Skip to content

Commit 18020fe

Browse files
rmehta19rmehta19
authoredNov 8, 2024··
fix: Make it explicit that there is a network call to MDS to get SecureSessionAgentConfig (#1573)
* S2A utility returns S2AConfig. * S2A -> SecureSessionAgent. * getConfig + javadocs. * static create. * typo. * add javadoc. * format.
·
v1.33.1v1.30.0
1 parent 7c5ed2f commit 18020fe

File tree

5 files changed

+78
-64
lines changed

5 files changed

+78
-64
lines changed
 

‎oauth2_http/java/com/google/auth/oauth2/S2A.java ‎oauth2_http/java/com/google/auth/oauth2/SecureSessionAgent.java

+30-27
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@
5858
* <p>This is an experimental utility.
5959
*/
6060
@ThreadSafe
61-
public final class S2A {
61+
public class SecureSessionAgent {
6262
static final String S2A_PLAINTEXT_ADDRESS_JSON_KEY = "plaintext_address";
6363
static final String S2A_MTLS_ADDRESS_JSON_KEY = "mtls_address";
6464
static final String S2A_CONFIG_ENDPOINT_POSTFIX =
@@ -72,23 +72,25 @@ public final class S2A {
7272
private static final String MDS_MTLS_ENDPOINT =
7373
ComputeEngineCredentials.getMetadataServerUrl() + S2A_CONFIG_ENDPOINT_POSTFIX;
7474

75-
private S2AConfig config;
76-
7775
private transient HttpTransportFactory transportFactory;
7876

79-
S2A(S2A.Builder builder) {
77+
SecureSessionAgent(SecureSessionAgent.Builder builder) {
8078
this.transportFactory = builder.getHttpTransportFactory();
81-
this.config = getS2AConfigFromMDS();
8279
}
8380

84-
/** @return the mTLS S2A Address from the mTLS config. */
85-
public String getMtlsS2AAddress() {
86-
return config.getMtlsAddress();
81+
/**
82+
* This method makes a network call to MDS to get the {@link SecureSessionAgentConfig} which
83+
* contains the plaintext and mtls address to reach the S2A (Secure Session Agent).
84+
*
85+
* @return a SecureSessionAgentConfig.
86+
*/
87+
public SecureSessionAgentConfig getConfig() {
88+
return getSecureSessionAgentConfigFromMDS();
8789
}
8890

89-
/** @return the plaintext S2A Address from the mTLS config. */
90-
public String getPlaintextS2AAddress() {
91-
return config.getPlaintextAddress();
91+
/** @return default instance of SecureSessionAgent */
92+
public static SecureSessionAgent create() {
93+
return newBuilder().build();
9294
}
9395

9496
public static Builder newBuilder() {
@@ -110,17 +112,18 @@ public HttpTransportFactory getHttpTransportFactory() {
110112
return this.transportFactory;
111113
}
112114

113-
public S2A build() {
114-
return new S2A(this);
115+
public SecureSessionAgent build() {
116+
return new SecureSessionAgent(this);
115117
}
116118
}
117119

118120
/**
119-
* Queries the MDS mTLS Autoconfiguration endpoint and returns the {@link S2AConfig}.
121+
* Queries the MDS mTLS Autoconfiguration endpoint and returns the {@link
122+
* SecureSessionAgentConfig}.
120123
*
121-
* <p>Returns {@link S2AConfig}. If S2A is not running, or if any error occurs when making the
122-
* request to MDS / processing the response, {@link S2AConfig} will be populated with empty
123-
* addresses.
124+
* <p>Returns {@link SecureSessionAgentConfig}. If S2A is not running, or if any error occurs when
125+
* making the request to MDS / processing the response, {@link SecureSessionAgentConfig} will be
126+
* populated with empty addresses.
124127
*
125128
* <p>Users are expected to try to fetch the mTLS-S2A address first (via {@link
126129
* getMtlsS2AAddress}). If it is empty or they have some problem loading the mTLS-MDS credentials,
@@ -129,9 +132,9 @@ public S2A build() {
129132
* when talking to the MDS / processing the response or that S2A is not running in the
130133
* environment; in either case this indicates S2A shouldn't be used.
131134
*
132-
* @return the {@link S2AConfig}.
135+
* @return the {@link SecureSessionAgentConfig}.
133136
*/
134-
private S2AConfig getS2AConfigFromMDS() {
137+
private SecureSessionAgentConfig getSecureSessionAgentConfigFromMDS() {
135138
if (transportFactory == null) {
136139
transportFactory =
137140
Iterables.getFirst(
@@ -144,9 +147,9 @@ private S2AConfig getS2AConfigFromMDS() {
144147
request = transportFactory.create().createRequestFactory().buildGetRequest(genericUrl);
145148
} catch (IOException ignore) {
146149
/*
147-
* Return empty addresses in {@link S2AConfig} if error building the GET request.
150+
* Return empty addresses in {@link SecureSessionAgentConfig} if error building the GET request.
148151
*/
149-
return S2AConfig.createBuilder().build();
152+
return SecureSessionAgentConfig.createBuilder().build();
150153
}
151154

152155
request.setParser(new JsonObjectParser(OAuth2Utils.JSON_FACTORY));
@@ -173,14 +176,14 @@ private S2AConfig getS2AConfigFromMDS() {
173176
HttpResponse response = request.execute();
174177
InputStream content = response.getContent();
175178
if (content == null) {
176-
return S2AConfig.createBuilder().build();
179+
return SecureSessionAgentConfig.createBuilder().build();
177180
}
178181
responseData = response.parseAs(GenericData.class);
179182
} catch (IOException ignore) {
180183
/*
181-
* Return empty addresses in {@link S2AConfig} once all retries have been exhausted.
184+
* Return empty addresses in {@link SecureSessionAgentConfig} once all retries have been exhausted.
182185
*/
183-
return S2AConfig.createBuilder().build();
186+
return SecureSessionAgentConfig.createBuilder().build();
184187
}
185188

186189
String plaintextS2AAddress = "";
@@ -190,19 +193,19 @@ private S2AConfig getS2AConfigFromMDS() {
190193
OAuth2Utils.validateString(responseData, S2A_PLAINTEXT_ADDRESS_JSON_KEY, PARSE_ERROR_S2A);
191194
} catch (IOException ignore) {
192195
/*
193-
* Do not throw error because of parsing error, just leave the address as empty in {@link S2AConfig}.
196+
* Do not throw error because of parsing error, just leave the address as empty in {@link SecureSessionAgentConfig}.
194197
*/
195198
}
196199
try {
197200
mtlsS2AAddress =
198201
OAuth2Utils.validateString(responseData, S2A_MTLS_ADDRESS_JSON_KEY, PARSE_ERROR_S2A);
199202
} catch (IOException ignore) {
200203
/*
201-
* Do not throw error because of parsing error, just leave the address as empty in {@link S2AConfig}.
204+
* Do not throw error because of parsing error, just leave the address as empty in {@link SecureSessionAgentConfig}.
202205
*/
203206
}
204207

205-
return S2AConfig.createBuilder()
208+
return SecureSessionAgentConfig.createBuilder()
206209
.setPlaintextAddress(plaintextS2AAddress)
207210
.setMtlsAddress(mtlsS2AAddress)
208211
.build();

‎oauth2_http/java/com/google/auth/oauth2/S2AConfig.java ‎oauth2_http/java/com/google/auth/oauth2/SecureSessionAgentConfig.java

+4-4
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@
3333
import com.google.errorprone.annotations.CanIgnoreReturnValue;
3434

3535
/** Holds an mTLS configuration (consists of address of S2A) retrieved from the Metadata Server. */
36-
final class S2AConfig {
36+
public class SecureSessionAgentConfig {
3737
// plaintextAddress is the plaintext address to reach the S2A.
3838
private final String plaintextAddress;
3939

@@ -86,12 +86,12 @@ public Builder setMtlsAddress(String mtlsAddress) {
8686
return this;
8787
}
8888

89-
public S2AConfig build() {
90-
return new S2AConfig(plaintextAddress, mtlsAddress);
89+
public SecureSessionAgentConfig build() {
90+
return new SecureSessionAgentConfig(plaintextAddress, mtlsAddress);
9191
}
9292
}
9393

94-
private S2AConfig(String plaintextAddress, String mtlsAddress) {
94+
private SecureSessionAgentConfig(String plaintextAddress, String mtlsAddress) {
9595
this.plaintextAddress = plaintextAddress;
9696
this.mtlsAddress = mtlsAddress;
9797
}

‎oauth2_http/javatests/com/google/auth/oauth2/MockMetadataServerTransport.java

+4-3
Original file line numberDiff line numberDiff line change
@@ -291,8 +291,8 @@ private MockLowLevelHttpRequest getMockRequestForMtlsConfig(String url) {
291291
@Override
292292
public LowLevelHttpResponse execute() throws IOException {
293293

294-
String metadataRequestHeader = getFirstHeaderValue(S2A.METADATA_FLAVOR);
295-
if (!S2A.GOOGLE.equals(metadataRequestHeader)) {
294+
String metadataRequestHeader = getFirstHeaderValue(SecureSessionAgent.METADATA_FLAVOR);
295+
if (!SecureSessionAgent.GOOGLE.equals(metadataRequestHeader)) {
296296
throw new IOException("Metadata request header not found");
297297
}
298298

@@ -337,6 +337,7 @@ protected boolean isIdentityDocumentUrl(String url) {
337337
protected boolean isMtlsConfigRequestUrl(String url) {
338338
return url.equals(
339339
String.format(
340-
ComputeEngineCredentials.getMetadataServerUrl() + S2A.S2A_CONFIG_ENDPOINT_POSTFIX));
340+
ComputeEngineCredentials.getMetadataServerUrl()
341+
+ SecureSessionAgent.S2A_CONFIG_ENDPOINT_POSTFIX));
341342
}
342343
}

‎oauth2_http/javatests/com/google/auth/oauth2/S2AConfigTest.java ‎oauth2_http/javatests/com/google/auth/oauth2/SecureSessionAgentConfigTest.java

+5-5
Original file line numberDiff line numberDiff line change
@@ -37,16 +37,16 @@
3737
import org.junit.runner.RunWith;
3838
import org.junit.runners.JUnit4;
3939

40-
/** Test cases for {@link S2AConfig}. */
40+
/** Test cases for {@linkSecureSessionAgentConfig}. */
4141
@RunWith(JUnit4.class)
42-
public class S2AConfigTest {
42+
public class SecureSessionAgentConfigTest {
4343
private static final String S2A_PLAINTEXT_ADDRESS = "plaintext";
4444
private static final String S2A_MTLS_ADDRESS = "mtls";
4545

4646
@Test
4747
public void createS2AConfig_success() {
48-
S2AConfig config =
49-
S2AConfig.createBuilder()
48+
SecureSessionAgentConfig config =
49+
SecureSessionAgentConfig.createBuilder()
5050
.setPlaintextAddress(S2A_PLAINTEXT_ADDRESS)
5151
.setMtlsAddress(S2A_MTLS_ADDRESS)
5252
.build();
@@ -56,7 +56,7 @@ public void createS2AConfig_success() {
5656

5757
@Test
5858
public void createEmptyS2AConfig_success() {
59-
S2AConfig config = S2AConfig.createBuilder().build();
59+
SecureSessionAgentConfig config = SecureSessionAgentConfig.createBuilder().build();
6060
assertTrue(config.getPlaintextAddress().isEmpty());
6161
assertTrue(config.getMtlsAddress().isEmpty());
6262
}

‎oauth2_http/javatests/com/google/auth/oauth2/S2ATest.java ‎oauth2_http/javatests/com/google/auth/oauth2/SecureSessionAgentTest.java

+35-25
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,9 @@
4040
import org.junit.runner.RunWith;
4141
import org.junit.runners.JUnit4;
4242

43-
/** Test cases for {@link S2A}. */
43+
/** Test cases for {@link SecureSessionAgent}. */
4444
@RunWith(JUnit4.class)
45-
public class S2ATest {
45+
public class SecureSessionAgentTest {
4646

4747
private static final String INVALID_JSON_KEY = "invalid_key";
4848
private static final String S2A_PLAINTEXT_ADDRESS = "plaintext";
@@ -53,15 +53,17 @@ public void getS2AAddress_validAddress() {
5353
MockMetadataServerTransportFactory transportFactory = new MockMetadataServerTransportFactory();
5454
transportFactory.transport.setS2AContentMap(
5555
ImmutableMap.of(
56-
S2A.S2A_PLAINTEXT_ADDRESS_JSON_KEY,
56+
SecureSessionAgent.S2A_PLAINTEXT_ADDRESS_JSON_KEY,
5757
S2A_PLAINTEXT_ADDRESS,
58-
S2A.S2A_MTLS_ADDRESS_JSON_KEY,
58+
SecureSessionAgent.S2A_MTLS_ADDRESS_JSON_KEY,
5959
S2A_MTLS_ADDRESS));
6060
transportFactory.transport.setRequestStatusCode(HttpStatusCodes.STATUS_CODE_OK);
6161

62-
S2A s2aUtils = S2A.newBuilder().setHttpTransportFactory(transportFactory).build();
63-
String plaintextS2AAddress = s2aUtils.getPlaintextS2AAddress();
64-
String mtlsS2AAddress = s2aUtils.getMtlsS2AAddress();
62+
SecureSessionAgent s2aUtils =
63+
SecureSessionAgent.newBuilder().setHttpTransportFactory(transportFactory).build();
64+
SecureSessionAgentConfig config = s2aUtils.getConfig();
65+
String plaintextS2AAddress = config.getPlaintextAddress();
66+
String mtlsS2AAddress = config.getMtlsAddress();
6567
assertEquals(S2A_PLAINTEXT_ADDRESS, plaintextS2AAddress);
6668
assertEquals(S2A_MTLS_ADDRESS, mtlsS2AAddress);
6769
}
@@ -71,16 +73,18 @@ public void getS2AAddress_queryEndpointResponseErrorCode_emptyAddress() {
7173
MockMetadataServerTransportFactory transportFactory = new MockMetadataServerTransportFactory();
7274
transportFactory.transport.setS2AContentMap(
7375
ImmutableMap.of(
74-
S2A.S2A_PLAINTEXT_ADDRESS_JSON_KEY,
76+
SecureSessionAgent.S2A_PLAINTEXT_ADDRESS_JSON_KEY,
7577
S2A_PLAINTEXT_ADDRESS,
76-
S2A.S2A_MTLS_ADDRESS_JSON_KEY,
78+
SecureSessionAgent.S2A_MTLS_ADDRESS_JSON_KEY,
7779
S2A_MTLS_ADDRESS));
7880
transportFactory.transport.setRequestStatusCode(
7981
HttpStatusCodes.STATUS_CODE_SERVICE_UNAVAILABLE);
8082

81-
S2A s2aUtils = S2A.newBuilder().setHttpTransportFactory(transportFactory).build();
82-
String plaintextS2AAddress = s2aUtils.getPlaintextS2AAddress();
83-
String mtlsS2AAddress = s2aUtils.getMtlsS2AAddress();
83+
SecureSessionAgent s2aUtils =
84+
SecureSessionAgent.newBuilder().setHttpTransportFactory(transportFactory).build();
85+
SecureSessionAgentConfig config = s2aUtils.getConfig();
86+
String plaintextS2AAddress = config.getPlaintextAddress();
87+
String mtlsS2AAddress = config.getMtlsAddress();
8488
assertTrue(plaintextS2AAddress.isEmpty());
8589
assertTrue(mtlsS2AAddress.isEmpty());
8690
}
@@ -90,16 +94,18 @@ public void getS2AAddress_queryEndpointResponseEmpty_emptyAddress() {
9094
MockMetadataServerTransportFactory transportFactory = new MockMetadataServerTransportFactory();
9195
transportFactory.transport.setS2AContentMap(
9296
ImmutableMap.of(
93-
S2A.S2A_PLAINTEXT_ADDRESS_JSON_KEY,
97+
SecureSessionAgent.S2A_PLAINTEXT_ADDRESS_JSON_KEY,
9498
S2A_PLAINTEXT_ADDRESS,
95-
S2A.S2A_MTLS_ADDRESS_JSON_KEY,
99+
SecureSessionAgent.S2A_MTLS_ADDRESS_JSON_KEY,
96100
S2A_MTLS_ADDRESS));
97101
transportFactory.transport.setRequestStatusCode(HttpStatusCodes.STATUS_CODE_OK);
98102
transportFactory.transport.setEmptyContent(true);
99103

100-
S2A s2aUtils = S2A.newBuilder().setHttpTransportFactory(transportFactory).build();
101-
String plaintextS2AAddress = s2aUtils.getPlaintextS2AAddress();
102-
String mtlsS2AAddress = s2aUtils.getMtlsS2AAddress();
104+
SecureSessionAgent s2aUtils =
105+
SecureSessionAgent.newBuilder().setHttpTransportFactory(transportFactory).build();
106+
SecureSessionAgentConfig config = s2aUtils.getConfig();
107+
String plaintextS2AAddress = config.getPlaintextAddress();
108+
String mtlsS2AAddress = config.getMtlsAddress();
103109
assertTrue(plaintextS2AAddress.isEmpty());
104110
assertTrue(mtlsS2AAddress.isEmpty());
105111
}
@@ -111,13 +117,15 @@ public void getS2AAddress_queryEndpointResponseInvalidPlaintextJsonKey_plaintext
111117
ImmutableMap.of(
112118
INVALID_JSON_KEY,
113119
S2A_PLAINTEXT_ADDRESS,
114-
S2A.S2A_MTLS_ADDRESS_JSON_KEY,
120+
SecureSessionAgent.S2A_MTLS_ADDRESS_JSON_KEY,
115121
S2A_MTLS_ADDRESS));
116122
transportFactory.transport.setRequestStatusCode(HttpStatusCodes.STATUS_CODE_OK);
117123

118-
S2A s2aUtils = S2A.newBuilder().setHttpTransportFactory(transportFactory).build();
119-
String plaintextS2AAddress = s2aUtils.getPlaintextS2AAddress();
120-
String mtlsS2AAddress = s2aUtils.getMtlsS2AAddress();
124+
SecureSessionAgent s2aUtils =
125+
SecureSessionAgent.newBuilder().setHttpTransportFactory(transportFactory).build();
126+
SecureSessionAgentConfig config = s2aUtils.getConfig();
127+
String plaintextS2AAddress = config.getPlaintextAddress();
128+
String mtlsS2AAddress = config.getMtlsAddress();
121129
assertTrue(plaintextS2AAddress.isEmpty());
122130
assertEquals(S2A_MTLS_ADDRESS, mtlsS2AAddress);
123131
}
@@ -127,15 +135,17 @@ public void getS2AAddress_queryEndpointResponseInvalidMtlsJsonKey_mtlsEmptyAddre
127135
MockMetadataServerTransportFactory transportFactory = new MockMetadataServerTransportFactory();
128136
transportFactory.transport.setS2AContentMap(
129137
ImmutableMap.of(
130-
S2A.S2A_PLAINTEXT_ADDRESS_JSON_KEY,
138+
SecureSessionAgent.S2A_PLAINTEXT_ADDRESS_JSON_KEY,
131139
S2A_PLAINTEXT_ADDRESS,
132140
INVALID_JSON_KEY,
133141
S2A_MTLS_ADDRESS));
134142
transportFactory.transport.setRequestStatusCode(HttpStatusCodes.STATUS_CODE_OK);
135143

136-
S2A s2aUtils = S2A.newBuilder().setHttpTransportFactory(transportFactory).build();
137-
String plaintextS2AAddress = s2aUtils.getPlaintextS2AAddress();
138-
String mtlsS2AAddress = s2aUtils.getMtlsS2AAddress();
144+
SecureSessionAgent s2aUtils =
145+
SecureSessionAgent.newBuilder().setHttpTransportFactory(transportFactory).build();
146+
SecureSessionAgentConfig config = s2aUtils.getConfig();
147+
String plaintextS2AAddress = config.getPlaintextAddress();
148+
String mtlsS2AAddress = config.getMtlsAddress();
139149
assertEquals(S2A_PLAINTEXT_ADDRESS, plaintextS2AAddress);
140150
assertTrue(mtlsS2AAddress.isEmpty());
141151
}

0 commit comments

Comments
 (0)
Please sign in to comment.