Skip to content

fix: Simplify call to directly retrieve the default service account from MDS #1844

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lqiu96 merged 2 commits into from
Dec 3, 2025
Merged

fix: Simplify call to directly retrieve the default service account from MDS #1844

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
abd8129
fix: Simplify call to directly retrieve the default service account f…
lqiu96 Nov 10, 2025
4381756
chore: Make getDefaultServiceAccountUrl package-private
lqiu96 Dec 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 8 additions & 8 deletions oauth2_http/java/com/google/auth/oauth2/ComputeEngineCredentials.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,6 @@
import java.util.Collections;
import java.util.Date;
import java.util.List;
import java.util.Map;
import java.util.Objects;
import java.util.logging.Level;
import java.util.logging.Logger;
Expand Down Expand Up @@ -117,7 +116,7 @@
private static final String LINUX = "linux";

private static final String PARSE_ERROR_PREFIX = "Error parsing token refresh response. ";
private static final String PARSE_ERROR_ACCOUNT = "Error parsing service account response. ";

Check warning on line 119 in oauth2_http/java/com/google/auth/oauth2/ComputeEngineCredentials.java

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Remove this unused "PARSE_ERROR_ACCOUNT" private field. 


See more on https://sonarcloud.io/project/issues?id=googleapis_google-auth-library-java&issues=AZpuAdtw-PoXAdrPMppb&open=AZpuAdtw-PoXAdrPMppb&pullRequest=1844
private static final long serialVersionUID = -4113476462526554235L;

private final String transportFactoryClassName;
Expand Down Expand Up @@ -471,7 +470,7 @@
requestMessage = "Sending request to refresh access token";
responseMessage = "Received response for refresh access token";
} else {
// TODO: this includes get universe domain and get default sa.

Check warning on line 473 in oauth2_http/java/com/google/auth/oauth2/ComputeEngineCredentials.java

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Complete the task associated to this TODO comment. 


See more on https://sonarcloud.io/project/issues?id=googleapis_google-auth-library-java&issues=AZpuAdtw-PoXAdrPMppa&open=AZpuAdtw-PoXAdrPMppa&pullRequest=1844
// refactor for more clear logging message.
requestMessage = "Sending request for universe domain/default service account";
responseMessage = "Received response for universe domain/default service account";
Expand Down Expand Up @@ -539,7 +538,7 @@

@VisibleForTesting
static boolean checkProductNameOnLinux(BufferedReader reader) throws IOException {
String name = reader.readLine().trim();

Check warning on line 541 in oauth2_http/java/com/google/auth/oauth2/ComputeEngineCredentials.java

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Fix this access on a value that can be null. 


See more on https://sonarcloud.io/project/issues?id=googleapis_google-auth-library-java&issues=AZpuAdtw-PoXAdrPMppc&open=AZpuAdtw-PoXAdrPMppc&pullRequest=1844
return name.startsWith(GOOGLE);
}

Expand Down Expand Up @@ -632,6 +631,12 @@
+ "/computeMetadata/v1/instance/service-accounts/?recursive=true";
}

/** Url to retrieve the default service account entry from the Metadata Server. */
static String getDefaultServiceAccountUrl() {
return getMetadataServerUrl(DefaultCredentialsProvider.DEFAULT)
+ "/computeMetadata/v1/instance/service-accounts/default/email";
}

public static String getIdentityDocumentUrl() {
return getMetadataServerUrl(DefaultCredentialsProvider.DEFAULT)
+ "/computeMetadata/v1/instance/service-accounts/default/identity";
Expand Down Expand Up @@ -733,7 +738,7 @@

private String getDefaultServiceAccount() throws IOException {
HttpResponse response =
getMetadataResponse(getServiceAccountsUrl(), RequestType.UNTRACKED, false);
getMetadataResponse(getDefaultServiceAccountUrl(), RequestType.UNTRACKED, false);
int statusCode = response.getStatusCode();
if (statusCode == HttpStatusCodes.STATUS_CODE_NOT_FOUND) {
throw new IOException(
Expand All @@ -756,12 +761,7 @@
// Mock transports will have success code with empty content by default.
throw new IOException(METADATA_RESPONSE_EMPTY_CONTENT_ERROR_MESSAGE);
}
GenericData responseData = response.parseAs(GenericData.class);
LoggingUtils.logResponsePayload(
responseData, LOGGER_PROVIDER, "Received default service account payload");
Map<String, Object> defaultAccount =
OAuth2Utils.validateMap(responseData, "default", PARSE_ERROR_ACCOUNT);
return OAuth2Utils.validateString(defaultAccount, "email", PARSE_ERROR_ACCOUNT);
return response.parseAsString();
}

public static class Builder extends GoogleCredentials.Builder {
Expand Down
4 changes: 2 additions & 2 deletions oauth2_http/javatests/com/google/auth/oauth2/ComputeEngineCredentialsTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -590,7 +590,7 @@
new MockMetadataServerTransport() {
@Override
public LowLevelHttpRequest buildRequest(String method, String url) throws IOException {
if (isGetServiceAccountsUrl(url)) {
if (isGetDefaultServiceAccountsUrl(url)) {
return new MockLowLevelHttpRequest(url) {
@Override
public LowLevelHttpResponse execute() throws IOException {
Expand Down Expand Up @@ -626,7 +626,7 @@
new MockMetadataServerTransport() {
@Override
public LowLevelHttpRequest buildRequest(String method, String url) throws IOException {
if (isGetServiceAccountsUrl(url)) {
if (isGetDefaultServiceAccountsUrl(url)) {
return new MockLowLevelHttpRequest(url) {
@Override
public LowLevelHttpResponse execute() throws IOException {
Expand Down Expand Up @@ -798,7 +798,7 @@
ComputeEngineCredentials.newBuilder().setHttpTransportFactory(transportFactory).build();

IOException exception =
Assert.assertThrows(IOException.class, () -> credentials.refreshAccessToken());

Check warning on line 801 in oauth2_http/javatests/com/google/auth/oauth2/ComputeEngineCredentialsTest.java

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Replace this lambda with method reference 'credentials::refreshAccessToken'. 


See more on https://sonarcloud.io/project/issues?id=googleapis_google-auth-library-java&issues=AZpuAdsg-PoXAdrPMppY&open=AZpuAdsg-PoXAdrPMppY&pullRequest=1844
assertTrue(exception.getCause().getMessage().contains("503"));
assertTrue(exception instanceof GoogleAuthException);
assertTrue(((GoogleAuthException) exception).isRetryable());
Expand Down Expand Up @@ -835,7 +835,7 @@
ComputeEngineCredentials.newBuilder().setHttpTransportFactory(transportFactory).build();

IOException exception =
Assert.assertThrows(IOException.class, () -> credentials.refreshAccessToken());

Check warning on line 838 in oauth2_http/javatests/com/google/auth/oauth2/ComputeEngineCredentialsTest.java

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Replace this lambda with method reference 'credentials::refreshAccessToken'. 


See more on https://sonarcloud.io/project/issues?id=googleapis_google-auth-library-java&issues=AZpuAdsg-PoXAdrPMppZ&open=AZpuAdsg-PoXAdrPMppZ&pullRequest=1844
assertFalse(exception instanceof GoogleAuthException);
}
}
Expand Down
23 changes: 7 additions & 16 deletions oauth2_http/javatests/com/google/auth/oauth2/MockMetadataServerTransport.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,8 +129,8 @@
if (url.startsWith(ComputeEngineCredentials.getTokenServerEncodedUrl())) {
this.request = getMockRequestForTokenEndpoint(url);
return this.request;
} else if (isGetServiceAccountsUrl(url)) {
this.request = getMockRequestForServiceAccount(url);
} else if (isGetDefaultServiceAccountsUrl(url)) {
this.request = getMockRequestForDefaultServiceAccount(url);
return this.request;
} else if (isSignRequestUrl(url)) {
this.request = getMockRequestForSign(url);
Expand Down Expand Up @@ -176,22 +176,13 @@
};
}

private MockLowLevelHttpRequest getMockRequestForServiceAccount(String url) {
private MockLowLevelHttpRequest getMockRequestForDefaultServiceAccount(String url) {
return new MockLowLevelHttpRequest(url) {
@Override
public LowLevelHttpResponse execute() throws IOException {
// Create the JSON response
GenericJson serviceAccountsContents = new GenericJson();
serviceAccountsContents.setFactory(OAuth2Utils.JSON_FACTORY);
GenericJson defaultAccount = new GenericJson();
defaultAccount.put("email", serviceAccountEmail);
serviceAccountsContents.put("default", defaultAccount);

String serviceAccounts = serviceAccountsContents.toPrettyString();

public LowLevelHttpResponse execute() {
return new MockLowLevelHttpResponse()
.setContentType(Json.MEDIA_TYPE)
.setContent(serviceAccounts);
.setContent(serviceAccountEmail);
}
};
}
Expand Down Expand Up @@ -279,7 +270,7 @@
if (queryPairs.containsKey("licenses")) {
// The metadata server defaults to false and matches "on", "off" and ::absl::SimpleAtob.
// See https://abseil.io/docs/cpp/guides/strings#numericConversion for more information.
if (BOOL_PARAMETER_VALUE.matcher((String) queryPairs.get("licenses")).matches()) {

Check warning on line 273 in oauth2_http/javatests/com/google/auth/oauth2/MockMetadataServerTransport.java

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Merge this if statement with the enclosing one. 


See more on https://sonarcloud.io/project/issues?id=googleapis_google-auth-library-java&issues=AZpuAdoI-PoXAdrPMppX&open=AZpuAdoI-PoXAdrPMppX&pullRequest=1844
return new MockLowLevelHttpRequest(url) {
@Override
public LowLevelHttpResponse execute() throws IOException {
Expand Down Expand Up @@ -341,8 +332,8 @@
};
}

protected boolean isGetServiceAccountsUrl(String url) {
return url.equals(ComputeEngineCredentials.getServiceAccountsUrl());
protected boolean isGetDefaultServiceAccountsUrl(String url) {
return url.equals(ComputeEngineCredentials.getDefaultServiceAccountUrl());
}

protected boolean isSignRequestUrl(String url) {
Expand Down