feat: Add TrustBoundaries support for ExternalAccounts. #1836

vverman · 2025-10-27T18:13:24Z

Added logic and unit tests for trust boundary for external accounts. This PR covers

Workload authentication.
Workforce authentication. (headful and headless)
Service account impersonation for workloads and workforces.

This PR is a followup of the initial PR for Trust Boundaries for Service accounts.

… and header value. # Conflicts: # oauth2_http/java/com/google/auth/oauth2/ComputeEngineCredentials.java # oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java # oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java # Conflicts: # oauth2_http/java/com/google/auth/oauth2/ComputeEngineCredentials.java # oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java # oauth2_http/java/com/google/auth/oauth2/ImpersonatedCredentials.java # oauth2_http/java/com/google/auth/oauth2/OAuth2Credentials.java # oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java # oauth2_http/java/com/google/auth/oauth2/TrustBoundary.java

…e trust boundary enabler env variable

…ents regarding a separate mock for trust boundary.

oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java

oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java

…s universe domain.

oauth2_http/javatests/com/google/auth/TestUtils.java

oauth2_http/javatests/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentialsTest.java

oauth2_http/javatests/com/google/auth/oauth2/MockTokenServerTransport.java

oauth2_http/javatests/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentialsTest.java

oauth2_http/javatests/com/google/auth/oauth2/ExternalAccountCredentialsTest.java

…nt time in UTC.

oauth2_http/java/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentials.java

oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java

…tion and format changes.

oauth2_http/java/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentials.java

oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java

lqiu96 · 2025-11-03T17:19:37Z

I think things generally LGTM. I will do a second pass for the tests below.

nbayati · 2025-11-03T18:18:20Z

oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java

      AccessToken accessToken = this.impersonatedCredentials.refreshAccessToken();
-      // After the impersonated credential refreshes, its trust boundary is
-      // also refreshed. That is the trust boundary we will use.
+      // We use the impersonated account's credential as the trust boundary


nit: I think the previous comment was more clear.

nbayati

LGTM. Great job! :)

lqiu96 · 2025-11-05T15:35:01Z

oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java

+  protected void setTrustBoundary(TrustBoundary trustBoundary) {
+    this.trustBoundary = trustBoundary;
+  }


is this still needed?

lqiu96 · 2025-11-05T15:44:37Z

oauth2_http/javatests/com/google/auth/oauth2/AwsCredentialsTest.java

+            .setSubjectTokenType("subjectTokenType")
+            .build();
+
+    awsCredential.refreshAccessToken();


nit: I think most of the other test classes use .refresh()

lqiu96 · 2025-11-05T15:45:38Z

oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java

+    throw new IllegalStateException(
+        "The provided audience is not in a valid format for either a workload identity pool or a workforce pool.");
+  }


nit: If possible, is there an official doc that we can link to with the format for workload pool and workforce pool?

lqiu96 · 2025-11-05T15:46:05Z

oauth2_http/java/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentials.java

+      throw new IllegalStateException(
+          "The provided audience is not in the correct format for a workforce pool.");


nit: If possible, can we link to a public offical doc that has the format for workforce pool?

lqiu96

LGTM. I added a few nits that may need additional code changes (feel free to resolve if it's not possible). I can re-approve afterwards.

vverman added 10 commits October 24, 2025 13:15

Added changes to authenticate TB endpoint, add correct TB headers.

c17e26d

Added unit tests for Trust Boundary for Service accounts. Updated. th…

2b486bd

…e trust boundary enabler env variable

Formatting changes

63f508b

Trust Boundary Recovery

5bddb2f

Changed key for encodedLocations and changed tests.

9fb3547

minor fixes

dab6d3b

External Account Initial Changes.

d58147c

Added tests for all excepting ExternalAccountCredentials.

283d8b5

Added tests for ExternalAccountCredentials trust boundary. Added comm…

b4e5199

…ents regarding a separate mock for trust boundary.

vverman requested review from a team as code owners October 27, 2025 18:13

product-auto-label bot added the size: l Pull request size is large. label Oct 27, 2025

Some nit fixes.

458bad4

vverman force-pushed the feat/trust-boundary-external-account branch from fb18c0c to 458bad4 Compare October 27, 2025 23:24

Fixed test failures.

8cd8f2f

vverman self-assigned this Oct 29, 2025

vverman requested review from lqiu96 and nbayati October 29, 2025 17:57

vverman added the do not merge Indicates a pull request not ready for merge, due to either quality or timing. label Oct 29, 2025

nbayati reviewed Oct 30, 2025

View reviewed changes

TrustBoundaryUrl's universe domain is now configured from the client'…

f737866

…s universe domain.

vverman requested a review from nbayati October 30, 2025 22:11

Formatted ExternalAccountCredentials.

fe772d8

nbayati reviewed Oct 30, 2025

View reviewed changes

assertThrows changes. Fixed TestUtils getDefaultExpireTime to represe…

1efce2d

…nt time in UTC.