Skip to content

Commit b4e5199

Browse files
vvermanvverman
committed
Added tests for ExternalAccountCredentials trust boundary. Added comments regarding a separate mock for trust boundary.
1 parent 283d8b5 commit b4e5199

16 files changed

+345
-407
lines changed

‎oauth2_http/java/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentials.java‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -225,7 +225,7 @@ public AccessToken refreshAccessToken() throws IOException {
225225
.setTokenValue(accessToken)
226226
.build();
227227

228-
refreshTrustBoundaries(newAccessToken);
228+
refreshTrustBoundary(newAccessToken, transportFactory);
229229
return newAccessToken;
230230
}
231231

@@ -240,11 +240,6 @@ public String getTrustBoundaryUrl() throws IOException {
240240
return String.format(WORKFORCE_POOL_URL_FORMAT, poolId);
241241
}
242242

243-
@Override
244-
public HttpTransportFactory getTransportFactory() {
245-
return transportFactory;
246-
}
247-
248243
@Nullable
249244
public String getAudience() {
250245
return audience;

‎oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -543,7 +543,7 @@ protected AccessToken exchangeExternalCredentialForAccessToken(
543543
if (this.impersonatedCredentials != null) {
544544
AccessToken accessToken = this.impersonatedCredentials.refreshAccessToken();
545545
// After the impersonated credential refreshes, its trust boundary is
546-
// also refreshed. We need to get the refreshed trust boundary.
546+
// also refreshed. That is the trust boundary we will use.
547547
setTrustBoundary(this.impersonatedCredentials.getTrustBoundary());
548548
return accessToken;
549549
}
@@ -575,7 +575,7 @@ protected AccessToken exchangeExternalCredentialForAccessToken(
575575

576576
StsTokenExchangeResponse response = requestHandler.build().exchangeToken();
577577
AccessToken accessToken = response.getAccessToken();
578-
refreshTrustBoundaries(accessToken);
578+
refreshTrustBoundary(accessToken, transportFactory);
579579
return accessToken;
580580
}
581581

@@ -656,11 +656,6 @@ public String getTrustBoundaryUrl() throws IOException {
656656
}
657657
}
658658

659-
@Override
660-
public HttpTransportFactory getTransportFactory() {
661-
return transportFactory;
662-
}
663-
664659
@Nullable
665660
public String getClientId() {
666661
return clientId;

‎oauth2_http/java/com/google/auth/oauth2/TrustBoundary.java‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -184,9 +184,7 @@ static TrustBoundary refresh(
184184

185185
// Add the cached trust boundary header, if available.
186186
if (cachedTrustBoundary != null) {
187-
String headerValue =
188-
cachedTrustBoundary.isNoOp() ? "" : cachedTrustBoundary.getEncodedLocations();
189-
request.getHeaders().set(TRUST_BOUNDARY_KEY, headerValue);
187+
request.getHeaders().set(TRUST_BOUNDARY_KEY, cachedTrustBoundary.getEncodedLocations());
190188
}
191189

192190
// Add retry logic

‎oauth2_http/javatests/com/google/auth/TestUtils.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@
4242
import com.google.api.client.json.gson.GsonFactory;
4343
import com.google.auth.http.AuthHttpConstants;
4444
import com.google.common.base.Splitter;
45+
import com.google.common.collect.ImmutableList;
4546
import com.google.common.collect.Lists;
4647
import java.io.ByteArrayInputStream;
4748
import java.io.IOException;
@@ -64,6 +65,9 @@ public class TestUtils {
6465
URI.create("https://auth.cloud.google/authorize");
6566
public static final URI WORKFORCE_IDENTITY_FEDERATION_TOKEN_SERVER_URI =
6667
URI.create("https://sts.googleapis.com/v1/oauthtoken");
68+
public static final String TRUST_BOUNDARY_ENCODED_LOCATION = "0x800000";
69+
public static final List<String> TRUST_BOUNDARY_LOCATIONS =
70+
ImmutableList.of("us-central1", "us-central2");
6771

6872
private static final JsonFactory JSON_FACTORY = GsonFactory.getDefaultInstance();
6973

‎oauth2_http/javatests/com/google/auth/oauth2/AwsCredentialsTest.java‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -40,11 +40,8 @@
4040
import static org.junit.Assert.fail;
4141

4242
import com.google.api.client.json.GenericJson;
43-
import com.google.api.client.json.Json;
4443
import com.google.api.client.json.JsonParser;
45-
import com.google.api.client.testing.http.MockHttpTransport;
4644
import com.google.api.client.testing.http.MockLowLevelHttpRequest;
47-
import com.google.api.client.testing.http.MockLowLevelHttpResponse;
4845
import com.google.api.client.util.Clock;
4946
import com.google.auth.TestUtils;
5047
import com.google.auth.oauth2.ExternalAccountCredentialsTest.MockExternalAccountCredentialsTransportFactory;
@@ -1403,8 +1400,8 @@ public AwsSecurityCredentials getCredentials(ExternalAccountSupplierContext cont
14031400
}
14041401
}
14051402

1406-
@Test
1407-
public void testRefresh_trustBoundarySuccess() throws IOException {
1403+
@Test
1404+
public void testRefresh_trustBoundarySuccess() throws IOException {
14081405
TestEnvironmentProvider environmentProvider = new TestEnvironmentProvider();
14091406
TrustBoundary.setEnvironmentProviderForTest(environmentProvider);
14101407
environmentProvider.setEnv("GOOGLE_AUTH_TRUST_BOUNDARY_ENABLE_EXPERIMENT", "1");

‎oauth2_http/javatests/com/google/auth/oauth2/ComputeEngineCredentialsTest.java‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333

3434
import static com.google.auth.oauth2.ComputeEngineCredentials.METADATA_RESPONSE_EMPTY_CONTENT_ERROR_MESSAGE;
3535
import static com.google.auth.oauth2.ImpersonatedCredentialsTest.SA_CLIENT_EMAIL;
36+
import static com.google.auth.oauth2.TrustBoundary.TRUST_BOUNDARY_KEY;
3637
import static org.junit.Assert.assertArrayEquals;
3738
import static org.junit.Assert.assertEquals;
3839
import static org.junit.Assert.assertFalse;
@@ -1159,15 +1160,17 @@ public void refresh_trustBoundarySuccess() throws IOException {
11591160
String defaultAccountEmail = "[email protected]";
11601161
MockMetadataServerTransportFactory transportFactory = new MockMetadataServerTransportFactory();
11611162
TrustBoundary trustBoundary =
1162-
new TrustBoundary("0x80000", Collections.singletonList("us-central1"));
1163+
new TrustBoundary(
1164+
TestUtils.TRUST_BOUNDARY_ENCODED_LOCATION, TestUtils.TRUST_BOUNDARY_LOCATIONS);
11631165
transportFactory.transport.setTrustBoundary(trustBoundary);
11641166
transportFactory.transport.setServiceAccountEmail(defaultAccountEmail);
11651167

11661168
ComputeEngineCredentials credentials =
11671169
ComputeEngineCredentials.newBuilder().setHttpTransportFactory(transportFactory).build();
11681170

11691171
Map<String, List<String>> headers = credentials.getRequestMetadata();
1170-
assertEquals(headers.get("x-allowed-locations"), Arrays.asList("0x80000"));
1172+
assertEquals(
1173+
headers.get(TRUST_BOUNDARY_KEY), Arrays.asList(TestUtils.TRUST_BOUNDARY_ENCODED_LOCATION));
11711174
}
11721175

11731176
@Test

‎oauth2_http/javatests/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentialsTest.java‎

Lines changed: 15 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -36,10 +36,7 @@
3636

3737
import com.google.api.client.http.HttpTransport;
3838
import com.google.api.client.json.GenericJson;
39-
import com.google.api.client.json.Json;
40-
import com.google.api.client.testing.http.MockHttpTransport;
4139
import com.google.api.client.testing.http.MockLowLevelHttpRequest;
42-
import com.google.api.client.testing.http.MockLowLevelHttpResponse;
4340
import com.google.api.client.util.Clock;
4441
import com.google.auth.TestUtils;
4542
import com.google.auth.http.AuthHttpConstants;
@@ -1244,26 +1241,27 @@ public void testRefresh_trustBoundarySuccess() throws IOException {
12441241

12451242
@Test
12461243
public void testRefresh_trustBoundaryFails_incorrectAudience() throws IOException {
1247-
TestEnvironmentProvider environmentProvider = new TestEnvironmentProvider();
1248-
TrustBoundary.setEnvironmentProviderForTest(environmentProvider);
1249-
environmentProvider.setEnv("GOOGLE_AUTH_TRUST_BOUNDARY_ENABLE_EXPERIMENT", "1");
1250-
1251-
ExternalAccountAuthorizedUserCredentials credentials =
1252-
ExternalAccountAuthorizedUserCredentials.newBuilder()
1253-
.setHttpTransportFactory(transportFactory)
1254-
.setAudience("audience")
1255-
.setClientId(CLIENT_ID)
1256-
.setClientSecret(CLIENT_SECRET)
1257-
.setRefreshToken(REFRESH_TOKEN)
1258-
.setTokenUrl(TOKEN_URL)
1259-
.build();
1244+
TestEnvironmentProvider environmentProvider = new TestEnvironmentProvider();
1245+
TrustBoundary.setEnvironmentProviderForTest(environmentProvider);
1246+
environmentProvider.setEnv("GOOGLE_AUTH_TRUST_BOUNDARY_ENABLE_EXPERIMENT", "1");
1247+
1248+
ExternalAccountAuthorizedUserCredentials credentials =
1249+
ExternalAccountAuthorizedUserCredentials.newBuilder()
1250+
.setHttpTransportFactory(transportFactory)
1251+
.setAudience("audience")
1252+
.setClientId(CLIENT_ID)
1253+
.setClientSecret(CLIENT_SECRET)
1254+
.setRefreshToken(REFRESH_TOKEN)
1255+
.setTokenUrl(TOKEN_URL)
1256+
.build();
12601257

12611258
try {
12621259
credentials.refresh();
12631260
fail("Expected IOException to be thrown.");
12641261
} catch (IOException e) {
12651262
assertEquals(
1266-
"Failed to refresh trust boundary and no cached value is available.", e.getMessage());
1263+
"The provided audience is not in the correct format for a workforce pool.",
1264+
e.getMessage());
12671265
}
12681266
}
12691267

0 commit comments

Comments
 (0)