-
Notifications
You must be signed in to change notification settings - Fork 236
feat: Return X509 certificate chain as the subject token. #1746
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
The CertificateIdentityPoolSubjectTokenSupplier's subjectToken function now returns the full X.509 certificate chain, including the leaf certificate and any provided trust chain certificates, as a JSON array of base64-encoded strings. This chain is used as the subject token for mTLS authentication.
oauth2_http/java/com/google/auth/oauth2/CertificateIdentityPoolSubjectTokenSupplier.java
Outdated
Show resolved
Hide resolved
oauth2_http/java/com/google/auth/oauth2/CertificateIdentityPoolSubjectTokenSupplier.java
Outdated
Show resolved
Hide resolved
oauth2_http/java/com/google/auth/oauth2/CertificateIdentityPoolSubjectTokenSupplier.java
Outdated
Show resolved
Hide resolved
oauth2_http/java/com/google/auth/oauth2/CertificateIdentityPoolSubjectTokenSupplier.java
Show resolved
Hide resolved
…certificate to the private helper method.
oauth2_http/java/com/google/auth/oauth2/CertificateIdentityPoolSubjectTokenSupplier.java
Outdated
Show resolved
Hide resolved
oauth2_http/java/com/google/auth/oauth2/CertificateIdentityPoolSubjectTokenSupplier.java
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM with some minor comments.
oauth2_http/java/com/google/auth/oauth2/CertificateIdentityPoolSubjectTokenSupplier.java
Outdated
Show resolved
Hide resolved
oauth2_http/java/com/google/auth/oauth2/CertificateIdentityPoolSubjectTokenSupplier.java
Show resolved
Hide resolved
oauth2_http/java/com/google/auth/oauth2/CertificateIdentityPoolSubjectTokenSupplier.java
Outdated
Show resolved
Hide resolved
oauth2_http/java/com/google/auth/oauth2/CertificateIdentityPoolSubjectTokenSupplier.java
Outdated
Show resolved
Hide resolved
oauth2_http/java/com/google/auth/oauth2/CertificateIdentityPoolSubjectTokenSupplier.java
Outdated
Show resolved
Hide resolved
oauth2_http/java/com/google/auth/oauth2/CertificateIdentityPoolSubjectTokenSupplier.java
Outdated
Show resolved
Hide resolved
oauth2_http/java/com/google/auth/oauth2/CertificateIdentityPoolSubjectTokenSupplier.java
Outdated
Show resolved
Hide resolved
...2_http/javatests/com/google/auth/oauth2/CertificateIdentityPoolSubjectTokenSupplierTest.java
Outdated
Show resolved
Hide resolved
...2_http/javatests/com/google/auth/oauth2/CertificateIdentityPoolSubjectTokenSupplierTest.java
Outdated
Show resolved
Hide resolved
...2_http/javatests/com/google/auth/oauth2/CertificateIdentityPoolSubjectTokenSupplierTest.java
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Changes LGTM. Added a few clarifying nits in the tests, but everything else is fine.
Leaving this up to @zhumin8 for final approval. She can help coordinate if this going into the next release cycle or the one after it.
...2_http/javatests/com/google/auth/oauth2/CertificateIdentityPoolSubjectTokenSupplierTest.java
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
| Package | Type | Package file | Manager | Update | Change | |---|---|---|---|---|---| | [com.google.auth:google-auth-library-oauth2-http](https://github.com/googleapis/google-auth-library-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `1.34.0` -> `1.35.0` | | [com.google.auth:google-auth-library-credentials](https://github.com/googleapis/google-auth-library-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `1.34.0` -> `1.35.0` | | [software.amazon.awssdk:sdk-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.40` -> `2.31.41` | | [software.amazon.awssdk:sqs](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.40` -> `2.31.41` | | [software.amazon.awssdk:dynamodb-enhanced](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.40` -> `2.31.41` | | [software.amazon.awssdk:dynamodb](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.40` -> `2.31.41` | --- ### Release Notes <details> <summary>googleapis/google-auth-library-java (com.google.auth:google-auth-library-oauth2-http)</summary> ### [`v1.35.0`](https://github.com/googleapis/google-auth-library-java/blob/HEAD/CHANGELOG.md#1350-2025-05-12) ##### Features - Add support for mTLS authentication via X.509 certificates ([#​1736](googleapis/google-auth-library-java#1736)) ([b347603](googleapis/google-auth-library-java@b347603)) - Return X509 certificate chain as the subject token. ([#​1746](googleapis/google-auth-library-java#1746)) ([6d05be8](googleapis/google-auth-library-java@6d05be8)) ##### Bug Fixes - Handle optional fields in ExternalAccountCredentials with null JSON value gracefully ([#​1706](googleapis/google-auth-library-java#1706)) ([f1f306d](googleapis/google-auth-library-java@f1f306d)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "after 6pm every weekday,before 2am every weekday" in timezone Australia/Melbourne, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Never, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). GitOrigin-RevId: abc60fba8102e94da5ecb2e7537ccaf5d3d8628f
design: go/x509-auth-lib-redesign
The CertificateIdentityPoolSubjectTokenSupplier's subjectToken function now returns the full X509 certificate chain, including the leaf certificate and any provided trust chain certificates, as a JSON array of base64-encoded strings. This chain is used as the subject token for mTLS authentication.
Similar work was done in the python and Go libraries.