{{ message }}
Repository navigation
impersonate: build the IAM and OAuth2 URLs from the universe domain impersonate: use the universe domain for the default audience too impersonate: assert the request host in the token source tests - #3741
Open
rootkiller6788 wants to merge 3 commits into
Open
rootkiller6788 wants to merge 3 commits into
rootkiller6788 wants to merge 3 commits into
Conversation
The iamcredentials and oauth2 hosts were baked in as package vars, so option.WithUniverseDomain had no effect on them and impersonation always went to googleapis.com. Turn them into helpers that take the universe domain and thread it through the token sources. The DWD flow only runs in the Google universe (it errors out otherwise), but it gets the same treatment so there is one place that decides hosts.
The base credentials get their default audience from this package, and it was hardcoded to googleapis.com as well. Point it at the same universe as the endpoint we call, otherwise the base token is not usable there.
Both tests used a fake transport that ignored the URL, so a wrong host went unnoticed. Record the host and check it, with a case for a custom universe domain.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #3739.
The iamcredentials and oauth2 hosts were package vars, so option.WithUniverseDomain (and GOOGLE_CLOUD_UNIVERSE_DOMAIN) never reached them and impersonation always went to googleapis.com. I hit this pointing impersonation at a non-GDU universe.
What I did: replaced the two vars with helpers that take the universe domain, read it once from the client options, and threaded it through the access token, ID token and DWD token sources. The default audience the base credentials get pointed at googleapis.com as well, so that now uses the same universe - otherwise the base token would not be accepted where we send the request.
For the Google universe the endpoint strings come out identical to before, so nothing changes there.
On the tests: both token source tests used a fake transport that ignored the URL, which is why this slipped through. They now record the request host and check it, with a case for a custom universe domain. I verified they fail if I hardcode the host back.