feat: add workload identity federation support #547

lsirac · 2021-01-28T23:42:17Z

See go/guac-3pi-java.

Add documentation/snippets

* feat: adds an internal token exchange utility based on https://tools.ietf.org/html/rfc8693 * fix: add copyright and address other comments * fix: fix formatting * fix: fixes copyright again * fix: revert pom changes * fix: revert auto-value changes * fix: remove gson and address other comments * fix: fixes to StsRequestHandlerTest

* feat: adds base external account credentials class and support for file/url based external credentials * fix: javadoc changes * fix: address review comments * fix: nits * fix: fix broken test * fix: format

* feat: implements AWS signature version 4 for signing requests * fix: fix javadoc * fix: address review comments * fix: changes to visibility and addresses other review comments * fix: removes sortedHeaderNames from AwsRequestSignature, uses MessageDigest, and misc changes * feat: generate authorization header in AwsRequestSigner * fix: address more review comments * fix: use RuntimeExceptions instead of invalid state/argument * fix: javadoc * fix: handle invalid input in Builder & misc fixes * fix: get dates at construction and no longer catch ParseException in AwsDates * fix: refactor AwsDates

* feat: adds text/json credential source support to IdentityPoolCredentials * fix: format * fix: format * fix: add missing changes to MockExternalAccountCredentialsTransport * fix: change parseToken to take an InputStream * fix: charsets * fix: broken build * fix: type null check

* feat: adds support for AWS credentials * fix: address nits * fix: remove Truth lib use in AwsCredentialsTest * fix: address more review comments * fix: assertEquals param order * feat: retrieve region from environment variable for AWS Lambda

…for 3pi (#501) * chore: use ImpersonatedCredentials for service account impersonation in ExternalAccountCredentials * chore: add test for invalid service account impersonation url

* fix: update AwsCredentials credential source logic * fix: remove TODOs * fix: cleanup * fix: code review nits * fix: fix broken test * fix: lint

codecov · 2021-01-28T23:43:36Z

Codecov Report

Merging #547 (c7f5730) into master (2142db3) will increase coverage by 3.39%.
The diff coverage is 93.25%.

@@             Coverage Diff              @@
##             master     #547      +/-   ##
============================================
+ Coverage     79.92%   83.32%   +3.39%     
- Complexity      421      571     +150     
============================================
  Files            28       41      +13     
  Lines          1978     2645     +667     
  Branches        215      274      +59     
============================================
+ Hits           1581     2204     +623     
- Misses          284      301      +17     
- Partials        113      140      +27

Impacted Files	Coverage Δ	Complexity Δ
...java/com/google/auth/oauth2/GoogleCredentials.java	`63.04% <50.00%> (+1.67%)`	`11.00 <0.00> (+1.00)`
...om/google/auth/oauth2/IdentityPoolCredentials.java	`86.02% <86.02%> (ø)`	`12.00 <12.00> (?)`
...om/google/auth/oauth2/StsTokenExchangeRequest.java	`86.84% <86.84%> (ø)`	`19.00 <19.00> (?)`
.../java/com/google/auth/oauth2/AwsRequestSigner.java	`88.67% <88.67%> (ø)`	`19.00 <19.00> (?)`
...m/google/auth/oauth2/StsTokenExchangeResponse.java	`90.32% <90.32%> (ø)`	`8.00 <8.00> (?)`
...tp/java/com/google/auth/oauth2/AwsCredentials.java	`94.17% <94.17%> (ø)`	`16.00 <16.00> (?)`
...va/com/google/auth/oauth2/AwsRequestSignature.java	`97.50% <97.50%> (ø)`	`9.00 <9.00> (?)`
...google/auth/oauth2/ExternalAccountCredentials.java	`97.61% <97.61%> (ø)`	`26.00 <26.00> (?)`
...java/com/google/auth/oauth2/StsRequestHandler.java	`98.68% <98.68%> (ø)`	`17.00 <17.00> (?)`
..._http/java/com/google/auth/oauth2/ActingParty.java	`100.00% <100.00%> (ø)`	`3.00 <3.00> (?)`
... and 17 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 2142db3...c7f5730. Read the comment docs.

elharo

This is a lot easier to review if you keep it on the same branch. Earlier comments apply.

elharo

Merge master

oauth2_http/java/com/google/auth/oauth2/AwsCredentials.java

oauth2_http/java/com/google/auth/oauth2/AwsRequestSigner.java

oauth2_http/java/com/google/auth/oauth2/AwsRequestSignature.java

oauth2_http/java/com/google/auth/oauth2/StsTokenExchangeResponse.java

oauth2_http/javatests/com/google/auth/oauth2/ExternalAccountCredentialsTest.java

elharo

merge in master

oauth2_http/java/com/google/auth/oauth2/AwsCredentials.java

silvolu

Auth bits look good, please resolve comments from @elharo

elharo

merge in master

oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java

oauth2_http/java/com/google/auth/oauth2/IdentityPoolCredentials.java

oauth2_http/java/com/google/auth/oauth2/OAuthException.java

oauth2_http/java/com/google/auth/oauth2/StsRequestHandler.java

oauth2_http/java/com/google/auth/oauth2/AwsCredentials.java

oauth2_http/java/com/google/auth/oauth2/IdentityPoolCredentials.java

oauth2_http/javatests/com/google/auth/oauth2/ExternalAccountCredentialsTest.java

oauth2_http/javatests/com/google/auth/oauth2/IdentityPoolCredentialsTest.java

oauth2_http/javatests/com/google/auth/oauth2/StsRequestHandlerTest.java

elharo

worth considering if any of the public classes and methods should be marked @Beta. In the near future it's going to be getting a lot harder to change something once we've shipped it than it has been in the past.

oauth2_http/java/com/google/auth/oauth2/IdentityPoolCredentials.java

…brary-java into byoid

elharo · 2021-02-17T18:36:05Z

oauth2_http/java/com/google/auth/oauth2/AwsCredentials.java

+ *
+ * <p>By default, attempts to exchange the external credential for a GCP access token.
+ */
+public class AwsCredentials extends ExternalAccountCredentials {


does this class need to be public? It looks like the only public methods are overridden or visible for testing, so I'm guessing no. The less API we have to publish and support ever after the better.

I'd prefer to keep this public. Developers can initialize an AwsCredential and use it directly, and other credentials follow that pattern. They also need to be able to create an AwsCredential with specific scopes.

oauth2_http/java/com/google/auth/oauth2/AwsRequestSigner.java

elharo · 2021-02-17T18:39:28Z

oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java

+    implements QuotaProjectIdProvider {
+
+  /** Base credential source class. Dictates the retrieval method of the external credential. */
+  abstract static class CredentialSource {


could/should this be an outer class? ExternalAccountCredentials is so large github won't even display it by default, which suggests it might help to break it up.

I don't think this makes sense as an outer class. It's required for all external credentials and not used in any other context. It's also confusing if you come across it outside of this class.

oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java

oauth2_http/java/com/google/auth/oauth2/StsRequestHandler.java

oauth2_http/java/com/google/auth/oauth2/StsTokenExchangeRequest.java

oauth2_http/java/com/google/auth/oauth2/StsTokenExchangeResponse.java

oauth2_http/java/com/google/auth/oauth2/AwsRequestSigner.java

oauth2_http/java/com/google/auth/oauth2/IdentityPoolCredentials.java

oauth2_http/java/com/google/auth/oauth2/OAuthException.java

oauth2_http/java/com/google/auth/oauth2/AwsCredentials.java

elharo · 2021-02-17T22:14:23Z

oauth2_http/java/com/google/auth/oauth2/AwsCredentials.java

+        throw new IllegalArgumentException("Invalid AWS environment ID.");
+      }
+
+      int environmentVersion = Integer.parseInt(matcher.group(2));


more simply, this looks like the string simply equals the literal "aws1"

hmm we have to parse the version anyway for the error message

oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java

…brary-java into byoid

lsirac and others added 16 commits August 5, 2020 16:10

feat: adds support for 3PI credentials (#464)

ebb4486

* feat: adds base external account credentials class and support for file/url based external credentials * fix: javadoc changes * fix: address review comments * fix: nits * fix: fix broken test * fix: format

Merge branch 'master' into 3pi

d639a78

Merge branch 'master' into 3pi

f7f741a

feat: add quota project ID to requestMetadata if present (#495)

dc16550

chore: remove use of Truth assertions (#498)

6d04b05

feat: add external account credentials to ADC (#500)

124c77c

chore: use ImpersonatedCredentials for service account impersonation …

17e849e

…for 3pi (#501) * chore: use ImpersonatedCredentials for service account impersonation in ExternalAccountCredentials * chore: add test for invalid service account impersonation url

fix: fix issues found through manual testing (#506)

223c6ec

Merge branch 'master' into 3pi

478f33b

fix: updates AWS credential source (#520)

3769b90

* fix: update AwsCredentials credential source logic * fix: remove TODOs * fix: cleanup * fix: code review nits * fix: fix broken test * fix: lint

Merge branch 'master' into 3pi

0ccd43d

fix: merge

48405f7

lsirac requested a review from a team as a code owner January 28, 2021 23:42

google-cla bot added the cla: yes This human has signed the Contributor License Agreement. label Jan 28, 2021

elharo suggested changes Jan 29, 2021

View reviewed changes

elharo requested a review from silvolu January 29, 2021 12:46

lsirac added 3 commits January 29, 2021 12:12

fix: address review comments

36ff0f6

fix: remove assertThrows

b9b9f8d

lsirac requested a review from elharo February 2, 2021 01:34

elharo reviewed Feb 2, 2021

View reviewed changes

fix: address review comments

a980a19

lsirac requested a review from elharo February 3, 2021 00:31

elharo reviewed Feb 9, 2021

View reviewed changes

oauth2_http/java/com/google/auth/oauth2/AwsCredentials.java Show resolved Hide resolved

lsirac changed the title ~~feat: adds support for 3p identities~~ feat: workload identity federation support Feb 10, 2021

silvolu approved these changes Feb 12, 2021

View reviewed changes

fix: review comments

6c3982c

lsirac requested a review from elharo February 12, 2021 04:10

elharo reviewed Feb 12, 2021

View reviewed changes

fix: more review comments

25c884b

lsirac requested a review from elharo February 12, 2021 20:13

elharo reviewed Feb 12, 2021

View reviewed changes

fix: review

bd49373

lsirac requested a review from elharo February 13, 2021 00:14

elharo reviewed Feb 13, 2021

View reviewed changes

fix: review

de0960d

lsirac requested a review from elharo February 13, 2021 00:59

Merge branch 'master' of https://github.com/googleapis/google-auth-li…

4d384b9

…brary-java into byoid

elharo reviewed Feb 17, 2021

View reviewed changes

fix: review

c9ee282

lsirac requested a review from elharo February 17, 2021 20:51

fix: add CredentialFormatException

623d878

elharo reviewed Feb 17, 2021

View reviewed changes

fix: review

1fe5188

elharo approved these changes Feb 17, 2021

View reviewed changes

Merge branch 'master' of https://github.com/googleapis/google-auth-li…

56a2e2b

…brary-java into byoid

chingor13 approved these changes Feb 18, 2021

View reviewed changes

Merge branch 'master' into byoid

c7f5730

chingor13 changed the title ~~feat: workload identity federation support~~ feat: add workload identity federation support Feb 18, 2021

chingor13 merged commit b8dde1e into googleapis:master Feb 18, 2021

release-please bot mentioned this pull request Jan 4, 2022

chore(main): release google-auth-library-java 1.0.0 #819

Closed

hermanbanken mentioned this pull request Mar 4, 2022

How can I authenticate using Workload identity federation? googleapis/google-auth-library-ruby#354

Open

release-please bot mentioned this pull request Aug 11, 2022

chore(main): release 1.11.0 #974

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add workload identity federation support #547

feat: add workload identity federation support #547

lsirac commented Jan 28, 2021 •

edited by chingor13

codecov bot commented Jan 28, 2021 •

edited

elharo left a comment

elharo left a comment

elharo left a comment

silvolu left a comment

elharo left a comment

elharo left a comment

elharo Feb 17, 2021

lsirac Feb 17, 2021

elharo Feb 17, 2021

lsirac Feb 17, 2021 •

edited

elharo Feb 17, 2021

lsirac Feb 17, 2021

feat: add workload identity federation support #547

feat: add workload identity federation support #547

Conversation

lsirac commented Jan 28, 2021 • edited by chingor13

codecov bot commented Jan 28, 2021 • edited

Codecov Report

elharo left a comment

Choose a reason for hiding this comment

elharo left a comment

Choose a reason for hiding this comment

elharo left a comment

Choose a reason for hiding this comment

silvolu left a comment

Choose a reason for hiding this comment

elharo left a comment

Choose a reason for hiding this comment

elharo left a comment

Choose a reason for hiding this comment

elharo Feb 17, 2021

Choose a reason for hiding this comment

lsirac Feb 17, 2021

Choose a reason for hiding this comment

elharo Feb 17, 2021

Choose a reason for hiding this comment

lsirac Feb 17, 2021 • edited

Choose a reason for hiding this comment

elharo Feb 17, 2021

Choose a reason for hiding this comment

lsirac Feb 17, 2021

Choose a reason for hiding this comment

lsirac commented Jan 28, 2021 •

edited by chingor13

codecov bot commented Jan 28, 2021 •

edited

lsirac Feb 17, 2021 •

edited