Skip to content

feat: Enable Bound Token for Agentic Identities #13873

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
macastelaz wants to merge 19 commits into
base: agentic-identities-bound-token
Choose a base branch
from
Open

feat: Enable Bound Token for Agentic Identities #13873

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
0af6032
Port Agent Identities feature for Cloud Run
vverman Apr 17, 2026
9d5672f
Added support for:
vverman May 8, 2026
a591db4
Added logic to verify key and cert to ensure no mismatch along with r…
vverman May 11, 2026
18afacb
Added documentation and addressed comments.
vverman May 12, 2026
7a2ae21
lint fix.
vverman May 12, 2026
2c1c298
Fix unaddressed comments from PR 13169
macastelaz Jul 22, 2026
0e3d440
Fix incorrect fail-fast logic for custom certificate config paths
macastelaz Jul 22, 2026
c5fab1d
Fix AgentIdentityUtils token binding logic and TOCTOU vulnerabilities
macastelaz Jul 23, 2026
0036d0c
Fix token binding 30s timeout on permission and absent config errors
macastelaz Jul 23, 2026
4d99d25
fix: resolve lint/formatting issues in AgentIdentityUtils
macastelaz Jul 23, 2026
727b596
fix: resolve checkstyle and format violations
macastelaz Jul 23, 2026
bd2f98b
test: add edge case coverage and refactor brittle resource loading
macastelaz Jul 24, 2026
e3d105e
style: fix checkstyle violations in auth utilities
macastelaz Jul 27, 2026
cb71972
Fix AgentIdentityUtilsTest compilation after checkstyle
macastelaz Jul 27, 2026
a4b6192
test: fix missing InputStream import in tests
macastelaz Jul 27, 2026
71cd2c1
Restore EnableAutoValue.txt for AutoValue annotation processor
macastelaz Jul 28, 2026
ea07ce4
Restore accidentally deleted gradle-wrapper.jar
macastelaz Jul 28, 2026
5b1c82b
style: fix formatting violations in oauth2_http
macastelaz Jul 29, 2026
0649e49
docs(oauth2): Make AgentIdentityUtils Javadoc comments proper and ful…
macastelaz Jul 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
700 changes: 700 additions & 0 deletions google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AgentIdentityUtils.java
View file
Open in desktop

Large diffs are not rendered by default.

66 changes: 56 additions & 10 deletions ...e-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ComputeEngineCredentials.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,7 @@
import java.io.ObjectInputStream;
import java.net.SocketTimeoutException;
import java.net.UnknownHostException;
import java.nio.charset.StandardCharsets;
import java.time.Duration;
import java.util.ArrayList;
import java.util.Arrays;
Expand Down Expand Up @@ -320,7 +321,7 @@ public String getUniverseDomain() throws IOException {

private String getUniverseDomainFromMetadata() throws IOException {
HttpResponse response =
getMetadataResponse(getUniverseDomainUrl(), RequestType.UNTRACKED, false);
getMetadataResponse(getUniverseDomainUrl(), "GET", null, RequestType.UNTRACKED, false);
int statusCode = response.getStatusCode();
if (statusCode == HttpStatusCodes.STATUS_CODE_NOT_FOUND) {
return Credentials.GOOGLE_DEFAULT_UNIVERSE;
Expand Down Expand Up @@ -379,7 +380,8 @@ public String getProjectId() {

private String getProjectIdFromMetadata() {
try {
HttpResponse response = getMetadataResponse(getProjectIdUrl(), RequestType.UNTRACKED, false);
HttpResponse response =
getMetadataResponse(getProjectIdUrl(), "GET", null, RequestType.UNTRACKED, false);
int statusCode = response.getStatusCode();
if (statusCode == HttpStatusCodes.STATUS_CODE_NOT_FOUND) {
LoggingUtils.log(
Expand Down Expand Up @@ -421,8 +423,21 @@ private String getProjectIdFromMetadata() {
/** Refresh the access token by getting it from the GCE metadata server */
@Override
public AccessToken refreshAccessToken() throws IOException {
HttpResponse response =
getMetadataResponse(createTokenUrlWithScopes(), RequestType.ACCESS_TOKEN_REQUEST, true);
String tokenUrl = createTokenUrlWithScopes();

String boundTokenPayload = AgentIdentityUtils.getBoundTokenPayload();
HttpResponse response;

if (boundTokenPayload != null) {
java.util.Map<String, String> payload =
Collections.singletonMap("certificate_chain", boundTokenPayload);
String jsonString = OAuth2Utils.JSON_FACTORY.toString(payload);

response =
getMetadataResponse(tokenUrl, "POST", jsonString, RequestType.ACCESS_TOKEN_REQUEST, true);
} else {
response = getMetadataResponse(tokenUrl, "GET", null, RequestType.ACCESS_TOKEN_REQUEST, true);
}
int statusCode = response.getStatusCode();
if (statusCode == HttpStatusCodes.STATUS_CODE_NOT_FOUND) {
throw new IOException(
Expand Down Expand Up @@ -490,8 +505,22 @@ public IdToken idTokenWithAudience(String targetAudience, List<IdTokenProvider.O
}
}
documentUrl.set("audience", targetAudience);
HttpResponse response =
getMetadataResponse(documentUrl.toString(), RequestType.ID_TOKEN_REQUEST, true);
String boundTokenPayload = AgentIdentityUtils.getBoundTokenPayload();
HttpResponse response;

if (boundTokenPayload != null) {
java.util.Map<String, String> payload =
Collections.singletonMap("certificate_chain", boundTokenPayload);
String jsonString = OAuth2Utils.JSON_FACTORY.toString(payload);

response =
getMetadataResponse(
documentUrl.toString(), "POST", jsonString, RequestType.ID_TOKEN_REQUEST, true);
} else {
response =
getMetadataResponse(
documentUrl.toString(), "GET", null, RequestType.ID_TOKEN_REQUEST, true);
}
int statusCode = response.getStatusCode();
if (statusCode == HttpStatusCodes.STATUS_CODE_NOT_FOUND) {
throw new IOException(
Expand Down Expand Up @@ -520,10 +549,26 @@ public IdToken idTokenWithAudience(String targetAudience, List<IdTokenProvider.O
}

private HttpResponse getMetadataResponse(
String url, RequestType requestType, boolean shouldSendMetricsHeader) throws IOException {
String url,
String method,
String jsonContent,
RequestType requestType,
boolean shouldSendMetricsHeader)
throws IOException {
GenericUrl genericUrl = new GenericUrl(url);
HttpRequest request =
transportFactory.create().createRequestFactory().buildGetRequest(genericUrl);
HttpRequest request;
if ("POST".equals(method)) {
com.google.api.client.http.HttpContent content = null;
if (jsonContent != null) {
content =
new com.google.api.client.http.ByteArrayContent(
"application/json", jsonContent.getBytes(StandardCharsets.UTF_8));
}
request =
transportFactory.create().createRequestFactory().buildPostRequest(genericUrl, content);
} else {
request = transportFactory.create().createRequestFactory().buildGetRequest(genericUrl);
}
// Disable automatic logging by google-http-java-client to prevent leakage of sensitive tokens.
// Client Library Debug Logging via LoggingUtils is used instead where appropriate.
request.setLoggingEnabled(false);
Expand Down Expand Up @@ -840,7 +885,8 @@ public byte[] sign(byte[] toSign) {

private String getDefaultServiceAccount() throws IOException {
HttpResponse response =
getMetadataResponse(getDefaultServiceAccountUrl(), RequestType.UNTRACKED, false);
getMetadataResponse(
getDefaultServiceAccountUrl(), "GET", null, RequestType.UNTRACKED, false);
int statusCode = response.getStatusCode();
if (statusCode == HttpStatusCodes.STATUS_CODE_NOT_FOUND) {
throw new IOException(
Expand Down
Loading
Loading