Skip to content

feat: Regional access boundaries #12766

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
vverman wants to merge 2 commits into
base: main
Choose a base branch
from
Open

feat: Regional access boundaries #12766

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0044eca
Regional Access Boundaries
vverman Apr 10, 2026
93bb045
Switched to executor and removed env variable
vverman Apr 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3,373 changes: 3,373 additions & 0 deletions changes.diff
View file
Open in desktop

Large diffs are not rendered by default.

16 changes: 14 additions & 2 deletions ...e-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ComputeEngineCredentials.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@
import com.google.api.client.http.HttpStatusCodes;
import com.google.api.client.json.JsonObjectParser;
import com.google.api.client.util.GenericData;
import com.google.api.core.InternalApi;
import com.google.auth.CredentialTypeForMetrics;
import com.google.auth.Credentials;
import com.google.auth.Retryable;
Expand Down Expand Up @@ -80,7 +81,7 @@
* <p>These credentials use the IAM API to sign data. See {@link #sign(byte[])} for more details.
*/
public class ComputeEngineCredentials extends GoogleCredentials
implements ServiceAccountSigner, IdTokenProvider {
implements ServiceAccountSigner, IdTokenProvider, RegionalAccessBoundaryProvider {

static final String METADATA_RESPONSE_EMPTY_CONTENT_ERROR_MESSAGE =
"Empty content from metadata token server request.";
Expand Down Expand Up @@ -454,7 +455,6 @@ public AccessToken refreshAccessToken() throws IOException {
int expiresInSeconds =
OAuth2Utils.validateInt32(responseData, "expires_in", PARSE_ERROR_PREFIX);
long expiresAtMilliseconds = clock.currentTimeMillis() + expiresInSeconds * 1000;

return new AccessToken(accessToken, new Date(expiresAtMilliseconds));
}

Expand Down Expand Up @@ -779,6 +779,11 @@ public static Builder newBuilder() {
*
* @throws RuntimeException if the default service account cannot be read
*/
@Override
HttpTransportFactory getTransportFactory() {
return transportFactory;
}

@Override
// todo(#314) getAccount should not throw a RuntimeException
public String getAccount() {
Expand All @@ -792,6 +797,13 @@ public String getAccount() {
return principal;
}

@InternalApi
@Override
public String getRegionalAccessBoundaryUrl() throws IOException {
return String.format(
OAuth2Utils.IAM_CREDENTIALS_ALLOWED_LOCATIONS_URL_FORMAT_SERVICE_ACCOUNT, getAccount());
}

/**
* Signs the provided bytes using the private key associated with the service account.
*
Expand Down
25 changes: 24 additions & 1 deletion ...ava/oauth2_http/java/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentials.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,9 @@

package com.google.auth.oauth2;

import static com.google.auth.oauth2.OAuth2Utils.IAM_CREDENTIALS_ALLOWED_LOCATIONS_URL_FORMAT_WORKFORCE_POOL;
import static com.google.auth.oauth2.OAuth2Utils.JSON_FACTORY;
import static com.google.auth.oauth2.OAuth2Utils.WORKFORCE_AUDIENCE_PATTERN;

import com.google.api.client.http.GenericUrl;
import com.google.api.client.http.HttpHeaders;
Expand All @@ -43,6 +45,7 @@
import com.google.api.client.json.JsonObjectParser;
import com.google.api.client.util.GenericData;
import com.google.api.client.util.Preconditions;
import com.google.api.core.InternalApi;
import com.google.auth.http.HttpTransportFactory;
import com.google.common.base.MoreObjects;
import com.google.common.io.BaseEncoding;
Expand All @@ -54,6 +57,7 @@
import java.util.Date;
import java.util.Map;
import java.util.Objects;
import java.util.regex.Matcher;
import javax.annotation.Nullable;

/**
Expand All @@ -74,7 +78,8 @@
* }
* </pre>
*/
public class ExternalAccountAuthorizedUserCredentials extends GoogleCredentials {
public class ExternalAccountAuthorizedUserCredentials extends GoogleCredentials
implements RegionalAccessBoundaryProvider {
private static final LoggerProvider LOGGER_PROVIDER =
LoggerProvider.forClazz(ExternalAccountAuthorizedUserCredentials.class);

Expand Down Expand Up @@ -229,6 +234,24 @@ public AccessToken refreshAccessToken() throws IOException {
.build();
}

@InternalApi
@Override
public String getRegionalAccessBoundaryUrl() throws IOException {
Matcher matcher = WORKFORCE_AUDIENCE_PATTERN.matcher(getAudience());
if (!matcher.matches()) {
throw new IllegalStateException(
"The provided audience is not in the correct format for a workforce pool. "
+ "Refer: https://docs.cloud.google.com/iam/docs/principal-identifiers");
}
String poolId = matcher.group("pool");
return String.format(IAM_CREDENTIALS_ALLOWED_LOCATIONS_URL_FORMAT_WORKFORCE_POOL, poolId);
}

@Override
HttpTransportFactory getTransportFactory() {
return transportFactory;
}

@Nullable
public String getAudience() {
return audience;
Expand Down
26 changes: 26 additions & 0 deletions ...oauth2_http/java/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentials.java.rej
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
diff a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentials.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountAuthorizedUserCredentials.java (rejected hunks)
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist bot Apr 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The pull request contains several .rej files (e.g., ExternalAccountAuthorizedUserCredentials.java.rej, ExternalAccountCredentials.java.rej, etc.). These files are typically generated when a patch fails to apply cleanly and should not be committed to the repository. Please remove all .rej files from the PR.

@@ -31,7 +31,9 @@

package com.google.auth.oauth2;

+import static com.google.auth.oauth2.OAuth2Utils.IAM_CREDENTIALS_ALLOWED_LOCATIONS_URL_FORMAT_WORKFORCE_POOL;
import static com.google.auth.oauth2.OAuth2Utils.JSON_FACTORY;
+import static com.google.auth.oauth2.OAuth2Utils.WORKFORCE_AUDIENCE_PATTERN;
import static com.google.common.base.Preconditions.checkNotNull;

import com.google.api.client.http.GenericUrl;
@@ -75,12 +79,12 @@
* }
* </pre>
*/
-public class ExternalAccountAuthorizedUserCredentials extends GoogleCredentials {
+public class ExternalAccountAuthorizedUserCredentials extends GoogleCredentials
+ implements RegionalAccessBoundaryProvider {

private static final String PARSE_ERROR_PREFIX = "Error parsing token refresh response. ";

private static final long serialVersionUID = -2181779590486283287L;
-
private final String transportFactoryClassName;
private final String audience;
private final String tokenUrl;
42 changes: 41 additions & 1 deletion ...auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,8 @@

package com.google.auth.oauth2;

import static com.google.auth.oauth2.OAuth2Utils.WORKFORCE_AUDIENCE_PATTERN;
import static com.google.auth.oauth2.OAuth2Utils.WORKLOAD_AUDIENCE_PATTERN;
import static com.google.common.base.Preconditions.checkNotNull;

import com.google.api.client.http.HttpHeaders;
Expand All @@ -55,6 +57,7 @@
import java.util.Locale;
import java.util.Map;
import java.util.concurrent.Executor;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import javax.annotation.Nullable;

Expand All @@ -64,7 +67,8 @@
* <p>Handles initializing external credentials, calls to the Security Token Service, and service
* account impersonation.
*/
public abstract class ExternalAccountCredentials extends GoogleCredentials {
public abstract class ExternalAccountCredentials extends GoogleCredentials
implements RegionalAccessBoundaryProvider {

private static final long serialVersionUID = 8049126194174465023L;

Expand Down Expand Up @@ -581,6 +585,11 @@ protected AccessToken exchangeExternalCredentialForAccessToken(
*/
public abstract String retrieveSubjectToken() throws IOException;

@Override
HttpTransportFactory getTransportFactory() {
return transportFactory;
}

public String getAudience() {
return audience;
}
Expand Down Expand Up @@ -624,6 +633,37 @@ public String getServiceAccountEmail() {
return ImpersonatedCredentials.extractTargetPrincipal(serviceAccountImpersonationUrl);
}

@InternalApi
@Override
public String getRegionalAccessBoundaryUrl() throws IOException {
if (getServiceAccountEmail() != null) {
return String.format(
OAuth2Utils.IAM_CREDENTIALS_ALLOWED_LOCATIONS_URL_FORMAT_SERVICE_ACCOUNT,
getServiceAccountEmail());
}

Matcher workforceMatcher = WORKFORCE_AUDIENCE_PATTERN.matcher(getAudience());
if (workforceMatcher.matches()) {
String poolId = workforceMatcher.group("pool");
return String.format(
OAuth2Utils.IAM_CREDENTIALS_ALLOWED_LOCATIONS_URL_FORMAT_WORKFORCE_POOL, poolId);
}

Matcher workloadMatcher = WORKLOAD_AUDIENCE_PATTERN.matcher(getAudience());
if (workloadMatcher.matches()) {
String projectNumber = workloadMatcher.group("project");
String poolId = workloadMatcher.group("pool");
return String.format(
OAuth2Utils.IAM_CREDENTIALS_ALLOWED_LOCATIONS_URL_FORMAT_WORKLOAD_POOL,
projectNumber,
poolId);
}

throw new IllegalStateException(
"The provided audience is not in a valid format for either a workload identity pool or a workforce pool."
+ " Refer: https://docs.cloud.google.com/iam/docs/principal-identifiers");
}

@Nullable
public String getClientId() {
return clientId;
Expand Down
17 changes: 17 additions & 0 deletions ...-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java.rej
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
diff a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java (rejected hunks)
@@ -31,12 +31,15 @@

package com.google.auth.oauth2;

+import static com.google.auth.oauth2.OAuth2Utils.WORKFORCE_AUDIENCE_PATTERN;
+import static com.google.auth.oauth2.OAuth2Utils.WORKLOAD_AUDIENCE_PATTERN;
import static com.google.common.base.Preconditions.checkNotNull;

import com.google.api.client.http.HttpHeaders;
import com.google.api.client.json.GenericJson;
import com.google.api.client.json.JsonObjectParser;
import com.google.api.client.util.Data;
+import com.google.api.core.InternalApi;
import com.google.auth.RequestMetadataCallback;
import com.google.auth.http.HttpTransportFactory;
import com.google.common.base.MoreObjects;
Loading
Loading