Skip to content

feat(auth): mTLS endpoint for Regional Access Boundaries - #13318

Open
vverman wants to merge 28 commits into
googleapis:new-regional-access-boundaries-july2026from
vverman:regional-access-boundaries
Open

feat(auth): mTLS endpoint for Regional Access Boundaries#13318
vverman wants to merge 28 commits into
googleapis:new-regional-access-boundaries-july2026from
vverman:regional-access-boundaries

Conversation

@vverman

@vverman vverman commented May 31, 2026

Copy link
Copy Markdown
Contributor

Added logic to:

  1. Centralize mTLS enablement logic within the auth library.
  2. Based on 1. determine whether mtls or regular RAB lookup endpoint should be called.
  3. Added tests for the same.

gemini-code-assist[bot]
gemini-code-assist Bot reviewed May 31, 2026
View reviewed changes

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces centralized mTLS enablement checks and adds fallback support for SPIFFE credentials in MtlsUtils and X509Provider, alongside integrating mTLS transport initialization during regional access boundary refreshes. The review feedback suggests optimizing performance by removing redundant configuration checks and file parsing in X509Provider.getKeyStore() and GoogleCredentials.java, and improving robustness in RegionalAccessBoundary.java by replacing only the host name in the IAM credentials URL.

Comment thread google-auth-library-java/oauth2_http/java/com/google/auth/mtls/X509Provider.java
Comment thread google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java Outdated
Comment thread google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundary.java Outdated
@vverman vverman changed the title Regional access boundaries feat(auth): mTLS endpoint for Regional Access Boundaries Jun 1, 2026
@vverman
vverman marked this pull request as ready for review June 4, 2026 08:45
@vverman
vverman requested review from a team as code owners June 4, 2026 08:45
@vverman
vverman marked this pull request as draft June 4, 2026 08:46
@vverman
vverman marked this pull request as ready for review June 4, 2026 22:05
@vverman
vverman requested review from lqiu96 and nbayati June 4, 2026 22:05
lsirac
lsirac reviewed Jun 5, 2026
View reviewed changes

@lsirac lsirac left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we be checking GOOGLE_API_USE_MTLS_ENDPOINT?

lsirac
lsirac reviewed Jun 5, 2026
View reviewed changes
Comment thread google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsUtils.java Outdated
* @throws IOException if the configuration file is present but contains missing or malformed
* files
*/
public static boolean canMtlsBeEnabled(

@lsirac lsirac Jun 5, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I’m not sure that cert being present == automatically use mTLS. They can be using different credentials / not using it at all. So then we’d be adding mTLS setup and calls for credentials that are not actually using it.

I think the decision should be based on the credential type, and perhaps expose some state from the credential that we can use to check if mTLS should happen for these calls.

lqiu96
lqiu96 reviewed Jun 5, 2026
View reviewed changes
Comment thread google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsUtils.java
lqiu96
lqiu96 reviewed Jun 5, 2026
View reviewed changes
Comment thread google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsUtils.java Outdated
lqiu96
lqiu96 reviewed Jun 5, 2026
View reviewed changes
Comment thread google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsUtils.java Outdated
lqiu96
lqiu96 reviewed Jun 5, 2026
View reviewed changes
Comment thread google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsUtils.java Outdated
lqiu96
lqiu96 reviewed Jun 5, 2026
View reviewed changes
Comment thread google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundary.java Outdated
nbayati
nbayati requested changes Jun 10, 2026
View reviewed changes
Comment thread google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsUtils.java
Comment thread google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundary.java Outdated
Comment thread google-auth-library-java/oauth2_http/java/com/google/auth/mtls/X509Provider.java Outdated
@vverman
vverman force-pushed the regional-access-boundaries branch from 2c53152 to 48c3b59 Compare June 11, 2026 02:13
@vverman
vverman requested review from lqiu96 and nbayati June 11, 2026 03:16
lqiu96
lqiu96 reviewed Jun 11, 2026
View reviewed changes
Comment thread google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsUtils.java Outdated
lqiu96
lqiu96 reviewed Jun 11, 2026
View reviewed changes
Comment thread google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsUtils.java
lqiu96
lqiu96 reviewed Jun 11, 2026
View reviewed changes
Comment thread google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsUtils.java Outdated
lqiu96
lqiu96 reviewed Jun 11, 2026
View reviewed changes
Comment thread google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsUtils.java Outdated
lqiu96
lqiu96 reviewed Jun 11, 2026
View reviewed changes
Comment thread google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsUtils.java Outdated
lqiu96
lqiu96 reviewed Jun 11, 2026
View reviewed changes
Comment thread google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java Outdated
lqiu96
lqiu96 reviewed Jun 11, 2026
View reviewed changes
Comment thread google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java Outdated
vverman added 13 commits July 14, 2026 17:04
@vverman
nit Fixes.
c9bd60b
@vverman
Moved cert-discovery to a common function. Addressed PR comments.
4ba1d2f
@vverman
cache userMtlsPolicy so we read only once other comment addressals.
9bd60fd
@vverman
lint fixes.
e6d3be9
@vverman
canMtlsBeEnabled changes.
dcb4c18
@vverman
userMtlsPolicy DCL lock check for concurrency.
afde0d3
@vverman
fix: address technical review findings for regional access boundary m…
b65c895 
…TLS refresh

- MtlsUtils:
  - Validate custom transport factory outside try-block to prevent swallowing exceptions.
  - Add null check for baseTransportFactory to prevent NullPointerException.
  - Wrap getWellKnownCertificateConfigFile call to enforce the exception contract.
  - Use case-insensitive matching for GOOGLE_API_USE_MTLS_ENDPOINT.
- RegionalAccessBoundary & Manager:
  - Remove JVM-wide userMtlsPolicy static cache to prevent test pollution.
  - Inject EnvironmentProvider dynamically to refresh methods.
- MockExternalAccountCredentialsTransport:
  - Strip .mtls. subdomain before looking up regional access boundaries.
  - Define host-only IAM_ENDPOINT and MTLS_IAM_ENDPOINT constants.
- GoogleCredentialsTest:
  - Add test asserting boundary refresh hits .mtls. subdomain when required.
- oauth2_http/pom.xml:
  - Set GOOGLE_API_USE_CLIENT_CERTIFICATE=false in surefire config to isolate tests.
@vverman
lint fixes.
579f4bf
@vverman
Changed check to enable mTLS so we only do it once every ~5 hours.
76a22bb
@vverman
lint fixes.
3fed9f7
@vverman
feat(mtls): support custom HttpTransportFactory with mTLS and improve…
d6331d9 
… exception wrapping

- MtlsUtils:
  - Trust and preserve developer's custom HttpTransportFactory when mTLS is enabled instead of throwing IOException.
- X509Provider:
  - Move workload certificate configuration resolution inside the try-catch block to properly wrap certificate source errors into IOException.
- RegionalAccessBoundary & Manager:
  - Move subdomain substitution (.mtls.) logic to RegionalAccessBoundaryManager, gating it on MtlsUtils.canBeEnabled.
  - Simplify RegionalAccessBoundary.refresh signature.
- Tests:
  - Add unit tests verifying custom HttpTransportFactory retention under AUTO and ALWAYS policies.
  - Add tests validating proper wrapping of JSON parsing failures in X509Provider.
@vverman
test fix.
13c69af
@vverman
Improves regional access boundary cooldown on task submission failure…
ba2d3ca 
…s, adds 3-minute token clock skew buffer, and fixes mTLS fallback logic.
@vverman
vverman force-pushed the regional-access-boundaries branch from 43d72dc to ba2d3ca Compare July 15, 2026 00:56
lsirac
lsirac requested changes Jul 15, 2026
View reviewed changes
Comment thread google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsUtils.java
Comment thread google-auth-library-java/oauth2_http/java/com/google/auth/mtls/X509Provider.java Outdated
Comment thread ...auth-library-java/oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundaryManager.java
@vverman
vverman requested a review from lqiu96 July 15, 2026 22:06
vverman added 4 commits July 15, 2026 15:54
@vverman
removed test which needed static mocking.
bcc2932
@vverman
Added double check when refreshing RAB to ensure no duplicated refres…
99d19a0 
…hes are queued.
@vverman
decouple mTLS endpoint selection and certificate availability checks …
161f288 
…per AIP-4114, removing fail-fast exceptions when client certificates are unavailable under always policy.
@vverman
restore X509Provider.isAvailable to check certificate store availabil…
dfbe814 
…ity rather than configuration flags, and add unit tests.
@vverman
vverman requested a review from lsirac July 16, 2026 23:06
lsirac
lsirac requested changes Jul 17, 2026
View reviewed changes
Comment thread ...auth-library-java/oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundaryManager.java
Comment thread google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsUtils.java
Comment thread google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsUtils.java Outdated
Comment thread ...auth-library-java/oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundaryManager.java Outdated
@vverman
vverman requested a review from lsirac July 20, 2026 18:43
lsirac
lsirac approved these changes Jul 28, 2026
View reviewed changes

@lsirac lsirac left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

some things are missing / need to be fixed but the next owner of this work will pick it up.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lsirac lsirac lsirac approved these changes
@nbayati nbayati Awaiting requested review from nbayati
@lqiu96 lqiu96 Awaiting requested review from lqiu96
+1 more reviewer
@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@vverman @lqiu96 @lsirac @nbayati