fix(oauth2_http): scope sourceCredentials in ImpersonatedCredentials constructor

Author: lsirac

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ImpersonatedCredentials.java

@@ -106,7 +106,7 @@ public class ImpersonatedCredentials extends GoogleCredentials
   private static final long serialVersionUID = -2133257318957488431L;
   private static final int TWELVE_HOURS_IN_SECONDS = 43200;
   private static final int DEFAULT_LIFETIME_IN_SECONDS = 3600;
-  private GoogleCredentials sourceCredentials;
+  private final GoogleCredentials sourceCredentials;
   private final String targetPrincipal;
   private List<String> delegates;
   private final List<String> scopes;
@@ -533,7 +533,18 @@ public ImpersonatedCredentials createWithCustomCalendar(Calendar calendar) {
 
   private ImpersonatedCredentials(Builder builder) throws IOException {
     super(builder);
-    this.sourceCredentials = builder.getSourceCredentials();
+    GoogleCredentials sourceCredentials = builder.getSourceCredentials();
+    if (sourceCredentials != null
+        && !builder.sourceCredentialsScoped
+        && sourceCredentials.getAccessToken() == null) {
+      // Apply the `CLOUD_PLATFORM_SCOPE` to access the iamcredentials endpoint
+      sourceCredentials =
+          firstNonNull(
+              sourceCredentials.createScoped(
+                  Collections.singletonList(OAuth2Utils.CLOUD_PLATFORM_SCOPE)),
+              sourceCredentials);
+    }
+    this.sourceCredentials = sourceCredentials;
     this.targetPrincipal = builder.getTargetPrincipal();
     this.delegates = builder.getDelegates();
     this.scopes = ImmutableList.copyOf(builder.getScopes());
@@ -580,12 +591,6 @@ public String getUniverseDomain() throws IOException {
 
   @Override
   public AccessToken refreshAccessToken() throws IOException {
-    if (this.sourceCredentials.getAccessToken() == null) {
-      // Apply the `CLOUD_PLATFORM_SCOPE` to access the iamcredentials endpoint
-      this.sourceCredentials =
-          this.sourceCredentials.createScoped(
-              Collections.singletonList(OAuth2Utils.CLOUD_PLATFORM_SCOPE));
-    }
 
     // skip for SA with SSJ flow because it uses self-signed JWT
     // and will get refreshed at initialize request step
@@ -764,6 +769,7 @@ public static Builder newBuilder() {
   public static class Builder extends GoogleCredentials.Builder {
 
     private @Nullable GoogleCredentials sourceCredentials;
+    private boolean sourceCredentialsScoped;
     private @Nullable String targetPrincipal;
     private @Nullable List<String> delegates;
     private @Nullable List<String> scopes;
@@ -789,6 +795,7 @@ protected Builder(GoogleCredentials sourceCredentials, String targetPrincipal) {
     protected Builder(ImpersonatedCredentials credentials) {
       super(credentials);
       this.sourceCredentials = credentials.sourceCredentials;
+      this.sourceCredentialsScoped = true;
       this.targetPrincipal = credentials.targetPrincipal;
       this.delegates = credentials.delegates;
       this.scopes = credentials.scopes;
@@ -800,6 +807,7 @@ protected Builder(ImpersonatedCredentials credentials) {
     @CanIgnoreReturnValue
     public Builder setSourceCredentials(GoogleCredentials sourceCredentials) {
       this.sourceCredentials = sourceCredentials;
+      this.sourceCredentialsScoped = false;
       return this;
     }
 

google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/ImpersonatedCredentialsTest.java

@@ -47,19 +47,23 @@
 import com.google.api.client.http.HttpStatusCodes;
 import com.google.api.client.http.HttpTransport;
 import com.google.api.client.json.GenericJson;
+import com.google.api.client.json.Json;
 import com.google.api.client.json.JsonFactory;
 import com.google.api.client.json.JsonGenerator;
 import com.google.api.client.json.JsonParser;
 import com.google.api.client.json.gson.GsonFactory;
 import com.google.api.client.json.webtoken.JsonWebToken.Payload;
+import com.google.api.client.testing.http.MockHttpTransport;
 import com.google.api.client.testing.http.MockLowLevelHttpRequest;
+import com.google.api.client.testing.http.MockLowLevelHttpResponse;
 import com.google.api.client.util.Clock;
 import com.google.auth.Credentials;
 import com.google.auth.ServiceAccountSigner.SigningException;
 import com.google.auth.TestUtils;
 import com.google.auth.http.HttpTransportFactory;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
+import com.google.common.util.concurrent.Uninterruptibles;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
@@ -70,9 +74,16 @@
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Calendar;
+import java.util.Collection;
 import java.util.Date;
 import java.util.List;
 import java.util.Map;
+import java.util.concurrent.CyclicBarrier;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.Future;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicInteger;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
@@ -1262,6 +1273,75 @@ void refreshAccessToken_afterSerialization_success() throws IOException, ClassNo
     assertEquals(ACCESS_TOKEN, token.getTokenValue());
   }
 
+  @Test
+  void refreshAccessToken_concurrentColdStart_scopesAndRefreshesSourceCredentialsOnce()
+      throws Exception {
+    int numThreads = 16;
+    AtomicInteger createScopedCount = new AtomicInteger(0);
+    AtomicInteger sourceRefreshCount = new AtomicInteger(0);
+
+    GoogleCredentials coldSourceCredentials =
+        new GoogleCredentials() {
+          @Override
+          public GoogleCredentials createScoped(Collection<String> scopes) {
+            createScopedCount.incrementAndGet();
+            return new GoogleCredentials() {
+              @Override
+              public AccessToken refreshAccessToken() {
+                sourceRefreshCount.incrementAndGet();
+                Uninterruptibles.sleepUninterruptibly(50, TimeUnit.MILLISECONDS);
+                return new AccessToken(
+                    "source-token", new Date(System.currentTimeMillis() + 3600_000L));
+              }
+            };
+          }
+        };
+
+    ImpersonatedCredentials impersonatedCredentials =
+        (ImpersonatedCredentials)
+            ImpersonatedCredentials.create(
+                    coldSourceCredentials,
+                    IMPERSONATED_CLIENT_EMAIL,
+                    null,
+                    ImmutableList.of(),
+                    VALID_LIFETIME,
+                    () ->
+                        new MockHttpTransport.Builder()
+                            .setLowLevelHttpResponse(
+                                new MockLowLevelHttpResponse()
+                                    .setContentType(Json.MEDIA_TYPE)
+                                    .setContent(
+                                        String.format(
+                                            "{\"accessToken\":\"%s\",\"expireTime\":\"%s\"}",
+                                            ACCESS_TOKEN, getDefaultExpireTime())))
+                            .build())
+                .createScoped(IMMUTABLE_SCOPES_LIST);
+
+    assertEquals(1, createScopedCount.get());
+
+    CyclicBarrier barrier = new CyclicBarrier(numThreads);
+    ExecutorService executor = Executors.newFixedThreadPool(numThreads);
+    try {
+      List<Future<AccessToken>> futures = new ArrayList<>(numThreads);
+      for (int i = 0; i < numThreads; i++) {
+        futures.add(
+            executor.submit(
+                () -> {
+                  barrier.await(5, TimeUnit.SECONDS);
+                  return impersonatedCredentials.refreshAccessToken();
+                }));
+      }
+      for (Future<AccessToken> future : futures) {
+        assertEquals(ACCESS_TOKEN, future.get(10, TimeUnit.SECONDS).getTokenValue());
+      }
+    } finally {
+      executor.shutdownNow();
+    }
+
+    assertEquals(1, createScopedCount.get());
+    assertEquals(1, sourceRefreshCount.get());
+  }
+
   public static String getDefaultExpireTime() {
     return Instant.now().plusSeconds(VALID_LIFETIME).truncatedTo(ChronoUnit.SECONDS).toString();
   }