmehta19 Feb 22, 2025
18f2ac6
Merge branch 'main' into build-new-cred
rmehta19 Feb 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 12 additions & 3 deletions ...java/gax-grpc/src/main/java/com/google/api/gax/grpc/InstantiatingGrpcChannelProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1200,11 +1200,20 @@ boolean isDirectPathBoundTokenEnabled() {
CallCredentials createHardBoundTokensCallCredentials(
ComputeEngineCredentials.GoogleAuthTransport googleAuthTransport,
ComputeEngineCredentials.BindingEnforcement bindingEnforcement) {
ComputeEngineCredentials.Builder credsBuilder =
((ComputeEngineCredentials) credentials).toBuilder();
// We only set scopes and HTTP transport factory from the original credentials because
Copy link
Member

@rockspore rockspore Feb 22, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For future readers, could you explain briefly in the comment why we create it from a newBuilder()?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! Done.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, yes thanks! This is an known issue in the Auth Library that we're slowly trying to fix as well and sorry to see that this also bit you all.

The existing access token will be invalidated (not copied) in the future from the builder.

// only those are used in gRPC CallCredentials to fetch request metadata.
// only those are used in gRPC CallCredentials to fetch request metadata. We create a new
// credential
// via {@code newBuilder} as opposed to {@code toBuilder} because we don't want a reference to
// the
// access token held by {@code credentials}; we want this new credential to fetch a new access
// token
// from MDS using the {@param googleAuthTransport} and {@param bindingEnforcement}.
return MoreCallCredentials.from(
((ComputeEngineCredentials) this.credentials)
.toBuilder()
ComputeEngineCredentials.newBuilder()
.setScopes(credsBuilder.getScopes())
.setHttpTransportFactory(credsBuilder.getHttpTransportFactory())
.setGoogleAuthTransport(googleAuthTransport)
.setBindingEnforcement(bindingEnforcement)
.build());
Expand Down
Loading