Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: add AIP 4120 - Universe Domain support #1282
base: master
Are you sure you want to change the base?
feat: add AIP 4120 - Universe Domain support #1282
Changes from 3 commits
0053245
856fa58
665af2c
e2ea58b
8202ff4
24c3fd8
File filter
Filter by extension
Conversations
Jump to
There are no files selected for viewing
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Since this is a specification, could we just say "If the universe domain is not GDU, only self-signed JWT tokens may be used for authentication via bearer token when using service account key credentials."
And discard all the stuff that might change over the next few months/years like how the library works in GDU?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The
useJwtWithScope
option is already documented in https://google.aip.dev/auth/4111, so I think it's appropriate to have it as part of this spec as well.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Heads up: this has turned out to be a bit of a problem -- because "MDS" doesn't much have a specification we can refer to, customers have implemented "MDS" clones that don't match our expectations.
Beyond the scope of this AIP, but is there a way we can mitigate that problem without requiring changes to MDS clones or our libraries? Maybe a trusted parameter or environment variable available to auth libraries to fix the universe domain.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
By accepting 404s to be
googleapis.com
, we should be handling all edgecases where other MDSs don't behave as expected (see line 66)There's a potential for accepting a timeout as
googleapis.com
in the event that the library has already confirmed that it's running on MDS. But this is a temporary fix, and has not been accepted in the spec yet, so I think it's best to leave it out.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Who tests that the fetched credential universe matches the user-specified universe domain in the client lib and prevents mismatches?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This validation happens in the client libraries
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is there a reference for what changes outside and what doesn't that we can refer to?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There is no canonical list that I am aware of. I believe this is because "scopes" is currently the only value of
googleapis.com
that is allowed outside GDU - everything else should change based on the universe.