Query S2A Address from MDS #1400

rmehta19 · 2024-05-09T00:20:33Z

Add utility to get S2A address from MDS MTLS autoconfiguration endpoint.

This utility will be used when creating mTLS channel using S2A Java Client, which takes S2A Address as input to create S2AChannelCredentials.

Parallel change in go: googleapis/google-api-go-client#1874
S2A Java client: grpc/grpc-java#11113

rmehta19 · 2024-05-14T23:56:00Z

cc: @xmenxk

oauth2_http/java/com/google/auth/oauth2/S2A.java

xmenxk · 2024-05-15T03:06:50Z

oauth2_http/java/com/google/auth/oauth2/S2A.java

+      if (transportFactory == null) {
+        transportFactory =
+            Iterables.getFirst(
+                ServiceLoader.load(HttpTransportFactory.class), OAuth2Utils.HTTP_TRANSPORT_FACTORY);
+      }
+      String url = getMdsMtlsEndpoint();
+      GenericUrl genericUrl = new GenericUrl(url);
+      HttpRequest request =
+          transportFactory.create().createRequestFactory().buildGetRequest(genericUrl);
+      JsonObjectParser parser = new JsonObjectParser(OAuth2Utils.JSON_FACTORY);
+      request.setParser(parser);
+      request.getHeaders().set(METADATA_FLAVOR, GOOGLE);
+      request.setThrowExceptionOnExecuteError(false);
+      HttpResponse response = request.execute();
+
+      if (!response.isSuccessStatusCode()) {
+        return MtlsConfig.createBuilder().build();
+      }
+
+      InputStream content = response.getContent();
+      if (content == null) {
+        return MtlsConfig.createBuilder().build();
+      }


is it possible to reuse the code below for querying mds endpoint?

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ComputeEngineCredentials.java

Line 338 in dde6876

private HttpResponse getMetadataResponse(String url) throws IOException {

We could use this function to get the MDS HttpResponse, but it would only replace a few lines (~7) in this function:

creating the HttpRequest and executing it to get the response, replaced with

response = getMetadataResponse(url).

However, in order to do this, we would also have to:

ignore the ComputeEngineCredentials specific errors thrown by the function, because we only care if we are able to successfully create a response (aligning with Go implementation, return empty S2A Address if any error). This technically works, although I am not sure it is best practice.

getMetadataResponse(String url) is not static, so we would have to create an instance of ComputeEngineCredentials to use it.

WDYT?

…n' into s2a-java-integration

sonarcloud · 2024-05-17T17:49:40Z

Quality Gate passed

Issues
4 New issues
0 Accepted issues

Measures
0 Security Hotspots
87.3% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

rmehta19 · 2024-06-25T17:24:40Z

@westarle, friendly ping :). Please review when you get a chance.

clundin25 · 2024-07-15T20:25:15Z

oauth2_http/java/com/google/auth/oauth2/MtlsConfig.java

+import com.google.errorprone.annotations.CanIgnoreReturnValue;
+
+/** Holds an mTLS configuration (consists of address of S2A) retrieved from the Metadata Server. */
+public final class MtlsConfig {


I think this should be re-branded to S2AConfig. MtlsConfig is much more generic than the settings in this class.

Done in 359fd43

clundin25 · 2024-07-15T22:16:28Z

oauth2_http/java/com/google/auth/oauth2/S2A.java

+  public static final String METADATA_FLAVOR = "Metadata-Flavor";
+  public static final String GOOGLE = "Google";
+  private static final int MAX_MDS_PING_TRIES = 3;
+  private static final String PARSE_ERROR_S2A = "Error parsing Mtls Auto Config response.";


Is there any existing code for these constants?

Some are defined in ComputeEngineCredentials.

clundin25 · 2024-07-15T22:16:45Z

oauth2_http/java/com/google/auth/oauth2/S2A.java

+ */
+@ThreadSafe
+public final class S2A {
+  public static final String MTLS_CONFIG_ENDPOINT =


Suggested change

public static final String MTLS_CONFIG_ENDPOINT =

public static final String S2A_CONFIG_ENDPOINT_POSTFIX =

Done in bce602e

clundin25 · 2024-07-15T22:17:22Z

oauth2_http/java/com/google/auth/oauth2/S2A.java

+  public static final String METADATA_FLAVOR = "Metadata-Flavor";
+  public static final String GOOGLE = "Google";
+  private static final int MAX_MDS_PING_TRIES = 3;
+  private static final String PARSE_ERROR_S2A = "Error parsing Mtls Auto Config response.";


I think this error message should be expanded to explain what went wrong and how it can be triaged.

Done in b82790a

clundin25 · 2024-07-15T22:18:15Z

oauth2_http/java/com/google/auth/oauth2/S2A.java

+    if (config == null) {
+      config = getMdsMtlsConfig();
+    }
+    return config.getMtlsS2AAddress();


Could a valid config be a requirement to instantiate this class?

The behavior we would like is for the S2A config to be queried once from the MDS, all subsequent requests from the application for the S2A config should return the cached config.
Re: Could a valid config be a requirement to instantiate this class

I think we can do this and perhaps simplify the code. I moved the call to get the config to the constructor.

32caef5

clundin25 · 2024-07-15T22:19:22Z

oauth2_http/java/com/google/auth/oauth2/S2A.java

+   *
+   * @return the {@link MtlsConfig}.
+   */
+  private MtlsConfig getMdsMtlsConfig() {


Suggested change

private MtlsConfig getMdsMtlsConfig() {

private MtlsConfig getS2AConfigFromMDS() {

Done in bce602e

clundin25 · 2024-07-15T22:23:08Z

oauth2_http/java/com/google/auth/oauth2/S2A.java

+        if (transportFactory == null) {
+          transportFactory =
+              Iterables.getFirst(
+                  ServiceLoader.load(HttpTransportFactory.class), OAuth2Utils.HTTP_TRANSPORT_FACTORY);
+        }


Should this be outside of the loop?

Done in 05aa9cc

clundin25 · 2024-07-15T22:23:28Z

oauth2_http/java/com/google/auth/oauth2/S2A.java

+        }
+        HttpRequest request =
+            transportFactory.create().createRequestFactory().buildGetRequest(genericUrl);
+        JsonObjectParser parser = new JsonObjectParser(OAuth2Utils.JSON_FACTORY);


Should this be outside of the loop?

Done in 05aa9cc

clundin25 · 2024-07-15T22:24:36Z

oauth2_http/java/com/google/auth/oauth2/S2A.java

+          .setMtlsS2AAddress(mtlsS2AAddress)
+          .build();
+    }
+    return MtlsConfig.createBuilder().build();


How will callers know if a valid config is returned?

If the plaintext and mTLS S2A addresses are able to be parsed from the MDS response, it is a valid config. The MDS MTLS Autoconfig endpoint always returns the address that S2A is running at, if available. It is the caller's responsibility to check if the address is empty before passing it on the S2A Client to create ChannelCredentials (example). This is similar to what we do in Go: https://github.com/googleapis/google-api-go-client/blob/main/internal/s2a.go#L22-L31

sonarcloud · 2024-09-26T21:56:34Z

Quality Gate passed

Issues
4 New issues
0 Accepted issues

Measures
0 Security Hotspots
90.6% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

clundin25 · 2024-10-01T17:26:38Z

oauth2_http/java/com/google/auth/oauth2/S2A.java

+        HttpRequest request =
+            transportFactory.create().createRequestFactory().buildGetRequest(genericUrl);
+        request.setParser(parser);
+        request.getHeaders().set(METADATA_FLAVOR, GOOGLE);
+        request.setThrowExceptionOnExecuteError(false);


Can the request be re-used across loops?

Not familiar with Java, but I imagine it's re-usable / expensive to create on each loop.

Done in 1466f0d

clundin25 · 2024-10-01T17:27:38Z

oauth2_http/java/com/google/auth/oauth2/S2A.java

+    String plaintextS2AAddress = "";
+    String mtlsS2AAddress = "";


nit: Why declare these at the top? Is it a code style choice?

It could be declared in the loop, moved in be1cfd2

clundin25 · 2024-10-01T17:28:57Z

oauth2_http/java/com/google/auth/oauth2/S2A.java

+          .setMtlsAddress(mtlsS2AAddress)
+          .build();
+    }
+    return S2AConfig.createBuilder().build();


So consumers will have to check if the config contains empty strings? Could you use a result type or other form of indication that you were unable to build a valid config?

This was done to keep consistency with Go implementation: https://github.com/googleapis/google-api-go-client/blob/main/internal/s2a.go#L22

The rationale is that we do not want to throw an error from this API that the client has to handle. If any problem occurs querying the endpoint for the address, we return an empty address. The client can pass that empty address to the S2A Client libraries, which will throw an error (e.g. something like "Error: Empty S2A Address.").

rmehta19 added 5 commits February 23, 2024 18:15

utils.

c96cb4a

formatted.

f90be0b

static mtls config.

0c64a0a

update autoconfig endpoint URL.

993663d

plaintext and mtls S2A address.

0f96e86

rmehta19 requested a review from a team as a code owner May 9, 2024 00:20

product-auto-label bot added the size: l Pull request size is large. label May 9, 2024

rmehta19 added 5 commits May 8, 2024 17:24

utils.

3d68cef

formatted.

6d75a4e

static mtls config.

d932e0c

update autoconfig endpoint URL.

6aa071b

plaintext and mtls S2A address.

ddac7aa

rmehta19 force-pushed the s2a-java-integration branch from 0f96e86 to ddac7aa Compare May 9, 2024 00:24

clundin25 requested a review from westarle May 13, 2024 18:36

xmenxk reviewed May 15, 2024

View reviewed changes

rmehta19 added 3 commits May 17, 2024 09:50

Merge remote-tracking branch 'refs/remotes/origin/s2a-java-integratio…

2c26736

…n' into s2a-java-integration

Use logic in ComputeEngineCredentials to get MDS URL.

67f9462

retry MDS request.

36d4cd1

clundin25 reviewed Jul 15, 2024

View reviewed changes

Merge branch 'main' into s2a-java-integration

fc2b246

rmehta19 requested a review from a team as a code owner September 26, 2024 21:03

rmehta19 added 5 commits September 26, 2024 14:26

rebranch MtlsConfig as S2AConfig.

359fd43

change naming to S2AConfig elsewhere.

bce602e

set config in constructor.

32caef5

make error message more specific.

b82790a

move creation of transportFactory and parser out of loop.

05aa9cc

clundin25 reviewed Oct 1, 2024

View reviewed changes

construct request once.

1466f0d

rmehta19 force-pushed the s2a-java-integration branch from 99b7257 to 1466f0d Compare October 2, 2024 19:52

move declare to loop.

be1cfd2

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Query S2A Address from MDS #1400

Query S2A Address from MDS #1400

rmehta19 commented May 9, 2024

rmehta19 commented May 14, 2024

xmenxk May 15, 2024

rmehta19 May 17, 2024

sonarcloud bot commented May 17, 2024

rmehta19 commented Jun 25, 2024

clundin25 Jul 15, 2024

rmehta19 Sep 26, 2024

clundin25 Jul 15, 2024

rmehta19 Sep 26, 2024

clundin25 Jul 15, 2024

rmehta19 Sep 26, 2024

clundin25 Jul 15, 2024

rmehta19 Sep 26, 2024

clundin25 Jul 15, 2024

rmehta19 Sep 26, 2024

clundin25 Jul 15, 2024

rmehta19 Sep 26, 2024

clundin25 Jul 15, 2024

rmehta19 Sep 26, 2024

clundin25 Jul 15, 2024

rmehta19 Sep 26, 2024

clundin25 Jul 15, 2024

rmehta19 Sep 26, 2024

sonarcloud bot commented Sep 26, 2024

clundin25 Oct 1, 2024

rmehta19 Oct 2, 2024 •

edited

Loading

clundin25 Oct 1, 2024

rmehta19 Oct 2, 2024

clundin25 Oct 1, 2024

rmehta19 Oct 2, 2024

	public static final String MTLS_CONFIG_ENDPOINT =
	public static final String S2A_CONFIG_ENDPOINT_POSTFIX =

	private MtlsConfig getMdsMtlsConfig() {
	private MtlsConfig getS2AConfigFromMDS() {

Query S2A Address from MDS #1400

Are you sure you want to change the base?

Query S2A Address from MDS #1400

Conversation

rmehta19 commented May 9, 2024

rmehta19 commented May 14, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sonarcloud bot commented May 17, 2024

Quality Gate passed

rmehta19 commented Jun 25, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sonarcloud bot commented Sep 26, 2024

Quality Gate passed

Choose a reason for hiding this comment

rmehta19 Oct 2, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rmehta19 Oct 2, 2024 •

edited

Loading