Merge branch 'main' into main

andyrzhao · web-flow · commit da7cb32fb855 · 2025-05-30T11:16:42.000-07:00
diff --git a/.kokoro/presubmit/graalvm-native-a.cfg b/.kokoro/presubmit/graalvm-native-a.cfg
@@ -44,6 +44,6 @@ env_vars: {
 }
 
 container_properties {
-  docker_image: "us-docker.pkg.dev/java-graalvm-ci-prod/graalvm-integration-testing/graalvm_a:1.15.4"
+  docker_image: "us-docker.pkg.dev/java-graalvm-ci-prod/graalvm-integration-testing/graalvm_a:1.16.0"
 }
 
diff --git a/.kokoro/presubmit/graalvm-native-b.cfg b/.kokoro/presubmit/graalvm-native-b.cfg
@@ -44,5 +44,5 @@ env_vars: {
 }
 
 container_properties {
-  docker_image: "us-docker.pkg.dev/java-graalvm-ci-prod/graalvm-integration-testing/graalvm_b:1.15.4"
+  docker_image: "us-docker.pkg.dev/java-graalvm-ci-prod/graalvm-integration-testing/graalvm_b:1.16.0"
 }
diff --git a/.kokoro/presubmit/graalvm-native-c.cfg b/.kokoro/presubmit/graalvm-native-c.cfg
@@ -44,6 +44,6 @@ env_vars: {
 }
 
 container_properties {
-  docker_image: "us-docker.pkg.dev/java-graalvm-ci-prod/graalvm-integration-testing/graalvm_c:1.15.4"
+  docker_image: "us-docker.pkg.dev/java-graalvm-ci-prod/graalvm-integration-testing/graalvm_c:1.16.0"
 }
 
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "1.35.0"
+  ".": "1.36.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,18 @@
 # Changelog
 
+## [1.36.0](https://github.com/googleapis/google-auth-library-java/compare/v1.35.0...v1.36.0) (2025-05-28)
+
+
+### Features
+
+* Support ability to set universe domain in ServiceAccountJwtAccessCredentials ([#1754](https://github.com/googleapis/google-auth-library-java/issues/1754)) ([919ae32](https://github.com/googleapis/google-auth-library-java/commit/919ae320bf5a4f06fd39871bf055b8487ed55d71))
+
+
+### Bug Fixes
+
+* IdTokenCredentials should fetch license id claim when requested ([#1450](https://github.com/googleapis/google-auth-library-java/issues/1450)) ([c5648a5](https://github.com/googleapis/google-auth-library-java/commit/c5648a55f15a75b1d616fbdc37cd331811e66f3a))
+* Update approval_prompt=force to prompt=consent ([#1752](https://github.com/googleapis/google-auth-library-java/issues/1752)) ([4543d04](https://github.com/googleapis/google-auth-library-java/commit/4543d0423775f1e568249eb782b88dc0e6d64a59))
+
 ## [1.35.0](https://github.com/googleapis/google-auth-library-java/compare/v1.34.0...v1.35.0) (2025-05-12)
 
 
diff --git a/appengine/pom.xml b/appengine/pom.xml
@@ -5,7 +5,7 @@
   <parent>
     <groupId>com.google.auth</groupId>
     <artifactId>google-auth-library-parent</artifactId>
-    <version>1.35.1-SNAPSHOT</version><!-- {x-version-update:google-auth-library-parent:current} -->
+    <version>1.36.0</version><!-- {x-version-update:google-auth-library-parent:current} -->
     <relativePath>../pom.xml</relativePath>
   </parent>
 
diff --git a/bom/pom.xml b/bom/pom.xml
@@ -3,7 +3,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.google.auth</groupId>
   <artifactId>google-auth-library-bom</artifactId>
-  <version>1.35.1-SNAPSHOT</version><!-- {x-version-update:google-auth-library-bom:current} -->
+  <version>1.36.0</version><!-- {x-version-update:google-auth-library-bom:current} -->
   <packaging>pom</packaging>
   <name>Google Auth Library for Java BOM</name>
   <description>
diff --git a/cab-token-generator/pom.xml b/cab-token-generator/pom.xml
@@ -6,7 +6,7 @@
   <parent>
     <groupId>com.google.auth</groupId>
     <artifactId>google-auth-library-parent</artifactId>
-    <version>1.35.1-SNAPSHOT</version><!-- {x-version-update:google-auth-library-parent:current} -->
+    <version>1.36.0</version><!-- {x-version-update:google-auth-library-parent:current} -->
   </parent>
 
   <artifactId>google-auth-library-cab-token-generator</artifactId>
diff --git a/credentials/pom.xml b/credentials/pom.xml
@@ -4,7 +4,7 @@
   <parent>
     <groupId>com.google.auth</groupId>
     <artifactId>google-auth-library-parent</artifactId>
-    <version>1.35.1-SNAPSHOT</version><!-- {x-version-update:google-auth-library-parent:current} -->
+    <version>1.36.0</version><!-- {x-version-update:google-auth-library-parent:current} -->
     <relativePath>../pom.xml</relativePath>
   </parent>
 
diff --git a/oauth2_http/java/com/google/auth/oauth2/ComputeEngineCredentials.java b/oauth2_http/java/com/google/auth/oauth2/ComputeEngineCredentials.java
@@ -407,9 +407,9 @@ public IdToken idTokenWithAudience(String targetAudience, List<IdTokenProvider.O
         documentUrl.set("format", "full");
       }
       if (options.contains(IdTokenProvider.Option.LICENSES_TRUE)) {
-        // license will only get returned if format is also full
+        // licenses will only get returned if format is also full
         documentUrl.set("format", "full");
-        documentUrl.set("license", "TRUE");
+        documentUrl.set("licenses", "TRUE");
       }
     }
     documentUrl.set("audience", targetAudience);
diff --git a/oauth2_http/java/com/google/auth/oauth2/ServiceAccountJwtAccessCredentials.java b/oauth2_http/java/com/google/auth/oauth2/ServiceAccountJwtAccessCredentials.java
@@ -88,6 +88,7 @@ public class ServiceAccountJwtAccessCredentials extends Credentials
   private final String privateKeyId;
   private final URI defaultAudience;
   private final String quotaProjectId;
+  private final String universeDomain;
 
   private transient LoadingCache<JwtClaims, JwtCredentials> credentialsCache;
 
@@ -104,7 +105,14 @@ public class ServiceAccountJwtAccessCredentials extends Credentials
    */
   private ServiceAccountJwtAccessCredentials(
       String clientId, String clientEmail, PrivateKey privateKey, String privateKeyId) {
-    this(clientId, clientEmail, privateKey, privateKeyId, null, null);
+    this(
+        clientId,
+        clientEmail,
+        privateKey,
+        privateKeyId,
+        null,
+        null,
+        Credentials.GOOGLE_DEFAULT_UNIVERSE);
   }
 
   /**
@@ -115,21 +123,29 @@ private ServiceAccountJwtAccessCredentials(
    * @param privateKey RSA private key object for the service account.
    * @param privateKeyId Private key identifier for the service account. May be null.
    * @param defaultAudience Audience to use if not provided by transport. May be null.
+   * @param universeDomain universe domain in the format some-domain.xyz. By default, sets it to
+   *     googleapis.com
    */
   private ServiceAccountJwtAccessCredentials(
       String clientId,
       String clientEmail,
       PrivateKey privateKey,
       String privateKeyId,
       URI defaultAudience,
-      String quotaProjectId) {
+      String quotaProjectId,
+      String universeDomain) {
     this.clientId = clientId;
     this.clientEmail = Preconditions.checkNotNull(clientEmail);
     this.privateKey = Preconditions.checkNotNull(privateKey);
     this.privateKeyId = privateKeyId;
     this.defaultAudience = defaultAudience;
     this.credentialsCache = createCache();
     this.quotaProjectId = quotaProjectId;
+    if (universeDomain == null || universeDomain.trim().isEmpty()) {
+      this.universeDomain = Credentials.GOOGLE_DEFAULT_UNIVERSE;
+    } else {
+      this.universeDomain = universeDomain;
+    }
   }
 
   /**
@@ -160,6 +176,10 @@ static ServiceAccountJwtAccessCredentials fromJson(Map<String, Object> json, URI
     String privateKeyPkcs8 = (String) json.get("private_key");
     String privateKeyId = (String) json.get("private_key_id");
     String quoataProjectId = (String) json.get("quota_project_id");
+    String rawUniverseDomain = (String) json.get("universe_domain");
+    String resolvedUniverseDomain =
+        (rawUniverseDomain == null) ? Credentials.GOOGLE_DEFAULT_UNIVERSE : rawUniverseDomain;
+
     if (clientId == null
         || clientEmail == null
         || privateKeyPkcs8 == null
@@ -169,7 +189,13 @@ static ServiceAccountJwtAccessCredentials fromJson(Map<String, Object> json, URI
               + "expecting  'client_id', 'client_email', 'private_key' and 'private_key_id'.");
     }
     return ServiceAccountJwtAccessCredentials.fromPkcs8(
-        clientId, clientEmail, privateKeyPkcs8, privateKeyId, defaultAudience, quoataProjectId);
+        clientId,
+        clientEmail,
+        privateKeyPkcs8,
+        privateKeyId,
+        defaultAudience,
+        quoataProjectId,
+        resolvedUniverseDomain);
   }
 
   /**
@@ -207,7 +233,13 @@ public static ServiceAccountJwtAccessCredentials fromPkcs8(
       URI defaultAudience)
       throws IOException {
     return ServiceAccountJwtAccessCredentials.fromPkcs8(
-        clientId, clientEmail, privateKeyPkcs8, privateKeyId, defaultAudience, null);
+        clientId,
+        clientEmail,
+        privateKeyPkcs8,
+        privateKeyId,
+        defaultAudience,
+        null,
+        Credentials.GOOGLE_DEFAULT_UNIVERSE);
   }
 
   static ServiceAccountJwtAccessCredentials fromPkcs8(
@@ -216,11 +248,18 @@ static ServiceAccountJwtAccessCredentials fromPkcs8(
       String privateKeyPkcs8,
       String privateKeyId,
       URI defaultAudience,
-      String quotaProjectId)
+      String quotaProjectId,
+      String universeDomain)
       throws IOException {
     PrivateKey privateKey = OAuth2Utils.privateKeyFromPkcs8(privateKeyPkcs8);
     return new ServiceAccountJwtAccessCredentials(
-        clientId, clientEmail, privateKey, privateKeyId, defaultAudience, quotaProjectId);
+        clientId,
+        clientEmail,
+        privateKey,
+        privateKeyId,
+        defaultAudience,
+        quotaProjectId,
+        universeDomain);
   }
 
   /**
@@ -352,7 +391,6 @@ public Map<String, List<String>> getRequestMetadata(URI uri) throws IOException
                 + "defaultAudience to be specified");
       }
     }
-
     try {
       JwtClaims defaultClaims =
           JwtClaims.newBuilder()
@@ -399,6 +437,12 @@ public final String getPrivateKeyId() {
     return privateKeyId;
   }
 
+  /** Returns the universe domain (example, googleapis.com) for the credentials instance. */
+  @Override
+  public final String getUniverseDomain() {
+    return universeDomain;
+  }
+
   @Override
   public String getAccount() {
     return getClientEmail();
@@ -474,6 +518,7 @@ public static class Builder {
     private String privateKeyId;
     private URI defaultAudience;
     private String quotaProjectId;
+    private String universeDomain;
 
     protected Builder() {}
 
@@ -484,6 +529,7 @@ protected Builder(ServiceAccountJwtAccessCredentials credentials) {
       this.privateKeyId = credentials.privateKeyId;
       this.defaultAudience = credentials.defaultAudience;
       this.quotaProjectId = credentials.quotaProjectId;
+      this.universeDomain = credentials.universeDomain;
     }
 
     @CanIgnoreReturnValue
@@ -522,6 +568,13 @@ public Builder setQuotaProjectId(String quotaProjectId) {
       return this;
     }
 
+    @CanIgnoreReturnValue
+    /** Sets the universe domain (example, googleapis.com). */
+    public Builder setUniverseDomain(String universeDomain) {
+      this.universeDomain = universeDomain;
+      return this;
+    }
+
     public String getClientId() {
       return clientId;
     }
@@ -546,9 +599,20 @@ public String getQuotaProjectId() {
       return quotaProjectId;
     }
 
+    /** Returns the universe domain (example, googleapis.com) for the credentials instance. */
+    public String getUniverseDomain() {
+      return universeDomain;
+    }
+
     public ServiceAccountJwtAccessCredentials build() {
       return new ServiceAccountJwtAccessCredentials(
-          clientId, clientEmail, privateKey, privateKeyId, defaultAudience, quotaProjectId);
+          clientId,
+          clientEmail,
+          privateKey,
+          privateKeyId,
+          defaultAudience,
+          quotaProjectId,
+          universeDomain);
     }
   }
 }
diff --git a/oauth2_http/java/com/google/auth/oauth2/UserAuthorizer.java b/oauth2_http/java/com/google/auth/oauth2/UserAuthorizer.java
@@ -206,7 +206,7 @@ public URL getAuthorizationUrl(
       url.put("state", state);
     }
     url.put("access_type", "offline");
-    url.put("approval_prompt", "force");
+    url.put("prompt", "consent");
     if (userId != null) {
       url.put("login_hint", userId);
     }
diff --git a/oauth2_http/javatests/com/google/auth/oauth2/ComputeEngineCredentialsTest.java b/oauth2_http/javatests/com/google/auth/oauth2/ComputeEngineCredentialsTest.java
@@ -103,19 +103,19 @@ public class ComputeEngineCredentialsTest extends BaseSerializationTest {
           + "20iLCJzdWIiOiIxMTIxNzkwNjI3MjAzOTEzMDU4ODUifQ.redacted";
 
   // Id Token which includes GCE extended claims and any VM License data (if applicable)
-  public static final String FULL_ID_TOKEN_WITH_LICENSE =
+  public static final String FULL_ID_TOKEN_WITH_LICENSES =
       "eyJhbGciOiJSUzI1NiIsImtpZCI6ImRmMzc1ODkwOG"
           + "I3OTIyOTNhZDk3N2EwYjk5MWQ5OGE3N2Y0ZWVlY2QiLCJ0eXAiOiJKV1QifQ.ew0KICAiYXVkIjogImh0dHBzOi8"
           + "vZm9vLmJhciIsDQogICJhenAiOiAiMTEyMTc5MDYyNzIwMzkxMzA1ODg1IiwNCiAgImVtYWlsIjogIjEyMzQ1Ni1"
           + "jb21wdXRlQGRldmVsb3Blci5nc2VydmljZWFjY291bnQuY29tIiwNCiAgImVtYWlsX3ZlcmlmaWVkIjogdHJ1ZSw"
           + "NCiAgImV4cCI6IDE1NjQ1MTk0OTYsDQogICJnb29nbGUiOiB7DQogICAgImNvbXB1dGVfZW5naW5lIjogew0KICA"
           + "gICAgImluc3RhbmNlX2NyZWF0aW9uX3RpbWVzdGFtcCI6IDE1NjMyMzA5MDcsDQogICAgICAiaW5zdGFuY2VfaWQ"
-          + "iOiAiMzQ5Nzk3NDM5MzQ0MTE3OTI0MyIsDQogICAgICAiaW5zdGFuY2VfbmFtZSI6ICJpYW0iLA0KICAgICAgInB"
-          + "yb2plY3RfaWQiOiAiZm9vLWJhci04MjAiLA0KICAgICAgInByb2plY3RfbnVtYmVyIjogMTA3MTI4NDE4NDQzNiw"
-          + "NCiAgICAgICJ6b25lIjogInVzLWNlbnRyYWwxLWEiDQogICAgfSwNCiAgICAibGljZW5zZSI6IFsNCiAgICAgICA"
-          + "iTElDRU5TRV8xIiwNCiAgICAgICAiTElDRU5TRV8yIg0KICAgIF0NCiAgfSwNCiAgImlhdCI6IDE1NjQ1MTU4OTY"
-          + "sDQogICJpc3MiOiAiaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tIiwNCiAgInN1YiI6ICIxMTIxNzkwNjI3MjA"
-          + "zOTEzMDU4ODUiDQp9.redacted";
+          + "iOiAiMzQ5Nzk3NDM5MzQ0MTE3OTI0MyIsDQogICAgICAiaW5zdGFuY2VfbmFtZSI6ICJpYW0iLA0KICAgICAgImx"
+          + "pY2Vuc2VfaWQiOiBbDQogICAgICAgICIxMDAxMDAwIiwNCiAgICAgICAgIjEwMDEwMDEiLA0KICAgICAgICAiMTA"
+          + "wMTAwOCINCiAgICAgIF0sDQogICAgICAicHJvamVjdF9pZCI6ICJmb28tYmFyLTgyMCIsDQogICAgICAicHJvamV"
+          + "jdF9udW1iZXIiOiAxMDcxMjg0MTg0NDM2LA0KICAgICAgInpvbmUiOiAidXMtY2VudHJhbDEtYSINCiAgICB9DQo"
+          + "gIH0sDQogICJpYXQiOiAxNTY0NTE1ODk2LA0KICAiaXNzIjogImh0dHBzOi8vYWNjb3VudHMuZ29vZ2xlLmNvbSI"
+          + "sDQogICJzdWIiOiAiMTEyMTc5MDYyNzIwMzkxMzA1ODg1Ig0KfQ.redacted";
   private static final String ACCESS_TOKEN = "1/MkSJoj1xsli0AccessToken_NKPY2";
   private static final List<String> SCOPES = Arrays.asList("foo", "bar");
   private static final String ACCESS_TOKEN_WITH_SCOPES = "1/MkSJoj1xsli0AccessTokenScoped_NKPY2";
@@ -1066,7 +1066,8 @@ public void idTokenWithAudience_full() throws IOException {
     tokenCredential.refresh();
     Payload p = tokenCredential.getIdToken().getJsonWebSignature().getPayload();
     assertTrue("Full ID Token format not provided", p.containsKey("google"));
-    ArrayMap<String, ArrayMap> googleClaim = (ArrayMap<String, ArrayMap>) p.get("google");
+    ArrayMap<String, ArrayMap<String, ?>> googleClaim =
+        (ArrayMap<String, ArrayMap<String, ?>>) p.get("google");
     assertTrue(googleClaim.containsKey("compute_engine"));
 
     // verify metrics header
@@ -1076,7 +1077,7 @@ public void idTokenWithAudience_full() throws IOException {
 
   @Test
   @SuppressWarnings("unchecked")
-  public void idTokenWithAudience_license() throws IOException {
+  public void idTokenWithAudience_licenses() throws IOException {
     MockMetadataServerTransportFactory transportFactory = new MockMetadataServerTransportFactory();
     ComputeEngineCredentials credentials =
         ComputeEngineCredentials.newBuilder().setHttpTransportFactory(transportFactory).build();
@@ -1093,8 +1094,12 @@ public void idTokenWithAudience_license() throws IOException {
     tokenCredential.refresh();
     Payload p = tokenCredential.getIdToken().getJsonWebSignature().getPayload();
     assertTrue("Full ID Token format not provided", p.containsKey("google"));
-    ArrayMap<String, ArrayMap> googleClaim = (ArrayMap<String, ArrayMap>) p.get("google");
-    assertTrue(googleClaim.containsKey("license"));
+    ArrayMap<String, ArrayMap<String, ?>> googleClaim =
+        (ArrayMap<String, ArrayMap<String, ?>>) p.get("google");
+    assertTrue(googleClaim.containsKey("compute_engine"));
+    ArrayMap<String, ?> computeEngineClaim =
+        (ArrayMap<String, ?>) googleClaim.get("compute_engine");
+    assertTrue(computeEngineClaim.containsKey("license_id"));
   }
 
   @Test
diff --git a/oauth2_http/javatests/com/google/auth/oauth2/MockMetadataServerTransport.java b/oauth2_http/javatests/com/google/auth/oauth2/MockMetadataServerTransport.java
@@ -50,12 +50,16 @@
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.regex.Pattern;
 
 /** Transport that simulates the GCE metadata server for access tokens. */
 public class MockMetadataServerTransport extends MockHttpTransport {
 
+  private static final Pattern BOOL_PARAMETER_VALUE = Pattern.compile("on|1|(?i)y|yes|true");
+
   // key are scopes as in request url string following "?scopes="
   private Map<String, String> scopesToAccessToken;
+
   private Integer statusCode;
 
   private String serviceAccountEmail;
@@ -271,14 +275,16 @@ public LowLevelHttpResponse execute() {
     if (queryPairs.containsKey("format")) {
       if (((String) queryPairs.get("format")).equals("full")) {
 
-        // return license only if format=full is set
-        if (queryPairs.containsKey("license")) {
-          if (((String) queryPairs.get("license")).equals("TRUE")) {
+        // return licenses only if format=full is set
+        if (queryPairs.containsKey("licenses")) {
+          // The metadata server defaults to false and matches "on", "off" and ::absl::SimpleAtob.
+          // See https://abseil.io/docs/cpp/guides/strings#numericConversion for more information.
+          if (BOOL_PARAMETER_VALUE.matcher((String) queryPairs.get("licenses")).matches()) {
             return new MockLowLevelHttpRequest(url) {
               @Override
               public LowLevelHttpResponse execute() throws IOException {
                 return new MockLowLevelHttpResponse()
-                    .setContent(ComputeEngineCredentialsTest.FULL_ID_TOKEN_WITH_LICENSE);
+                    .setContent(ComputeEngineCredentialsTest.FULL_ID_TOKEN_WITH_LICENSES);
               }
             };
           }
diff --git a/oauth2_http/javatests/com/google/auth/oauth2/ServiceAccountJwtAccessCredentialsTest.java b/oauth2_http/javatests/com/google/auth/oauth2/ServiceAccountJwtAccessCredentialsTest.java
diff --git a/oauth2_http/javatests/com/google/auth/oauth2/UserAuthorizerTest.java b/oauth2_http/javatests/com/google/auth/oauth2/UserAuthorizerTest.java
diff --git a/oauth2_http/pom.xml b/oauth2_http/pom.xml
diff --git a/pom.xml b/pom.xml
diff --git a/samples/snippets/pom.xml b/samples/snippets/pom.xml
diff --git a/versions.txt b/versions.txt

Original file line number	Diff line number	Diff line change
`@@ -44,6 +44,6 @@ env_vars: {`
`44`	`44`	`}`
`45`	`45`
`46`	`46`	`container_properties {`
`47`		`- docker_image: "us-docker.pkg.dev/java-graalvm-ci-prod/graalvm-integration-testing/graalvm_a:1.15.4"`
	`47`	`+ docker_image: "us-docker.pkg.dev/java-graalvm-ci-prod/graalvm-integration-testing/graalvm_a:1.16.0"`
`48`	`48`	`}`
`49`	`49`
Original file line number	Diff line number	Diff line change
`@@ -44,5 +44,5 @@ env_vars: {`
`44`	`44`	`}`
`45`	`45`
`46`	`46`	`container_properties {`
`47`		`- docker_image: "us-docker.pkg.dev/java-graalvm-ci-prod/graalvm-integration-testing/graalvm_b:1.15.4"`
	`47`	`+ docker_image: "us-docker.pkg.dev/java-graalvm-ci-prod/graalvm-integration-testing/graalvm_b:1.16.0"`
`48`	`48`	`}`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,3 @@`
`1`	`1`	`{`
`2`		`- ".": "1.35.0"`
	`2`	`+ ".": "1.36.0"`
`3`	`3`	`}`
Original file line number	Diff line number	Diff line change
`@@ -407,9 +407,9 @@ public IdToken idTokenWithAudience(String targetAudience, List<IdTokenProvider.O`
`407`	`407`	`documentUrl.set("format", "full");`
`408`	`408`	`}`
`409`	`409`	`if (options.contains(IdTokenProvider.Option.LICENSES_TRUE)) {`
`410`		`- // license will only get returned if format is also full`
	`410`	`+ // licenses will only get returned if format is also full`
`411`	`411`	`documentUrl.set("format", "full");`
`412`		`- documentUrl.set("license", "TRUE");`
	`412`	`+ documentUrl.set("licenses", "TRUE");`
`413`	`413`	`}`
`414`	`414`	`}`
`415`	`415`	`documentUrl.set("audience", targetAudience);`