fix: S2A gRPC flow creates ComputeEngineCredentials via newBuilder. by rmehta19 · Pull Request #3651 · googleapis/sdk-platform-java

rmehta19 · 2025-02-22T00:15:31Z

@rockspore pointed out that the credential should be created from scratch because when using toBuilder the underlying access token is copied.

This was confirmed to be a bug with local testing which:

deployed a GAE app, the app performs the below two actions sequentially
create Google API client ( allowedHardBoundAccessTokens empty in GrpcProvider) and then ping the API, logs show the bearer token is used, obtained from making call to MDS
create a Google API client ( allowedHardBoundAccessTokens contains MTLS_S2A in GrpcProvider) and then ping the API, logs show the bearer token is used. A call to MDS is not made.

This is likely because the credential and channel have different lifetimes.

rockspore · 2025-02-22T00:18:05Z

gax-java/gax-grpc/src/main/java/com/google/api/gax/grpc/InstantiatingGrpcChannelProvider.java

        ComputeEngineCredentials.BindingEnforcement bindingEnforcement) {
+      ComputeEngineCredentials.Builder credsBuilder =
+          ((ComputeEngineCredentials) credentials).toBuilder();
      // We only set scopes and HTTP transport factory from the original credentials because


For future readers, could you explain briefly in the comment why we create it from a newBuilder()?

Thanks! Done.

Ah, yes thanks! This is an known issue in the Auth Library that we're slowly trying to fix as well and sorry to see that this also bit you all.

The existing access token will be invalidated (not copied) in the future from the builder.

rmehta19 · 2025-02-22T00:25:31Z

@lqiu96 , please review, thanks!

lqiu96 · 2025-02-24T18:31:28Z

/gcbrun

lqiu96 · 2025-02-24T18:45:25Z

Oh, can you also rename the title to follow conventional commits?

fix: S2A gRPC flow creates ComputeEngineCredentials via newBuilder.

or some similar

rmehta19 · 2025-02-24T21:45:47Z

Thanks @lqiu96 . I also updated the branch with upstream main, I think you will have to rerun gcbrun?

lqiu96 · 2025-02-24T21:57:24Z

/gcbrun

🤖 I have created a release *beep* *boop* --- <details><summary>2.54.0</summary> ## [2.54.0](v2.53.0...v2.54.0) (2025-02-25) ### Features * add client side logging with slf4j ([#3403](#3403)) ([fe002fa](fe002fa)) ### Bug Fixes * S2A gRPC flow creates ComputeEngineCredentials via newBuilder. ([#3651](#3651)) ([29c061e](29c061e)) ### Dependencies * update dependency ch.qos.logback:logback-core to v1.3.15 [security] ([#3654](#3654)) ([093d867](093d867)) * update google api dependencies ([#3631](#3631)) ([48db2a1](48db2a1)) * update google auth library dependencies to v1.33.1 ([#3656](#3656)) ([f7877a5](f7877a5)) * update google http client dependencies to v1.46.3 ([#3657](#3657)) ([9d5b3b5](9d5b3b5)) * update grpc to 1.70.0 ([#3641](#3641)) ([ad26cf9](ad26cf9)) * update grpc to 1.70.0 (missed update) ([#3658](#3658)) ([6ca0599](6ca0599)) * Update opentelemetry-semconv to v1.29.0-alpha ([#3635](#3635)) ([49ac09d](49ac09d)) ### Documentation * update showcase readme ([#3659](#3659)) ([0ddf073](0ddf073)) </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Joe Wang <joewa@google.com>

| Package | Type | Package file | Manager | Update | Change | |---|---|---|---|---|---| | [com.google.api.grpc:proto-google-common-protos](https://github.com/googleapis/sdk-platform-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `2.53.0` -> `2.54.0` | | [com.google.cloud:google-cloud-core-http](https://github.com/googleapis/sdk-platform-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `2.52.0` -> `2.53.0` | | [com.google.cloud:google-cloud-core](https://github.com/googleapis/sdk-platform-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `2.52.0` -> `2.53.0` | | [com.google.api:gax](https://github.com/googleapis/sdk-platform-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `2.62.0` -> `2.63.0` | | [com.autonomousapps.dependency-analysis](https://github.com/autonomousapps/dependency-analysis-android-gradle-plugin) | plugin | misk/gradle/libs.versions.toml | gradle | minor | `2.10.1` -> `2.11.0` | | [software.amazon.awssdk:sdk-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.37` -> `2.30.38` | | [software.amazon.awssdk:sqs](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.37` -> `2.30.38` | | [software.amazon.awssdk:dynamodb-enhanced](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.37` -> `2.30.38` | | [software.amazon.awssdk:dynamodb](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.37` -> `2.30.38` | | [software.amazon.awssdk:aws-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.37` -> `2.30.38` | | [software.amazon.awssdk:bom](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.37` -> `2.30.38` | | [software.amazon.awssdk:auth](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.37` -> `2.30.38` | --- ### Release Notes <details> <summary>googleapis/sdk-platform-java (com.google.api.grpc:proto-google-common-protos)</summary> ### [`v2.54.0`](https://github.com/googleapis/sdk-platform-java/blob/HEAD/CHANGELOG.md#2540-2025-02-25) ##### Features - add client side logging with slf4j ([#3403](googleapis/sdk-platform-java#3403)) ([fe002fa](googleapis/sdk-platform-java@fe002fa)) ##### Bug Fixes - S2A gRPC flow creates ComputeEngineCredentials via newBuilder. ([#3651](googleapis/sdk-platform-java#3651)) ([29c061e](googleapis/sdk-platform-java@29c061e)) ##### Dependencies - update dependency ch.qos.logback:logback-core to v1.3.15 \[security] ([#3654](googleapis/sdk-platform-java#3654)) ([093d867](googleapis/sdk-platform-java@093d867)) - update google api dependencies ([#3631](googleapis/sdk-platform-java#3631)) ([48db2a1](googleapis/sdk-platform-java@48db2a1)) - update google auth library dependencies to v1.33.1 ([#3656](googleapis/sdk-platform-java#3656)) ([f7877a5](googleapis/sdk-platform-java@f7877a5)) - update google http client dependencies to v1.46.3 ([#3657](googleapis/sdk-platform-java#3657)) ([9d5b3b5](googleapis/sdk-platform-java@9d5b3b5)) - update grpc to 1.70.0 ([#3641](googleapis/sdk-platform-java#3641)) ([ad26cf9](googleapis/sdk-platform-java@ad26cf9)) - update grpc to 1.70.0 (missed update) ([#3658](googleapis/sdk-platform-java#3658)) ([6ca0599](googleapis/sdk-platform-java@6ca0599)) - Update opentelemetry-semconv to v1.29.0-alpha ([#3635](googleapis/sdk-platform-java#3635)) ([49ac09d](googleapis/sdk-platform-java@49ac09d)) ##### Documentation - update showcase readme ([#3659](googleapis/sdk-platform-java#3659)) ([0ddf073](googleapis/sdk-platform-java@0ddf073)) </details> <details> <summary>autonomousapps/dependency-analysis-android-gradle-plugin (com.autonomousapps.dependency-analysis)</summary> ### [`v2.11.0`](https://github.com/autonomousapps/dependency-analysis-android-gradle-plugin/blob/HEAD/CHANGELOG.md#Version-2110) - \[Feat]: new task (`:computeAllDependencies`) for producing a version catalog file containing all dependencies. - \[Fix]: kotlin-reflect must be on the compile classpath. - \[Test]: Update AGP 8.9.0 stable. - \[Test]: conditional signing. </details> --- ### Configuration 📅 **Schedule**: Branch creation - "after 6pm every weekday,before 2am every weekday" in timezone Australia/Melbourne, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Never, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). GitOrigin-RevId: c7d38837c081de3bba13d5d7f2d42008ba98f440

rmehta19 added 2 commits February 21, 2025 16:09

create new ComputeEngineCredentials via newBuilder.

1f3cdc9

set parameter values.

f26b07b

product-auto-label bot added the size: s Pull request size is small. label Feb 22, 2025

rmehta19 changed the title ~~fix: create new ComputeEngineCredentials via newBuilder.~~ grpc fix: create new ComputeEngineCredentials via newBuilder. Feb 22, 2025

rockspore reviewed Feb 22, 2025

View reviewed changes

return cred.

cf27512

product-auto-label bot added size: xs Pull request size is extra small. and removed size: s Pull request size is small. labels Feb 22, 2025

update comment.

dbe590f

product-auto-label bot added size: s Pull request size is small. and removed size: xs Pull request size is extra small. labels Feb 22, 2025

rmehta19 changed the title ~~grpc fix: create new ComputeEngineCredentials via newBuilder.~~ grpc: create new ComputeEngineCredentials via newBuilder. Feb 22, 2025

lqiu96 approved these changes Feb 24, 2025

View reviewed changes

rmehta19 changed the title ~~grpc: create new ComputeEngineCredentials via newBuilder.~~ fix: S2A gRPC flow creates ComputeEngineCredentials via newBuilder. Feb 24, 2025

Merge branch 'main' into build-new-cred

18f2ac6

lqiu96 enabled auto-merge (squash) February 24, 2025 21:57

lqiu96 merged commit 29c061e into googleapis:main Feb 24, 2025
45 of 47 checks passed

release-please bot mentioned this pull request Feb 24, 2025

chore(main): release 2.54.0 #3636

Merged

rockspore mentioned this pull request Feb 25, 2025

feat: enable ALTS hard bound token in DirectPath googleapis/java-spanner#3645

Merged

suztomo mentioned this pull request Nov 5, 2025

chore(2.59.x): release 2.59.3 #3982

Merged

release-please bot mentioned this pull request Dec 11, 2025

chore(protobuf-4.x-rc): release 2.65.0-rc1 #3999

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: S2A gRPC flow creates ComputeEngineCredentials via newBuilder.#3651

fix: S2A gRPC flow creates ComputeEngineCredentials via newBuilder.#3651
lqiu96 merged 5 commits intogoogleapis:mainfrom
rmehta19:build-new-cred

rmehta19 commented Feb 22, 2025 •

edited

Loading

Uh oh!

rockspore Feb 22, 2025 •

edited

Loading

Uh oh!

rmehta19 Feb 22, 2025

Uh oh!

lqiu96 Feb 24, 2025

Uh oh!

rmehta19 commented Feb 22, 2025

Uh oh!

lqiu96 commented Feb 24, 2025

Uh oh!

lqiu96 commented Feb 24, 2025

Uh oh!

rmehta19 commented Feb 24, 2025

Uh oh!

lqiu96 commented Feb 24, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

rmehta19 commented Feb 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rockspore Feb 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rmehta19 Feb 22, 2025

Choose a reason for hiding this comment

Uh oh!

lqiu96 Feb 24, 2025

Choose a reason for hiding this comment

Uh oh!

rmehta19 commented Feb 22, 2025

Uh oh!

lqiu96 commented Feb 24, 2025

Uh oh!

lqiu96 commented Feb 24, 2025

Uh oh!

rmehta19 commented Feb 24, 2025

Uh oh!

lqiu96 commented Feb 24, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

rmehta19 commented Feb 22, 2025 •

edited

Loading

rockspore Feb 22, 2025 •

edited

Loading