feat(Kotlin SDK): Iap kotlin sdk support (#1684)

This PR adds support for routing API requests through Identity-Aware
Proxy. This is done by putting an OIDC token in the header as
`Proxy-Authorization: Bearer <token>`. The OIDC is generated without
IamCredentialsClient library

To use, users need to provide their `iap_client_id` and
`iap_service_account_email` to the SDK's configuration payload.
```
        Map<String, String> lookerConfig = new HashMap<>();
        lookerConfig.put("base_url", "<Base_Url>");

        lookerConfig.put("kotlin_http_transport", "JAVA_NET");
        lookerConfig.put("client_id", "<Client_ID>");
        lookerConfig.put("client_secret", "<Client_Secret>");
        lookerConfig.put("iap_client_id", "<IAP_Client_ID>");
        lookerConfig.put("iap_service_account_email", "<IAP_Service_Account_Email>);

        ConfigurationProvider settings = ApiSettings.fromMap(lookerConfig);

        Transport transport = new Transport(settings);
        AuthSession session = new AuthSession(settings, transport);

        LookerSDK sdk = new LookerSDK(session);
```

`iap_client_id` is the OAuth client ID that was set-up when configuring
the the identity-aware proxy.
`iap_service_account_email` is the service account that is authorized to
bypass IAP.

---------

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

Release-As: 26.6.3

Author: MitchellGale

kotlin/build.gradle.kts

@@ -36,17 +36,14 @@ dependencies {
     implementation("org.ini4j:ini4j:0.5.4")
 
     implementation("commons-configuration:commons-configuration:1.10")
-
+    implementation("com.google.auth:google-auth-library-oauth2-http:1.23.0")
     implementation(platform("com.google.http-client:google-http-client-bom:$googleHttpVersion"))
     implementation("com.google.http-client:google-http-client")
     implementation("com.google.http-client:google-http-client-apache-v2")
     implementation("com.google.http-client:google-http-client-gson")
 
-    implementation(platform("com.google.cloud:libraries-bom:26.54.0"))
-    implementation("com.google.cloud:google-cloud-iamcredentials")
-
     implementation("org.jetbrains.kotlinx:kotlinx-coroutines-core:1.6.4")
-    implementation("com.google.code.gson:gson:2.8.5")
+    implementation("com.google.code.gson:gson:2.8.9")
 
     testImplementation("org.junit.jupiter:junit-jupiter-api:5.3.1")
     testRuntimeOnly("org.junit.jupiter:junit-jupiter-engine:5.3.1")

kotlin/src/main/com/looker/rtl/AuthSession.kt

@@ -25,10 +25,13 @@
 package com.looker.rtl
 
 import com.google.api.client.http.UrlEncodedContent
-import com.google.cloud.iam.credentials.v1.GenerateIdTokenRequest
-import com.google.cloud.iam.credentials.v1.IamCredentialsClient
-import com.google.cloud.iam.credentials.v1.IamCredentialsSettings
-import com.google.cloud.iam.credentials.v1.ServiceAccountName
+import com.google.auth.oauth2.GoogleCredentials
+import com.google.gson.JsonParser
+import java.net.URI
+import java.net.http.HttpClient
+import java.net.http.HttpRequest
+import java.net.http.HttpResponse
+import java.time.Duration
 import java.time.LocalDateTime
 
 open class AuthSession(
@@ -45,6 +48,7 @@ open class AuthSession(
 
     private var cachedIapToken: String? = null
     private var iapTokenExpiration: LocalDateTime? = null
+    private var isIapConfigured: Boolean? = null
 
     /** Abstraction of AuthToken retrieval to support sudo mode */
     fun activeToken(): AuthToken {
@@ -85,9 +89,21 @@ open class AuthSession(
         return init.copy(headers = headers)
     }
 
+    private val httpClient: HttpClient = HttpClient.newBuilder()
+        .connectTimeout(Duration.ofSeconds(5))
+        .build()
+
+    private val googleCreds by lazy {
+        GoogleCredentials.getApplicationDefault()
+            .createScoped(listOf("https://www.googleapis.com/auth/cloud-platform"))
+    }
+
+    @Synchronized
     fun fetchIapToken(): String? {
+        if (isIapConfigured == false) return null
+
         if (cachedIapToken != null && iapTokenExpiration != null) {
-            if (LocalDateTime.now().isBefore(iapTokenExpiration)) {
+            if (LocalDateTime.now().isBefore(iapTokenExpiration!!.minusMinutes(5))) {
                 return cachedIapToken
             }
         }
@@ -96,31 +112,51 @@ open class AuthSession(
         val audience = config["iap_client_id"]
         val serviceAccount = config["iap_service_account_email"]
 
-        if (audience.isNullOrBlank() || serviceAccount.isNullOrBlank()) return null
+        if (audience.isNullOrBlank() || serviceAccount.isNullOrBlank()) {
+            isIapConfigured = false
+            return null
+        }
+
+        isIapConfigured = true
 
         return try {
-            val settings = IamCredentialsSettings.newBuilder()
-                .setTransportChannelProvider(
-                    IamCredentialsSettings.defaultHttpJsonTransportProviderBuilder().build(),
-                )
+            googleCreds.refreshIfExpired()
+            val accessToken = googleCreds.accessToken?.tokenValue ?: throw RuntimeException("Failed to obtain Google access token")
+
+            val encodedServiceAccount = java.net.URLEncoder.encode(serviceAccount, java.nio.charset.StandardCharsets.UTF_8)
+            val apiUrl = "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/$encodedServiceAccount:generateIdToken"
+
+            val jsonBody = com.google.gson.JsonObject().apply {
+                addProperty("audience", audience)
+                addProperty("includeEmail", true)
+            }.toString()
+
+            val iapRequest = HttpRequest.newBuilder()
+                .uri(URI.create(apiUrl))
+                .header("Authorization", "Bearer $accessToken")
+                .header("Content-Type", "application/json")
+                .timeout(Duration.ofSeconds(5))
+                .POST(HttpRequest.BodyPublishers.ofString(jsonBody))
                 .build()
 
-            IamCredentialsClient.create(settings).use { client ->
-                val request = GenerateIdTokenRequest.newBuilder()
-                    .setName(ServiceAccountName.of("-", serviceAccount).toString())
-                    .setAudience(audience)
-                    .setIncludeEmail(true)
-                    .build()
-                val token = client.generateIdToken(request).token
-                cachedIapToken = token
-                iapTokenExpiration = LocalDateTime.now().plusMinutes(IAP_TOKEN_CACHE_MINUTES)
-                token
+            val iapResponse = httpClient.send(iapRequest, HttpResponse.BodyHandlers.ofString())
+
+            if (iapResponse.statusCode() != 200) {
+                throw RuntimeException("IAM API Error: ${iapResponse.statusCode()} - ${iapResponse.body()}")
             }
+
+            val iapJsonObject = JsonParser.parseString(iapResponse.body()).asJsonObject
+            val token = iapJsonObject.get("token")?.asString
+                ?: throw RuntimeException("Could not find token in IAM JSON response")
+
+            cachedIapToken = token
+            iapTokenExpiration = LocalDateTime.now().plusMinutes(IAP_TOKEN_CACHE_MINUTES)
+            token
         } catch (e: Exception) {
             cachedIapToken = null
             iapTokenExpiration = null
             throw RuntimeException(
-                "OIDC Token failed for IAP. Please check your IAP Client ID and IAP Service Account Email. Underlying Google Cloud error: ${e.message}",
+                "OIDC Token failed for IAP. Ensure your Google credentials are authenticated. Error: ${e.message}",
                 e,
             )
         }