Skip to content

Commit 2df2dbf

Browse files
lsiraclsirac
authored
test: adds integration tests for workload identity federation (googleapis#581)
A setup script workloadidentityfederation-setup.sh is added to make the workload identity pool configuration changes on the current project, if needed. The setup script only needs to be run once on a project (already ran).
1 parent cce5415 commit 2df2dbf

14 files changed

Lines changed: 663 additions & 102 deletions

‎google-auth-library-java/.kokoro/nightly/integration.cfg‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,3 +35,8 @@ env_vars: {
3535
key: "SECRET_MANAGER_KEYS"
3636
value: "java-it-service-account"
3737
}
38+
39+
env_vars: {
40+
key: "GCS_BUCKET"
41+
value: "byoid-it-bucket"
42+
}

‎google-auth-library-java/.kokoro/presubmit/integration.cfg‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,3 +31,8 @@ env_vars: {
3131
key: "SECRET_MANAGER_KEYS"
3232
value: "java-it-service-account"
3333
}
34+
35+
env_vars: {
36+
key: "GCS_BUCKET"
37+
value: "byoid-it-bucket"
38+
}

‎google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsCredentials.java‎

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,8 @@ static class AwsCredentialSource extends CredentialSource {
117117
/**
118118
* Internal constructor. See {@link
119119
* ExternalAccountCredentials#ExternalAccountCredentials(HttpTransportFactory, String, String,
120-
* String, CredentialSource, String, String, String, String, String, Collection)}
120+
* String, CredentialSource, String, String, String, String, String, Collection,
121+
* EnvironmentProvider)}
121122
*/
122123
AwsCredentials(
123124
HttpTransportFactory transportFactory,
@@ -130,7 +131,8 @@ static class AwsCredentialSource extends CredentialSource {
130131
@Nullable String quotaProjectId,
131132
@Nullable String clientId,
132133
@Nullable String clientSecret,
133-
@Nullable Collection<String> scopes) {
134+
@Nullable Collection<String> scopes,
135+
@Nullable EnvironmentProvider environmentProvider) {
134136
super(
135137
transportFactory,
136138
audience,
@@ -142,7 +144,8 @@ static class AwsCredentialSource extends CredentialSource {
142144
quotaProjectId,
143145
clientId,
144146
clientSecret,
145-
scopes);
147+
scopes,
148+
environmentProvider);
146149
this.awsCredentialSource = credentialSource;
147150
}
148151

@@ -200,7 +203,8 @@ public GoogleCredentials createScoped(Collection<String> newScopes) {
200203
getQuotaProjectId(),
201204
getClientId(),
202205
getClientSecret(),
203-
newScopes);
206+
newScopes,
207+
getEnvironmentProvider());
204208
}
205209

206210
private String retrieveResource(String url, String resourceName) throws IOException {
@@ -241,7 +245,7 @@ private String buildSubjectToken(AwsRequestSignature signature)
241245

242246
private String getAwsRegion() throws IOException {
243247
// For AWS Lambda, the region is retrieved through the AWS_REGION environment variable.
244-
String region = getEnv("AWS_REGION");
248+
String region = getEnvironmentProvider().getEnv("AWS_REGION");
245249
if (region != null) {
246250
return region;
247251
}
@@ -261,9 +265,9 @@ private String getAwsRegion() throws IOException {
261265
@VisibleForTesting
262266
AwsSecurityCredentials getAwsSecurityCredentials() throws IOException {
263267
// Check environment variables for credentials first.
264-
String accessKeyId = getEnv("AWS_ACCESS_KEY_ID");
265-
String secretAccessKey = getEnv("AWS_SECRET_ACCESS_KEY");
266-
String token = getEnv("Token");
268+
String accessKeyId = getEnvironmentProvider().getEnv("AWS_ACCESS_KEY_ID");
269+
String secretAccessKey = getEnvironmentProvider().getEnv("AWS_SECRET_ACCESS_KEY");
270+
String token = getEnvironmentProvider().getEnv("Token");
267271
if (accessKeyId != null && secretAccessKey != null) {
268272
return new AwsSecurityCredentials(accessKeyId, secretAccessKey, token);
269273
}
@@ -343,7 +347,8 @@ public AwsCredentials build() {
343347
quotaProjectId,
344348
clientId,
345349
clientSecret,
346-
scopes);
350+
scopes,
351+
environmentProvider);
347352
}
348353
}
349354
}

‎google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/EnvironmentProvider.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
package com.google.auth.oauth2;
2+
3+
/** Interface for an environment provider. */
4+
interface EnvironmentProvider {
5+
String getEnv(String name);
6+
}

‎google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java‎

Lines changed: 56 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,8 @@ abstract static class CredentialSource {
8888

8989
@Nullable protected final ImpersonatedCredentials impersonatedCredentials;
9090

91+
private EnvironmentProvider environmentProvider;
92+
9193
/**
9294
* Constructor with minimum identifying information and custom HTTP transport.
9395
*
@@ -121,6 +123,41 @@ protected ExternalAccountCredentials(
121123
@Nullable String clientId,
122124
@Nullable String clientSecret,
123125
@Nullable Collection<String> scopes) {
126+
this(
127+
transportFactory,
128+
audience,
129+
subjectTokenType,
130+
tokenUrl,
131+
credentialSource,
132+
tokenInfoUrl,
133+
serviceAccountImpersonationUrl,
134+
quotaProjectId,
135+
clientId,
136+
clientSecret,
137+
scopes,
138+
/* environmentProvider= */ null);
139+
}
140+
141+
/**
142+
* See {@link ExternalAccountCredentials#ExternalAccountCredentials(HttpTransportFactory, String,
143+
* String, String, CredentialSource, String, String, String, String, String, Collection)}
144+
*
145+
* @param environmentProvider the environment provider. May be null. Defaults to {@link
146+
* SystemEnvironmentProvider}.
147+
*/
148+
protected ExternalAccountCredentials(
149+
HttpTransportFactory transportFactory,
150+
String audience,
151+
String subjectTokenType,
152+
String tokenUrl,
153+
CredentialSource credentialSource,
154+
@Nullable String tokenInfoUrl,
155+
@Nullable String serviceAccountImpersonationUrl,
156+
@Nullable String quotaProjectId,
157+
@Nullable String clientId,
158+
@Nullable String clientSecret,
159+
@Nullable Collection<String> scopes,
160+
@Nullable EnvironmentProvider environmentProvider) {
124161
this.transportFactory =
125162
MoreObjects.firstNonNull(
126163
transportFactory,
@@ -137,6 +174,9 @@ protected ExternalAccountCredentials(
137174
this.clientSecret = clientSecret;
138175
this.scopes =
139176
(scopes == null || scopes.isEmpty()) ? Arrays.asList(CLOUD_PLATFORM_SCOPE) : scopes;
177+
this.environmentProvider =
178+
environmentProvider == null ? SystemEnvironmentProvider.getInstance() : environmentProvider;
179+
140180
this.impersonatedCredentials = initializeImpersonatedCredentials();
141181
}
142182

@@ -251,7 +291,8 @@ static ExternalAccountCredentials fromJson(
251291
quotaProjectId,
252292
clientId,
253293
clientSecret,
254-
/* scopes= */ null);
294+
/* scopes= */ null,
295+
/* environmentProvider= */ null);
255296
}
256297
return new IdentityPoolCredentials(
257298
transportFactory,
@@ -264,7 +305,8 @@ static ExternalAccountCredentials fromJson(
264305
quotaProjectId,
265306
clientId,
266307
clientSecret,
267-
/* scopes= */ null);
308+
/* scopes= */ null,
309+
/* environmentProvider= */ null);
268310
}
269311

270312
private static boolean isAwsCredential(Map<String, Object> credentialSource) {
@@ -296,7 +338,7 @@ protected AccessToken exchangeExternalCredentialForAccessToken(
296338
}
297339

298340
private static String extractTargetPrincipal(String serviceAccountImpersonationUrl) {
299-
// Extract the target principal
341+
// Extract the target principal.
300342
int startIndex = serviceAccountImpersonationUrl.lastIndexOf('/');
301343
int endIndex = serviceAccountImpersonationUrl.indexOf(":generateAccessToken");
302344

@@ -364,6 +406,10 @@ public Collection<String> getScopes() {
364406
return scopes;
365407
}
366408

409+
EnvironmentProvider getEnvironmentProvider() {
410+
return environmentProvider;
411+
}
412+
367413
/** Base builder for external account credentials. */
368414
public abstract static class Builder extends GoogleCredentials.Builder {
369415

@@ -372,6 +418,7 @@ public abstract static class Builder extends GoogleCredentials.Builder {
372418
protected String tokenUrl;
373419
protected String tokenInfoUrl;
374420
protected CredentialSource credentialSource;
421+
protected EnvironmentProvider environmentProvider;
375422
protected HttpTransportFactory transportFactory;
376423

377424
@Nullable protected String serviceAccountImpersonationUrl;
@@ -394,6 +441,7 @@ protected Builder(ExternalAccountCredentials credentials) {
394441
this.clientId = credentials.clientId;
395442
this.clientSecret = credentials.clientSecret;
396443
this.scopes = credentials.scopes;
444+
this.environmentProvider = credentials.environmentProvider;
397445
}
398446

399447
public Builder setAudience(String audience) {
@@ -451,6 +499,11 @@ public Builder setHttpTransportFactory(HttpTransportFactory transportFactory) {
451499
return this;
452500
}
453501

502+
Builder setEnvironmentProvider(EnvironmentProvider environmentProvider) {
503+
this.environmentProvider = environmentProvider;
504+
return this;
505+
}
506+
454507
public abstract ExternalAccountCredentials build();
455508
}
456509
}

‎google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/IdentityPoolCredentials.java‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -158,7 +158,8 @@ private boolean hasHeaders() {
158158
/**
159159
* Internal constructor. See {@link
160160
* ExternalAccountCredentials#ExternalAccountCredentials(HttpTransportFactory, String, String,
161-
* String, CredentialSource, String, String, String, String, String, Collection)}
161+
* String, CredentialSource, String, String, String, String, String, Collection,
162+
* EnvironmentProvider)}
162163
*/
163164
IdentityPoolCredentials(
164165
HttpTransportFactory transportFactory,
@@ -171,7 +172,8 @@ private boolean hasHeaders() {
171172
@Nullable String quotaProjectId,
172173
@Nullable String clientId,
173174
@Nullable String clientSecret,
174-
@Nullable Collection<String> scopes) {
175+
@Nullable Collection<String> scopes,
176+
@Nullable EnvironmentProvider environmentProvider) {
175177
super(
176178
transportFactory,
177179
audience,
@@ -183,7 +185,8 @@ private boolean hasHeaders() {
183185
quotaProjectId,
184186
clientId,
185187
clientSecret,
186-
scopes);
188+
scopes,
189+
environmentProvider);
187190
this.identityPoolCredentialSource = credentialSource;
188191
}
189192

@@ -280,7 +283,8 @@ public IdentityPoolCredentials createScoped(Collection<String> newScopes) {
280283
getQuotaProjectId(),
281284
getClientId(),
282285
getClientSecret(),
283-
newScopes);
286+
newScopes,
287+
getEnvironmentProvider());
284288
}
285289

286290
public static Builder newBuilder() {
@@ -312,7 +316,8 @@ public IdentityPoolCredentials build() {
312316
quotaProjectId,
313317
clientId,
314318
clientSecret,
315-
scopes);
319+
scopes,
320+
environmentProvider);
316321
}
317322
}
318323
}

‎google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/SystemEnvironmentProvider.java‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
package com.google.auth.oauth2;
2+
3+
/** Represents the default system environment provider. */
4+
class SystemEnvironmentProvider implements EnvironmentProvider {
5+
static final SystemEnvironmentProvider INSTANCE = new SystemEnvironmentProvider();
6+
7+
private SystemEnvironmentProvider() {}
8+
9+
@Override
10+
public String getEnv(String name) {
11+
return System.getenv(name);
12+
}
13+
14+
public static SystemEnvironmentProvider getInstance() {
15+
return INSTANCE;
16+
}
17+
}

0 commit comments

Comments
 (0)