decouple mTLS endpoint selection and certificate availability checks per AIP-4114, removing fail-fast exceptions when client certificates are unavailable under always policy.

Author: vverman

google-auth-library-java/oauth2_http/java/com/google/auth/mtls/MtlsUtils.java

@@ -173,28 +173,47 @@ public static boolean canBeEnabled(
 
     // Check if client certificate usage is allowed
     String useClientCertificate = envProvider.getEnv("GOOGLE_API_USE_CLIENT_CERTIFICATE");
-    MtlsEndpointUsagePolicy policy = getMtlsEndpointUsagePolicy(envProvider);
     if ("false".equalsIgnoreCase(useClientCertificate)) {
-      if (policy == MtlsEndpointUsagePolicy.ALWAYS) {
-        throw new CertificateSourceUnavailableException(
-            "mTLS is configured to ALWAYS, but client certificate usage was explicitly disabled via GOOGLE_API_USE_CLIENT_CERTIFICATE=false.");
-      }
       return false;
     }
 
+    MtlsEndpointUsagePolicy policy = getMtlsEndpointUsagePolicy(envProvider);
     if (policy == MtlsEndpointUsagePolicy.NEVER) {
       return false;
     }
 
-    if (policy == MtlsEndpointUsagePolicy.ALWAYS) {
-      return true;
-    }
-
     File certConfigFile =
         resolveCertificateConfigFile(envProvider, propProvider, certConfigPathOverride);
     return certConfigFile != null;
   }
 
+  /**
+   * Returns whether the mutual TLS (mTLS) endpoint should be used.
+   *
+   * @param envProvider the environment provider to use for resolving environment variables
+   * @param propProvider the property provider to use for resolving system properties
+   * @param certConfigPathOverride optional override path for the configuration file
+   * @return true if the mTLS endpoint should be used, false otherwise
+   */
+  public static boolean shouldMtlsEndpointBeUsed(
+      EnvironmentProvider envProvider,
+      PropertyProvider propProvider,
+      String certConfigPathOverride) {
+    MtlsEndpointUsagePolicy policy = getMtlsEndpointUsagePolicy(envProvider);
+    if (policy == MtlsEndpointUsagePolicy.ALWAYS) {
+      return true;
+    }
+    if (policy == MtlsEndpointUsagePolicy.NEVER) {
+      return false;
+    }
+    // policy is AUTO: use mTLS endpoint if client certificate can be enabled
+    try {
+      return canBeEnabled(envProvider, propProvider, certConfigPathOverride);
+    } catch (IOException e) {
+      return false;
+    }
+  }
+
   /**
    * Resolves the mutual TLS (mTLS) certificate configuration file.
    *
@@ -313,7 +332,6 @@ public static HttpTransportFactory prepareTransportFactoryIfMtlsEnabled(
       return baseTransportFactory;
     }
 
-    MtlsEndpointUsagePolicy mtlsPolicy = getMtlsEndpointUsagePolicy(envProvider);
     try {
       // This is the default HttpTransportFactory assigned by credentials.
       // Automatically discover and load client certificates to construct an mTLS factory.
@@ -322,11 +340,10 @@ public static HttpTransportFactory prepareTransportFactoryIfMtlsEnabled(
       KeyStore mtlsKeyStore = x509Provider.getKeyStore();
       return new MtlsHttpTransportFactory(mtlsKeyStore);
     } catch (Exception e) {
-      if (mtlsPolicy == MtlsEndpointUsagePolicy.ALWAYS) {
-        throw new IOException(
-            "mTLS is configured to ALWAYS, but initialization failed: " + e.getMessage(), e);
-      }
-      // Graceful fallback to standard transport if mTLS initialization fails under AUTO policy
+      LOGGER.warning(
+          "mTLS transport factory initialization failed, falling back to non-mTLS transport: "
+              + e.getMessage());
+      // Graceful fallback to standard transport if mTLS initialization fails
       return baseTransportFactory;
     }
   }

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundaryManager.java

@@ -214,8 +214,7 @@ void triggerAsyncRefresh(
               HttpTransportFactory upgradedTransportFactory =
                   MtlsUtils.prepareTransportFactoryIfMtlsEnabled(
                       transportFactory, envProvider, propProvider, null);
-              if (MtlsUtils.canBeEnabled(envProvider, propProvider, null)
-                  && upgradedTransportFactory != OAuth2Utils.HTTP_TRANSPORT_FACTORY) {
+              if (MtlsUtils.shouldMtlsEndpointBeUsed(envProvider, propProvider, null)) {
                 url = url.replace(IAM_ENDPOINT, MTLS_IAM_ENDPOINT);
               }
               RegionalAccessBoundary newRAB =

google-auth-library-java/oauth2_http/javatests/com/google/auth/mtls/MtlsUtilsTest.java

@@ -353,7 +353,7 @@ public String getProperty(String name, String def) {
   }
 
   @Test
-  void canBeEnabled_alwaysPolicy_clientCertDisabled_throwsException() {
+  void canBeEnabled_alwaysPolicy_clientCertDisabled_returnsFalse() throws IOException {
     EnvironmentProvider envProvider =
         name -> {
           if ("GOOGLE_API_USE_CLIENT_CERTIFICATE".equals(name)) {
@@ -366,9 +366,8 @@ void canBeEnabled_alwaysPolicy_clientCertDisabled_throwsException() {
         };
     PropertyProvider propProvider = (name, def) -> def;
 
-    assertThrows(
-        CertificateSourceUnavailableException.class,
-        () -> MtlsUtils.canBeEnabled(envProvider, propProvider, null));
+    assertFalse(MtlsUtils.canBeEnabled(envProvider, propProvider, null));
+    assertTrue(MtlsUtils.shouldMtlsEndpointBeUsed(envProvider, propProvider, null));
   }
 
   @Test
@@ -431,12 +430,13 @@ public String getProperty(String name, String def) {
   }
 
   @Test
-  void canBeEnabled_alwaysPolicy_returnsTrue() throws IOException {
+  void canBeEnabled_alwaysPolicy_returnsFalse() throws IOException {
     EnvironmentProvider envProvider =
         name -> "GOOGLE_API_USE_MTLS_ENDPOINT".equals(name) ? "always" : null;
     PropertyProvider propProvider = (name, def) -> def;
 
-    assertTrue(MtlsUtils.canBeEnabled(envProvider, propProvider, null));
+    assertFalse(MtlsUtils.canBeEnabled(envProvider, propProvider, null));
+    assertTrue(MtlsUtils.shouldMtlsEndpointBeUsed(envProvider, propProvider, null));
   }
 
   @Test
@@ -537,6 +537,43 @@ public String getEnv(String name) {
     assertTrue(result instanceof MtlsHttpTransportFactory);
   }
 
+  @Test
+  void
+      prepareTransportFactoryIfMtlsEnabled_defaultFactory_mtlsAlways_clientCertDisabled_returnsAsIs()
+          throws IOException {
+    EnvironmentProvider envProvider =
+        name -> {
+          if ("GOOGLE_API_USE_CLIENT_CERTIFICATE".equals(name)) {
+            return "false";
+          }
+          if ("GOOGLE_API_USE_MTLS_ENDPOINT".equals(name)) {
+            return "always";
+          }
+          return null;
+        };
+    PropertyProvider propProvider = (name, def) -> def;
+
+    HttpTransportFactory result =
+        MtlsUtils.prepareTransportFactoryIfMtlsEnabled(
+            OAuth2Utils.HTTP_TRANSPORT_FACTORY, envProvider, propProvider, null);
+
+    assertSame(OAuth2Utils.HTTP_TRANSPORT_FACTORY, result);
+  }
+
+  @Test
+  void prepareTransportFactoryIfMtlsEnabled_defaultFactory_mtlsAlways_missingConfig_returnsAsIs()
+      throws IOException {
+    EnvironmentProvider envProvider =
+        name -> "GOOGLE_API_USE_MTLS_ENDPOINT".equals(name) ? "always" : null;
+    PropertyProvider propProvider = (name, def) -> def;
+
+    HttpTransportFactory result =
+        MtlsUtils.prepareTransportFactoryIfMtlsEnabled(
+            OAuth2Utils.HTTP_TRANSPORT_FACTORY, envProvider, propProvider, null);
+
+    assertSame(OAuth2Utils.HTTP_TRANSPORT_FACTORY, result);
+  }
+
   @Test
   void prepareTransportFactoryIfMtlsEnabled_defaultFactory_mtlsAuto_noConfig_returnsAsIs()
       throws IOException {