Skip to content

gcp_authn: fix bound token requests #45838

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tyxia merged 2 commits into from
Jun 26, 2026
+25 −13
Merged

gcp_authn: fix bound token requests #45838

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a440ea2
gcp_authn: fix bound token requests
antoniovleonti Jun 25, 2026
352ca1e
add comment and elide local variable
antoniovleonti Jun 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 9 additions & 3 deletions source/extensions/filters/http/gcp_authn/gcp_authn_client_impl.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ constexpr absl::string_view TokenUrlPath = "token";
constexpr absl::string_view AudienceQueryKey = "audience";
constexpr char MetadataFlavorKey[] = "Metadata-Flavor";
constexpr char MetadataFlavor[] = "Google";
constexpr char ClientCertificateSha256Key[] = "client_certificate_sha256";
constexpr char BindCertificateFingerprintKey[] = "bindCertificateFingerprint";

Http::RequestMessagePtr buildRequest(absl::string_view url) {
absl::string_view host;
Expand Down Expand Up @@ -100,7 +100,10 @@ void GcpAuthnClientImpl::fetchBoundJwt(
const std::string& fingerprint, GcpAuthnClient::Callbacks& callbacks) {
Http::Utility::QueryParamsMulti query_params;
query_params.add(AudienceQueryKey, audience.bound_jwt().url());
query_params.add(ClientCertificateSha256Key, fingerprint);
// N.B.: double-URL-encoding is REQUIRED by the GCP metadata server.
query_params.add(BindCertificateFingerprintKey,
Http::Utility::PercentEncoding::urlEncode(
Http::Utility::PercentEncoding::urlEncode(fingerprint)));
const std::string final_url =
absl::StrCat(DefaultServiceAccountPrefix, IdentityUrlPath, query_params.toString());
makeTokenRequest(TokenType::BoundJwt, audience, final_url, fingerprint, callbacks);
Expand All @@ -110,7 +113,10 @@ void GcpAuthnClientImpl::fetchBoundAccessToken(
const envoy::extensions::filters::http::gcp_authn::v3::Audience& audience,
const std::string& fingerprint, GcpAuthnClient::Callbacks& callbacks) {
Http::Utility::QueryParamsMulti query_params;
query_params.add(ClientCertificateSha256Key, fingerprint);
// N.B.: double-URL-encoding is REQUIRED by the GCP metadata server.
query_params.add(BindCertificateFingerprintKey,
Http::Utility::PercentEncoding::urlEncode(
Http::Utility::PercentEncoding::urlEncode(fingerprint)));
const std::string final_url =
absl::StrCat(DefaultServiceAccountPrefix, TokenUrlPath, query_params.toString());
makeTokenRequest(TokenType::BoundAccessToken, audience, final_url, fingerprint, callbacks);
Expand Down
8 changes: 4 additions & 4 deletions test/extensions/filters/http/gcp_authn/gcp_authn_client_impl_test.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -450,12 +450,12 @@ TEST_F(GcpAuthnClientImplTest, SuccessBoundJwt) {

envoy::extensions::filters::http::gcp_authn::v3::Audience audience;
audience.mutable_bound_jwt()->set_url("http://test_audience");
const std::string fingerprint = "test_fingerprint_value";
const std::string fingerprint = "abc+def/ghi=";
client_->fetchBoundJwt(audience, fingerprint, request_callbacks_);
EXPECT_EQ(message_->headers().Method()->value().getStringView(), "GET");
EXPECT_EQ(message_->headers().Path()->value().getStringView(),
"/computeMetadata/v1/instance/service-accounts/default/identity?audience=http://"
"test_audience&client_certificate_sha256=test_fingerprint_value");
"test_audience&bindCertificateFingerprint=abc%252Bdef%252Fghi%253D");

EXPECT_EQ(options_.retry_policy->num_retries().value(), 5);

Expand All @@ -477,12 +477,12 @@ TEST_F(GcpAuthnClientImplTest, SuccessBoundAccessToken) {

envoy::extensions::filters::http::gcp_authn::v3::Audience audience;
audience.mutable_bound_access_token();
const std::string fingerprint = "test_fingerprint_value";
const std::string fingerprint = "abc+def/ghi=";
client_->fetchBoundAccessToken(audience, fingerprint, request_callbacks_);
EXPECT_EQ(message_->headers().Method()->value().getStringView(), "GET");
EXPECT_EQ(message_->headers().Path()->value().getStringView(),
"/computeMetadata/v1/instance/service-accounts/default/"
"token?client_certificate_sha256=test_fingerprint_value");
"token?bindCertificateFingerprint=abc%252Bdef%252Fghi%253D");

EXPECT_EQ(options_.retry_policy->num_retries().value(), 5);

Expand Down
14 changes: 10 additions & 4 deletions test/extensions/filters/http/gcp_authn/gcp_authn_filter_integration_test.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
#include "envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.pb.h"
#include "envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.pb.validate.h"

#include "source/common/http/utility.h"
#include "source/extensions/filters/http/gcp_authn/gcp_authn_filter.h"

#include "test/integration/http_integration.h"
Expand Down Expand Up @@ -169,7 +170,9 @@ class GcpAuthnFilterIntegrationTest : public testing::TestWithParam<Network::Add

std::string expected_path = absl::StrCat(
"/computeMetadata/v1/instance/service-accounts/default/identity?audience=http://test.com",
"&client_certificate_sha256=", expected_fingerprint);
"&bindCertificateFingerprint=",
Http::Utility::PercentEncoding::urlEncode(
Http::Utility::PercentEncoding::urlEncode(expected_fingerprint)));

// Need to wait for headers complete before reading headers value.
result = request_->waitForHeadersComplete();
Expand Down Expand Up @@ -197,8 +200,9 @@ class GcpAuthnFilterIntegrationTest : public testing::TestWithParam<Network::Add

std::string expected_path =
absl::StrCat("/computeMetadata/v1/instance/service-accounts/default/token"
"?client_certificate_sha256=",
expected_fingerprint);
"?bindCertificateFingerprint=",
Http::Utility::PercentEncoding::urlEncode(
Http::Utility::PercentEncoding::urlEncode(expected_fingerprint)));

// Need to wait for headers complete before reading headers value.
result = request_->waitForHeadersComplete();
Expand Down Expand Up @@ -502,7 +506,9 @@ TEST_P(GcpAuthnFilterIntegrationTest, BoundJwtCacheHit) {

std::string expected_path = absl::StrCat(
"/computeMetadata/v1/instance/service-accounts/default/identity?audience=http://test.com",
"&client_certificate_sha256=", expected_fingerprint);
"&bindCertificateFingerprint=",
Http::Utility::PercentEncoding::urlEncode(
Http::Utility::PercentEncoding::urlEncode(expected_fingerprint)));

result = request_->waitForHeadersComplete();
RELEASE_ASSERT(result, result.message());
Expand Down
4 changes: 2 additions & 2 deletions test/extensions/filters/http/gcp_authn/gcp_authn_filter_test.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -319,7 +319,7 @@ TEST_F(GcpAuthnFilterTest, ResumeFilterChainIterationWithBoundAccessToken) {
ON_CALL(*cluster_info_, metadata()).WillByDefault(testing::ReturnRef(metadata_));

const std::string dummy_pem = "dummy cert PEM";
const std::string expected_fingerprint = "mock_fingerprint_base64";
const std::string expected_fingerprint = "mock+fingerprint/base64=";

auto socket_factory = std::make_unique<NiceMock<Network::MockTransportSocketFactory>>();
auto client_context_config = std::make_unique<NiceMock<Ssl::MockClientContextConfig>>();
Expand Down Expand Up @@ -349,7 +349,7 @@ TEST_F(GcpAuthnFilterTest, ResumeFilterChainIterationWithBoundAccessToken) {
EXPECT_EQ(message_->headers().Method()->value().getStringView(), "GET");
EXPECT_EQ(message_->headers().Path()->value().getStringView(),
"/computeMetadata/v1/instance/service-accounts/default/"
"token?client_certificate_sha256=mock_fingerprint_base64");
"token?bindCertificateFingerprint=mock%252Bfingerprint%252Fbase64%253D");

Envoy::Http::ResponseHeaderMapPtr resp_headers(new Envoy::Http::TestResponseHeaderMapImpl({
{":status", "200"},
Expand Down
Loading