feat(oauth2): implement IAM impersonation mTLS transport pinning and 401 recovery - #14212
Open
macastelaz wants to merge 2 commits into
Open
macastelaz wants to merge 2 commits into
macastelaz wants to merge 2 commits into
Conversation
macastelaz
marked this pull request as draft
August 30, 2026 02:28
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request introduces support for actor tokens in IdentityPoolCredentials (specifically for file-based JSON credential sources over mTLS endpoints) and adds certificate pinning with automatic certificate reloading on 401 Unauthorized errors. It also updates other credential classes to support passing a custom HttpTransportFactory during token refresh, masks actor tokens in logs, and adds corresponding unit tests. The review feedback suggests persisting the reloaded transport factory back to this.transportFactory after a successful retry to prevent subsequent refreshes from failing first, and preserving programmatically set actorTokenSupplier instances in the Builder copy constructor.
macastelaz
force-pushed
the
cert-bound-oauth-iam-pinning
branch
from
August 30, 2026 03:19
73a0301 to
4be79cb
Compare
macastelaz
force-pushed
the
cert-bound-oauth-iam-pinning
branch
from
September 1, 2026 02:09
4be79cb to
ce341c7
Compare
macastelaz
marked this pull request as ready for review
September 4, 2026 16:41
…401 recovery - Pin mTLS HttpTransportFactory across multi-step STS and IAM token exchanges so both requests use the exact same certificate snapshot within a single refresh cycle. - Add 401 Unauthorized recovery with automatic certificate reload from X509Provider and single-retry coordination in IdentityPoolCredentials and ImpersonatedCredentials. - Preserve custom non-default HttpTransportFactory instances when X509Provider is configured. - Add comprehensive unit tests across IdentityPoolCredentialsTest, ImpersonatedCredentialsTest, and OAuth2UtilsTest.
macastelaz
force-pushed
the
cert-bound-oauth-iam-pinning
branch
from
September 17, 2026 03:17
e09d76e to
dadeda6
Compare
…dentials and address review findings - Explicitly scope inner sourceCredentials to CLOUD_PLATFORM_SCOPE in ExternalAccountCredentials.buildImpersonatedCredentials and ImpersonatedCredentials.refreshAccessToken so STS issues tokens authorized to call IAM generateAccessToken even when downstream target scopes are configured via createScoped. - Ensure public no-arg ImpersonatedCredentials.refreshAccessToken delegates without overriding source credential transport settings. - Preserve custom actorTokenSupplier in IdentityPoolCredentials.Builder copy constructor when credentialSource is present. - Ensure HTTP response is closed in a finally block in ImpersonatedCredentials.refreshAccessToken. - Attach initial 401 exception as suppressed when the 401 retry attempt fails in IdentityPoolCredentials.refreshWithRetry. - Add unit tests in IdentityPoolCredentialsTest and ImpersonatedCredentialsTest covering scoped impersonation, custom actorTokenSupplier preservation, and retry exception chaining.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🥞 Stacked PRs
Summary
Propagates the cycle-pinned mTLS transport factory into
ImpersonatedCredentialsduring Workload Identity Federation with Service Account Impersonation, ensuring the IAMgenerateAccessTokencall uses the exact same pinned client certificate as the STS token exchange.Also extends 401 recovery in
IdentityPoolCredentialsto catch unauthorized responses across both STS and IAM calls, reloading fresh certificates and re-executing the full refresh cycle.Test Coverage
oauth2_http(including transport pinning lifecycle, multi-cycle rotation, 401 retry on IAM, and suppressed error handling).com.spotify.fmt:fmt-maven-plugin:2.25).See b/542238030 for tracking.