Underlying Java spanner client attempting to use TLS despite usePlainText=true

[SanjayVas]

Environment details

OS: Linux (Debian 14)
Java version: 17
java-spanner-jdbc version: 2.32.3

Steps to reproduce

1. Attempt to connect via JDBC to local Spanner emulator using usePlainText=true
2. Observe it trying to connect via TLS

Code example

    fun buildJdbcConnectionString(
      emulatorHost: String,
      project: String,
      instance: String,
      database: String,
    ): String {
      return "jdbc:cloudspanner://$emulatorHost/projects/$project/instances/$instance/databases/" +
        "$database;usePlainText=true;autoConfigEmulator=true"
    }

    val connectionString =
      SpannerEmulator.buildJdbcConnectionString(emulatorHost, PROJECT, INSTANCE, databaseId)
    DriverManager.getConnection(connectionString).use { connection ->
      Liquibase.update(connection, changelogPath)
    }

Stack trace

There's no exception thrown. This stack trace is from my test timing out.

app//com.google.auth.mtls.SecureConnectProvider.runCertificateProviderCommand(SecureConnectProvider.java:163)
        at app//com.google.auth.mtls.SecureConnectProvider.getKeyStore(SecureConnectProvider.java:142)
        at app//com.google.auth.mtls.SecureConnectProvider.getKeyStore(SecureConnectProvider.java:106)
        at app//com.google.auth.mtls.SecureConnectProvider.isAvailable(SecureConnectProvider.java:127)
        at app//com.google.auth.mtls.DefaultMtlsProviderFactory.create(DefaultMtlsProviderFactory.java:60)
        at app//com.google.api.gax.rpc.EndpointContext$Builder.determineEndpoint(EndpointContext.java:297)
        at app//com.google.api.gax.rpc.EndpointContext$Builder.build(EndpointContext.java:411)
        at app//com.google.api.gax.rpc.StubSettings.buildEndpointContext(StubSettings.java:129)
        at app//com.google.api.gax.rpc.StubSettings.<init>(StubSettings.java:110)
        at app//com.google.cloud.spanner.v1.stub.SpannerStubSettings.<init>(SpannerStubSettings.java:405)
        at app//com.google.cloud.spanner.v1.stub.SpannerStubSettings$Builder.build(SpannerStubSettings.java:823)
        at app//com.google.cloud.spanner.spi.v1.GapicSpannerRpc.<init>(GapicSpannerRpc.java:474)
        at app//com.google.cloud.spanner.spi.v1.GapicSpannerRpc.<init>(GapicSpannerRpc.java:290)
        at app//com.google.cloud.spanner.SpannerOptions$DefaultSpannerRpcFactory.create(SpannerOptions.java:644)
        at app//com.google.cloud.spanner.SpannerOptions$DefaultSpannerRpcFactory.create(SpannerOptions.java:639)
        at app//com.google.cloud.ServiceOptions.getRpc(ServiceOptions.java:602)
        at app//com.google.cloud.spanner.SpannerOptions.getSpannerRpcV1(SpannerOptions.java:2207)
        at app//com.google.cloud.spanner.SpannerImpl.<init>(SpannerImpl.java:155)
        at app//com.google.cloud.spanner.SpannerOptions$DefaultSpannerFactory.create(SpannerOptions.java:634)
        at app//com.google.cloud.spanner.SpannerOptions$DefaultSpannerFactory.create(SpannerOptions.java:629)
        at app//com.google.cloud.ServiceOptions.getService(ServiceOptions.java:582)
        at app//com.google.cloud.spanner.connection.SpannerPool.createSpanner(SpannerPool.java:425)
        at app//com.google.cloud.spanner.connection.SpannerPool.getSpanner(SpannerPool.java:341)
        at app//com.google.cloud.spanner.connection.ConnectionImpl.<init>(ConnectionImpl.java:318)
        at app//com.google.cloud.spanner.connection.ConnectionOptions.getConnection(ConnectionOptions.java:893)
        at app//com.google.cloud.spanner.jdbc.AbstractJdbcConnection.<init>(AbstractJdbcConnection.java:68)
        at app//com.google.cloud.spanner.jdbc.JdbcConnection.<init>(JdbcConnection.java:97)
        at app//com.google.cloud.spanner.jdbc.JdbcDriver.connect(JdbcDriver.java:232)
        at platform/java.sql@17.0.14/java.sql.DriverManager.getConnection(DriverManager.java:681)
        at platform/java.sql@17.0.14/java.sql.DriverManager.getConnection(DriverManager.java:252)

Any additional information below

I observed this after upgrading my client libraries by updating my version of the Google Cloud Libraries BOM.

It appears that the connection goes through eventually, but it's slow enough that my tests now time out.

I see the following warnings repeatedly in my logs:

Sep 20, 2025 1:25:25 AM com.google.api.gax.rpc.EndpointContext$Builder determineEndpoint
WARNING: DefaultMtlsProviderFactory encountered unexpected IOException: SecureConnect: Cert provider command failed with exit code: 139

[olavloite]

This is caused by googleapis/sdk-platform-java#3852

Filed googleapis/sdk-platform-java#3911

[olavloite]

There is unfortunately no code path or configuration option that available that allows us to disable this check. The only alternative is to overwrite the code. So if you need a workaround until googleapis/sdk-platform-java#3911 has been fixed, then you need to overwrite the offending code. This can be done in two ways:

1. Using something like bytebuddy:

See googleapis/java-spanner#4052, and then specifically the file DisableDefaultMtlsProvider

2. Overwriting the DefaultMtlsProviderFactory class manually by adding the following to your code and making sure this version of the class is loaded:

package com.google.auth.mtls;

import java.io.IOException;

public class DefaultMtlsProviderFactory {

  public static MtlsProvider create() throws IOException {
    throw new CertificateSourceUnavailableException(
        "No Certificate Source is available on this device.");
  }
}

[SanjayVas]

googleapis/sdk-platform-java#3911 appears to have been marked as fixed, but the PR which fixes it mentions an environment variable that needs to be set for tests. I just want to make sure that if usePlainText=true is specified for the JDBC connection that it never attempts to use TLS.