feat: Support querying S2A Addresses from MDS

oauth2_http/java/com/google/auth/oauth2/S2A.java

@@ -0,0 +1,110 @@
+package com.google.auth.oauth2;
+
+import com.google.api.client.http.GenericUrl;
+import com.google.api.client.http.HttpRequest;
+import com.google.api.client.http.HttpResponse;
+import com.google.api.client.json.JsonObjectParser;
+import com.google.api.client.util.GenericData;
+import com.google.auth.http.HttpTransportFactory;
+import com.google.common.collect.Iterables;
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.ServiceLoader;
+import javax.annotation.concurrent.ThreadSafe;
+
+/**
+ * Utilities to fetch the S2A (Secure Session Agent) address from the mTLS configuration.
+ *
+ * <p>mTLS configuration is queried from the MDS MTLS Autoconfiguration endpoint.
+ */
+@ThreadSafe
+public final class S2A {
+  public static final String S2A_CONFIG_ENDPOINT_POSTFIX =
+      "/computeMetadata/v1/instance/platform-security/auto-mtls-configuration";
+
+  public static final String METADATA_FLAVOR = "Metadata-Flavor";
+  public static final String GOOGLE = "Google";
+  private static final int MAX_MDS_PING_TRIES = 3;
+  private static final String PARSE_ERROR_S2A = "Error parsing S2A Config from MDS JSON response.";
+
+  private S2AConfig config;
+
+  private transient HttpTransportFactory transportFactory;
+
+  public S2A() {}
+
+  public void setHttpTransportFactory(HttpTransportFactory tf) {
+    this.transportFactory = tf;
+    this.config = getS2AConfigFromMDS();
+  }
+
+  /** @return the mTLS S2A Address from the mTLS config. */
+  public String getMtlsS2AAddress() {
+    return config.getMtlsAddress();
+  }
+
+  /** @return the plaintext S2A Address from the mTLS config. */
+  public String getPlaintextS2AAddress() {
+    return config.getPlaintextAddress();
+  }
+
+  /**
+   * Queries the MDS mTLS Autoconfiguration endpoint and returns the {@link S2AConfig}.
+   *
+   * <p>Returns {@link S2AConfig} with empty addresses on error.
+   *
+   * @return the {@link S2AConfig}.
+   */
+  private S2AConfig getS2AConfigFromMDS() {
+    String url = getMdsMtlsEndpoint();
+    GenericUrl genericUrl = new GenericUrl(url);
+    JsonObjectParser parser = new JsonObjectParser(OAuth2Utils.JSON_FACTORY); 
+    if (transportFactory == null) {
+      transportFactory =
+          Iterables.getFirst(
+              ServiceLoader.load(HttpTransportFactory.class), OAuth2Utils.HTTP_TRANSPORT_FACTORY);
+    }
+
+    HttpRequest request;
+    try {
+      request =
+              transportFactory.create().createRequestFactory().buildGetRequest(genericUrl);
+      request.setParser(parser);
+      request.getHeaders().set(METADATA_FLAVOR, GOOGLE);
+      request.setThrowExceptionOnExecuteError(false);
+    } catch (IOException e) {
+      return S2AConfig.createBuilder().build();
+    }
+
+    for (int i = 0; i < MAX_MDS_PING_TRIES; i++) {
+      String plaintextS2AAddress = "";
+      String mtlsS2AAddress = "";
+      try {
+        HttpResponse response = request.execute();
+        if (!response.isSuccessStatusCode()) {
+          continue;
+        }
+        InputStream content = response.getContent();
+        if (content == null) {
+          continue;
+        }
+        GenericData responseData = response.parseAs(GenericData.class);
+        plaintextS2AAddress =
+            OAuth2Utils.validateString(responseData, "plaintext_address", PARSE_ERROR_S2A);
+        mtlsS2AAddress = OAuth2Utils.validateString(responseData, "mtls_address", PARSE_ERROR_S2A);
+      } catch (IOException e) {
+        continue;
+      }
+      return S2AConfig.createBuilder()
+          .setPlaintextAddress(plaintextS2AAddress)
+          .setMtlsAddress(mtlsS2AAddress)
+          .build();
+    }
+    return S2AConfig.createBuilder().build();
+  }
+
+  /** @return MDS mTLS autoconfig endpoint. */
+  private String getMdsMtlsEndpoint() {
+    return ComputeEngineCredentials.getMetadataServerUrl() + S2A_CONFIG_ENDPOINT_POSTFIX;
+  }
+}

oauth2_http/java/com/google/auth/oauth2/S2AConfig.java

@@ -0,0 +1,58 @@
+package com.google.auth.oauth2;
+
+import com.google.errorprone.annotations.CanIgnoreReturnValue;
+
+/** Holds an mTLS configuration (consists of address of S2A) retrieved from the Metadata Server. */
+public final class S2AConfig {
+  // plaintextAddress is the plaintext address to reach the S2A.
+  private final String plaintextAddress;
+
+  // mtlsAddress is the mTLS address to reach the S2A.
+  private final String mtlsAddress;
+
+  public static Builder createBuilder() {
+    return new Builder();
+  }
+
+  public String getPlaintextAddress() {
+    return plaintextAddress;
+  }
+
+  public String getMtlsAddress() {
+    return mtlsAddress;
+  }
+
+  public static final class Builder {
+    // plaintextAddress is the plaintext address to reach the S2A.
+    private String plaintextAddress;
+
+    // mtlsAddress is the mTLS address to reach the S2A.
+    private String mtlsAddress;
+
+    Builder() {
+      plaintextAddress = "";
+      mtlsAddress = "";
+    }
+
+    @CanIgnoreReturnValue
+    public Builder setPlaintextAddress(String plaintextAddress) {
+      this.plaintextAddress = plaintextAddress;
+      return this;
+    }
+
+    @CanIgnoreReturnValue
+    public Builder setMtlsAddress(String mtlsAddress) {
+      this.mtlsAddress = mtlsAddress;
+      return this;
+    }
+
+    public S2AConfig build() {
+      return new S2AConfig(plaintextAddress, mtlsAddress);
+    }
+  }
+
+  private S2AConfig(String plaintextAddress, String mtlsAddress) {
+    this.plaintextAddress = plaintextAddress;
+    this.mtlsAddress = mtlsAddress;
+  }
+}

oauth2_http/javatests/com/google/auth/oauth2/MockMetadataServerTransport.java

@@ -62,6 +62,12 @@ public class MockMetadataServerTransport extends MockHttpTransport {
 
   private byte[] signature;
 
+  private String plaintextS2AAddress;
+
+  private String mtlsS2AAddress;
+
+  private boolean emptyContent;
+
   public MockMetadataServerTransport() {}
 
   public MockMetadataServerTransport(String accessToken) {
@@ -101,6 +107,18 @@ public void setIdToken(String idToken) {
     this.idToken = idToken;
   }
 
+  public void setPlaintextS2AAddress(String address) {
+    this.plaintextS2AAddress = address;
+  }
+
+  public void setMtlsS2AAddress(String address) {
+    this.mtlsS2AAddress = address;
+  }
+
+  public void setEmptyContent(boolean emptyContent) {
+    this.emptyContent = emptyContent;
+  }
+
   @Override
   public LowLevelHttpRequest buildRequest(String method, String url) throws IOException {
     if (url.startsWith(ComputeEngineCredentials.getTokenServerEncodedUrl())) {
@@ -111,6 +129,8 @@ public LowLevelHttpRequest buildRequest(String method, String url) throws IOExce
       return getMockRequestForSign(url);
     } else if (isIdentityDocumentUrl(url)) {
       return getMockRequestForIdentityDocument(url);
+    } else if (isMtlsConfigRequestUrl(url)) {
+      return getMockRequestForMtlsConfig(url);
     }
     return new MockLowLevelHttpRequest(url) {
       @Override
@@ -260,6 +280,37 @@ public LowLevelHttpResponse execute() throws IOException {
     };
   }
 
+  private MockLowLevelHttpRequest getMockRequestForMtlsConfig(String url) {
+    return new MockLowLevelHttpRequest(url) {
+      @Override
+      public LowLevelHttpResponse execute() throws IOException {
+
+        String metadataRequestHeader = getFirstHeaderValue(S2A.METADATA_FLAVOR);
+        if (!S2A.GOOGLE.equals(metadataRequestHeader)) {
+          throw new IOException("Metadata request header not found");
+        }
+
+        // Create the JSON response
+        GenericJson content = new GenericJson();
+        content.setFactory(OAuth2Utils.JSON_FACTORY);
+        content.put("plaintext_address", plaintextS2AAddress);
+        content.put("mtls_address", mtlsS2AAddress);
+        String contentText = content.toPrettyString();
+
+        MockLowLevelHttpResponse response = new MockLowLevelHttpResponse();
+
+        if (requestStatusCode != null) {
+          response.setStatusCode(requestStatusCode);
+        }
+        if (emptyContent == true) {
+          return response.setZeroContent();
+        }
+        response.setContentType(Json.MEDIA_TYPE).setContent(contentText);
+        return response;
+      }
+    };
+  }
+
   protected boolean isGetServiceAccountsUrl(String url) {
     return url.equals(ComputeEngineCredentials.getServiceAccountsUrl());
   }
@@ -273,4 +324,10 @@ protected boolean isSignRequestUrl(String url) {
   protected boolean isIdentityDocumentUrl(String url) {
     return url.startsWith(String.format(ComputeEngineCredentials.getIdentityDocumentUrl()));
   }
+
+  protected boolean isMtlsConfigRequestUrl(String url) {
+    return plaintextS2AAddress != null
+        && mtlsS2AAddress != null
+        && url.equals(String.format(ComputeEngineCredentials.getMetadataServerUrl() + S2A.S2A_CONFIG_ENDPOINT_POSTFIX));
+  }
 }

oauth2_http/javatests/com/google/auth/oauth2/S2AConfigTest.java

@@ -0,0 +1,33 @@
+package com.google.auth.oauth2;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/** Test cases for {@link S2AConfig}. */
+@RunWith(JUnit4.class)
+public class S2AConfigTest {
+  private static final String S2A_PLAINTEXT_ADDRESS = "plaintext";
+  private static final String S2A_MTLS_ADDRESS = "mtls";
+
+  @Test
+  public void createS2AConfig_success() {
+    S2AConfig config =
+        S2AConfig.createBuilder()
+            .setPlaintextAddress(S2A_PLAINTEXT_ADDRESS)
+            .setMtlsAddress(S2A_MTLS_ADDRESS)
+            .build();
+    assertEquals(S2A_PLAINTEXT_ADDRESS, config.getPlaintextAddress());
+    assertEquals(S2A_MTLS_ADDRESS, config.getMtlsAddress());
+  }
+
+  @Test
+  public void createEmptyS2AConfig_success() {
+    S2AConfig config = S2AConfig.createBuilder().build();
+    assertTrue(config.getPlaintextAddress().isEmpty());
+    assertTrue(config.getMtlsAddress().isEmpty());
+  }
+}

oauth2_http/javatests/com/google/auth/oauth2/S2ATest.java

@@ -0,0 +1,65 @@
+package com.google.auth.oauth2;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+import com.google.api.client.http.HttpStatusCodes;
+import com.google.auth.oauth2.ComputeEngineCredentialsTest.MockMetadataServerTransportFactory;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+/** Test cases for {@link S2A}. */
+@RunWith(JUnit4.class)
+public class S2ATest {
+
+  private static final String S2A_PLAINTEXT_ADDRESS = "plaintext";
+  private static final String S2A_MTLS_ADDRESS = "mtls";
+
+  @Test
+  public void getS2AAddress_validAddress() {
+    MockMetadataServerTransportFactory transportFactory = new MockMetadataServerTransportFactory();
+    transportFactory.transport.setPlaintextS2AAddress(S2A_PLAINTEXT_ADDRESS);
+    transportFactory.transport.setMtlsS2AAddress(S2A_MTLS_ADDRESS);
+    transportFactory.transport.setRequestStatusCode(HttpStatusCodes.STATUS_CODE_OK);
+
+    S2A s2aUtils = new S2A();
+    s2aUtils.setHttpTransportFactory(transportFactory);
+    String plaintextS2AAddress = s2aUtils.getPlaintextS2AAddress();
+    String mtlsS2AAddress = s2aUtils.getMtlsS2AAddress();
+    assertEquals(S2A_PLAINTEXT_ADDRESS, plaintextS2AAddress);
+    assertEquals(S2A_MTLS_ADDRESS, mtlsS2AAddress);
+  }
+
+  @Test
+  public void getS2AAddress_queryEndpointResponseErrorCode_emptyAddress() {
+    MockMetadataServerTransportFactory transportFactory = new MockMetadataServerTransportFactory();
+    transportFactory.transport.setPlaintextS2AAddress(S2A_PLAINTEXT_ADDRESS);
+    transportFactory.transport.setMtlsS2AAddress(S2A_MTLS_ADDRESS);
+    transportFactory.transport.setRequestStatusCode(
+        HttpStatusCodes.STATUS_CODE_SERVICE_UNAVAILABLE);
+
+    S2A s2aUtils = new S2A();
+    s2aUtils.setHttpTransportFactory(transportFactory);
+    String plaintextS2AAddress = s2aUtils.getPlaintextS2AAddress();
+    String mtlsS2AAddress = s2aUtils.getMtlsS2AAddress();
+    assertTrue(plaintextS2AAddress.isEmpty());
+    assertTrue(mtlsS2AAddress.isEmpty());
+  }
+
+  @Test
+  public void getS2AAddress_queryEndpointResponseEmpty_emptyAddress() {
+    MockMetadataServerTransportFactory transportFactory = new MockMetadataServerTransportFactory();
+    transportFactory.transport.setPlaintextS2AAddress(S2A_PLAINTEXT_ADDRESS);
+    transportFactory.transport.setMtlsS2AAddress(S2A_MTLS_ADDRESS);
+    transportFactory.transport.setRequestStatusCode(HttpStatusCodes.STATUS_CODE_OK);
+    transportFactory.transport.setEmptyContent(true);
+
+    S2A s2aUtils = new S2A();
+    s2aUtils.setHttpTransportFactory(transportFactory);
+    String plaintextS2AAddress = s2aUtils.getPlaintextS2AAddress();
+    String mtlsS2AAddress = s2aUtils.getMtlsS2AAddress();
+    assertTrue(plaintextS2AAddress.isEmpty());
+    assertTrue(mtlsS2AAddress.isEmpty());
+  }
+}