feat(oauth2_http): fail fast on all 4xx client errors during GCE ping

Author: macastelaz

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ComputeEngineCredentials.java

@@ -673,9 +673,11 @@ private static boolean pingComputeEngineMetadata(
       } catch (SocketTimeoutException expected) {
         // Ignore logging timeouts which is the expected failure mode in non GCE environments.
       } catch (IOException e) {
-        if (e instanceof HttpResponseException
-            && ((HttpResponseException) e).getStatusCode() == 403) {
-          return false;
+        if (e instanceof HttpResponseException) {
+          int statusCode = ((HttpResponseException) e).getStatusCode();
+          if (statusCode >= 400 && statusCode < 500) {
+            return false;
+          }
         }
         LOGGER.log(
             Level.FINE,

google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/ComputeEngineCredentialsTest.java

@@ -1178,20 +1178,51 @@ void getProjectId_explicitSet_noMDsCall() {
   }
 
   @Test
-  void isOnGce_forbidden_doesNotRetry() {
+  void isOnGce_clientError_doesNotRetry_returnsFalseOnUnknownOs() {
     MockMetadataServerTransportFactory transportFactory = new MockMetadataServerTransportFactory();
-    transportFactory.transport.setStatusCode(HttpStatusCodes.STATUS_CODE_FORBIDDEN);
-    UnknownOsCredentialsProvider provider = new UnknownOsCredentialsProvider();
+    transportFactory.transport.setStatusCode(HttpStatusCodes.STATUS_CODE_NOT_FOUND);
+    DefaultCredentialsProvider provider = new DefaultCredentialsProvider() {
+      @Override
+      String getEnv(String name) {
+        if (DefaultCredentialsProvider.NO_GCE_CHECK_ENV_VAR.equals(name)) {
+          return "false";
+        }
+        return super.getEnv(name);
+      }
+      @Override
+      String getOsName() {
+        return "Unknown";
+      }
+    };
     boolean isOnGce = ComputeEngineCredentials.isOnGce(transportFactory, provider);
     assertFalse(isOnGce);
     assertEquals(1, transportFactory.transport.getRequestCount());
   }
 
-  static class UnknownOsCredentialsProvider extends DefaultCredentialsProvider {
-    @Override
-    String getOsName() {
-      return "Unknown";
-    }
+  @Test
+  void isOnGce_clientError_doesNotRetry_returnsTrueOnLinuxGce() {
+    MockMetadataServerTransportFactory transportFactory = new MockMetadataServerTransportFactory();
+    transportFactory.transport.setStatusCode(HttpStatusCodes.STATUS_CODE_FORBIDDEN);
+    DefaultCredentialsProvider provider = new DefaultCredentialsProvider() {
+      @Override
+      String getEnv(String name) {
+        if (DefaultCredentialsProvider.NO_GCE_CHECK_ENV_VAR.equals(name)) {
+          return "false";
+        }
+        return super.getEnv(name);
+      }
+      @Override
+      String getOsName() {
+        return "Linux";
+      }
+      @Override
+      java.io.InputStream readStream(java.io.File file) throws java.io.FileNotFoundException {
+        return new java.io.ByteArrayInputStream("Google Compute Engine".getBytes(java.nio.charset.StandardCharsets.UTF_8));
+      }
+    };
+    boolean isOnGce = ComputeEngineCredentials.isOnGce(transportFactory, provider);
+    assertTrue(isOnGce);
+    assertEquals(1, transportFactory.transport.getRequestCount());
   }
 
   static class MockMetadataServerTransportFactory implements HttpTransportFactory {