Skip to content
This repository was archived by the owner on May 12, 2026. It is now read-only.

feat: Add TrustBoundaries support for ExternalAccounts.#1836

Merged
vverman merged 19 commits into
googleapis:feat-tb-safrom
vverman:feat/trust-boundary-external-account
Nov 11, 2025
Merged

feat: Add TrustBoundaries support for ExternalAccounts.#1836
vverman merged 19 commits into
googleapis:feat-tb-safrom
vverman:feat/trust-boundary-external-account

Conversation

@vverman
Copy link
Copy Markdown
Contributor

@vverman vverman commented Oct 27, 2025

Added logic and unit tests for trust boundary for external accounts. This PR covers

  1. Workload authentication.
  2. Workforce authentication. (headful and headless)
  3. Service account impersonation for workloads and workforces.

This PR is a followup of the initial PR for Trust Boundaries for Service accounts.

vverman added 10 commits October 24, 2025 13:15
@vverman
Initial Changes for trust boundary structure without TB enabled check…
d305b2f 
… and header value.

# Conflicts:
#	oauth2_http/java/com/google/auth/oauth2/ComputeEngineCredentials.java
#	oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java
#	oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java

# Conflicts:
#	oauth2_http/java/com/google/auth/oauth2/ComputeEngineCredentials.java
#	oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java
#	oauth2_http/java/com/google/auth/oauth2/ImpersonatedCredentials.java
#	oauth2_http/java/com/google/auth/oauth2/OAuth2Credentials.java
#	oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java
#	oauth2_http/java/com/google/auth/oauth2/TrustBoundary.java
@vverman
Added changes to authenticate TB endpoint, add correct TB headers.
c17e26d
@vverman
Added unit tests for Trust Boundary for Service accounts. Updated. th…
2b486bd 
…e trust boundary enabler env variable
@vverman
Formatting changes
63f508b
@vverman
Trust Boundary Recovery
5bddb2f
@vverman
Changed key for encodedLocations and changed tests.
9fb3547
@vverman
minor fixes
dab6d3b
@vverman
External Account Initial Changes.
d58147c
@vverman
Added tests for all excepting ExternalAccountCredentials.
283d8b5
@vverman
Added tests for ExternalAccountCredentials trust boundary. Added comm…
b4e5199 
…ents regarding a separate mock for trust boundary.
@vverman vverman requested review from a team October 27, 2025 18:13
@product-auto-label product-auto-label Bot added the size: l Pull request size is large. label Oct 27, 2025
@vverman vverman force-pushed the feat/trust-boundary-external-account branch from fb18c0c to 458bad4 Compare October 27, 2025 23:24
@vverman vverman self-assigned this Oct 29, 2025
@vverman vverman requested review from lqiu96 and nbayati October 29, 2025 17:57
@vverman vverman added the do not merge Indicates a pull request not ready for merge, due to either quality or timing. label Oct 29, 2025
nbayati
nbayati reviewed Oct 30, 2025
View reviewed changes
Comment thread oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java Outdated
Comment thread oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java Outdated
Comment thread oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java Outdated
Comment thread oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java Outdated
@vverman vverman requested a review from nbayati October 30, 2025 22:11
nbayati
nbayati reviewed Oct 30, 2025
View reviewed changes
Comment thread oauth2_http/javatests/com/google/auth/TestUtils.java Outdated
Comment thread oauth2_http/javatests/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentialsTest.java Outdated
Comment thread oauth2_http/javatests/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentialsTest.java Outdated
Comment thread oauth2_http/javatests/com/google/auth/oauth2/MockTokenServerTransport.java Outdated
Comment thread oauth2_http/javatests/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentialsTest.java Outdated
Comment thread oauth2_http/javatests/com/google/auth/oauth2/ExternalAccountCredentialsTest.java Outdated
lqiu96
lqiu96 reviewed Oct 31, 2025
View reviewed changes
Comment thread oauth2_http/java/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentials.java Outdated
lqiu96
lqiu96 reviewed Oct 31, 2025
View reviewed changes
Comment thread oauth2_http/java/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentials.java Outdated
lqiu96
lqiu96 reviewed Oct 31, 2025
View reviewed changes
Comment thread oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java Outdated
lqiu96
lqiu96 reviewed Oct 31, 2025
View reviewed changes
Comment thread oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java Outdated
lqiu96
lqiu96 reviewed Oct 31, 2025
View reviewed changes
Comment thread oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java Outdated
lqiu96
lqiu96 reviewed Oct 31, 2025
View reviewed changes
Comment thread oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java
@vverman vverman requested a review from lqiu96 October 31, 2025 21:21
lqiu96
lqiu96 reviewed Nov 3, 2025
View reviewed changes
Comment thread oauth2_http/java/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentials.java Outdated
lqiu96
lqiu96 reviewed Nov 3, 2025
View reviewed changes
Comment thread oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java Outdated
@lqiu96
Copy link
Copy Markdown
Member

lqiu96 commented Nov 3, 2025

I think things generally LGTM. I will do a second pass for the tests below.

nbayati
nbayati reviewed Nov 3, 2025
View reviewed changes
Comment thread oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java Outdated
nbayati
nbayati approved these changes Nov 3, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@nbayati nbayati left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Great job! :)

@product-auto-label product-auto-label Bot added size: xl Pull request size is extra large. and removed size: l Pull request size is large. labels Nov 4, 2025
@vverman vverman force-pushed the feat/trust-boundary-external-account branch from 01eb20d to 2071071 Compare November 4, 2025 06:31
@product-auto-label product-auto-label Bot added size: l Pull request size is large. and removed size: xl Pull request size is extra large. labels Nov 4, 2025
@vverman vverman requested a review from lqiu96 November 4, 2025 19:00
lqiu96
lqiu96 reviewed Nov 5, 2025
View reviewed changes
Comment thread oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java Outdated
lqiu96
lqiu96 reviewed Nov 5, 2025
View reviewed changes
Comment thread oauth2_http/javatests/com/google/auth/oauth2/AwsCredentialsTest.java Outdated
lqiu96
lqiu96 reviewed Nov 5, 2025
View reviewed changes
Comment thread oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java
lqiu96
lqiu96 reviewed Nov 5, 2025
View reviewed changes
Comment thread oauth2_http/java/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentials.java Outdated
lqiu96
lqiu96 approved these changes Nov 5, 2025
View reviewed changes
Copy link
Copy Markdown
Member

@lqiu96 lqiu96 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. I added a few nits that may need additional code changes (feel free to resolve if it's not possible). I can re-approve afterwards.

@vverman vverman removed the do not merge Indicates a pull request not ready for merge, due to either quality or timing. label Nov 11, 2025
@vverman vverman merged commit 4b2bdf8 into googleapis:feat-tb-sa Nov 11, 2025
18 checks passed
@vverman vverman deleted the feat/trust-boundary-external-account branch January 20, 2026 16:41
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

2 more reviewers

@lqiu96 lqiu96 lqiu96 approved these changes

@nbayati nbayati nbayati approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@vverman vverman

Labels

size: l Pull request size is large.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@vverman @lqiu96 @nbayati