Improves regional access boundary cooldown on task submission failures, adds 3-minute token clock skew buffer, and fixes mTLS fallback logic.

Author: vverman

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java

@@ -56,8 +56,10 @@
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
+import java.util.Locale;
 import java.util.Map;
 import java.util.Objects;
+import java.util.concurrent.Executor;
 import javax.annotation.Nullable;
 
 /** Base type for credentials for authorizing calls to Google APIs using OAuth2. */
@@ -379,7 +381,7 @@ void refreshRegionalAccessBoundaryIfExpired(@Nullable URI uri, @Nullable AccessT
 
     // Skip refresh for regional endpoints.
     if (uri != null && uri.getHost() != null) {
-      String host = uri.getHost().toLowerCase(java.util.Locale.US);
+      String host = uri.getHost().toLowerCase(Locale.US);
       if (host.endsWith(".rep.googleapis.com") || host.endsWith(".rep.sandbox.googleapis.com")) {
         return;
       }
@@ -388,7 +390,7 @@ void refreshRegionalAccessBoundaryIfExpired(@Nullable URI uri, @Nullable AccessT
     // We need a valid access token for the refresh.
     if (token == null
         || (token.getExpirationTimeMillis() != null
-            && token.getExpirationTimeMillis() < clock.currentTimeMillis())) {
+            && token.getExpirationTimeMillis() <= clock.currentTimeMillis() + 180_000L)) {
       return;
     }
 
@@ -466,9 +468,7 @@ public Map<String, List<String>> getRequestMetadata(URI uri) throws IOException
    */
   @Override
   public void getRequestMetadata(
-      final URI uri,
-      final java.util.concurrent.Executor executor,
-      final RequestMetadataCallback callback) {
+      final URI uri, final Executor executor, final RequestMetadataCallback callback) {
     super.getRequestMetadata(
         uri,
         executor,
@@ -556,7 +556,7 @@ Map<String, List<String>> addRegionalAccessBoundaryToRequestMetadata(
     Preconditions.checkNotNull(requestMetadata);
 
     if (uri != null && uri.getHost() != null) {
-      String host = uri.getHost().toLowerCase(java.util.Locale.US);
+      String host = uri.getHost().toLowerCase(Locale.US);
       if (host.endsWith(".rep.googleapis.com") || host.endsWith(".rep.sandbox.googleapis.com")) {
         return requestMetadata;
       }

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundary.java

@@ -185,8 +185,8 @@ static RegionalAccessBoundary refresh(
       throws IOException {
     Preconditions.checkNotNull(accessToken, "The provided access token is null.");
     if (accessToken.getExpirationTimeMillis() != null
-        && accessToken.getExpirationTimeMillis() < clock.currentTimeMillis()) {
-      throw new IllegalArgumentException("The provided access token is expired.");
+        && accessToken.getExpirationTimeMillis() <= clock.currentTimeMillis() + 180_000L) {
+      throw new IOException("The provided access token is expired or expiring within skew buffer.");
     }
 
     HttpRequestFactory requestFactory = transportFactory.create().createRequestFactory();

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundaryManager.java

@@ -36,7 +36,9 @@
 import com.google.api.client.util.Clock;
 import com.google.api.core.InternalApi;
 import com.google.auth.http.HttpTransportFactory;
+import com.google.auth.mtls.MtlsUtils;
 import com.google.common.annotations.VisibleForTesting;
+import java.io.IOException;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.LinkedBlockingQueue;
 import java.util.concurrent.ThreadPoolExecutor;
@@ -68,6 +70,9 @@ final class RegionalAccessBoundaryManager {
    */
   static final int DEFAULT_MAX_RETRY_ELAPSED_TIME_MILLIS = 60000;
 
+  static final String IAM_ENDPOINT = "iamcredentials.googleapis.com";
+  static final String MTLS_IAM_ENDPOINT = "iamcredentials.mtls.googleapis.com";
+
   /**
    * cachedRAB uses AtomicReference to provide thread-safe, lock-free access to the cached data for
    * high-concurrency request threads.
@@ -201,14 +206,13 @@ void triggerAsyncRefresh(
                 skipRAB.set(true);
                 return;
               }
-              if (com.google.auth.mtls.MtlsUtils.canBeEnabled(envProvider, propProvider, null)) {
-                url =
-                    url.replace(
-                        "iamcredentials.googleapis.com", "iamcredentials.mtls.googleapis.com");
-              }
               HttpTransportFactory upgradedTransportFactory =
-                  com.google.auth.mtls.MtlsUtils.prepareTransportFactoryIfMtlsEnabled(
+                  MtlsUtils.prepareTransportFactoryIfMtlsEnabled(
                       transportFactory, envProvider, propProvider, null);
+              if (MtlsUtils.canBeEnabled(envProvider, propProvider, null)
+                  && upgradedTransportFactory != OAuth2Utils.HTTP_TRANSPORT_FACTORY) {
+                url = url.replace(IAM_ENDPOINT, MTLS_IAM_ENDPOINT);
+              }
               RegionalAccessBoundary newRAB =
                   RegionalAccessBoundary.refresh(
                       upgradedTransportFactory, url, accessToken, clock, maxRetryElapsedTimeMillis);
@@ -227,6 +231,8 @@ void triggerAsyncRefresh(
       } catch (Exception | Error e) {
         // If scheduling fails (e.g., RejectedExecutionException, OutOfMemoryError for threads),
         // the task's finally block will never execute. We must release the lock here.
+        handleRefreshFailure(
+            new IOException("Failed to submit background refresh task: " + e.getMessage(), e));
         log(
             LOGGER_PROVIDER,
             Level.FINE,

google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/RegionalAccessBoundaryTest.java

@@ -35,6 +35,7 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import com.google.api.client.testing.http.MockHttpTransport;
@@ -156,6 +157,23 @@ public void testRefreshClosesResponse() throws Exception {
     assertTrue(mockResponse.isDisconnected(), "Response should have been disconnected");
   }
 
+  @Test
+  public void testRefreshThrowsIOExceptionOnExpiringToken() {
+    final String url = "https://example.com/rab";
+    final AccessToken token =
+        new AccessToken(
+            "token", new java.util.Date(testClock.currentTimeMillis() + 120_000L)); // 2 minutes, within 3 min skew
+
+    MockHttpTransport transport = new MockHttpTransport.Builder().build();
+    HttpTransportFactory transportFactory = () -> transport;
+
+    assertThrows(
+        IOException.class,
+        () -> {
+          RegionalAccessBoundary.refresh(transportFactory, url, token, testClock, 1000);
+        });
+  }
+
   @Test
   public void testManagerTriggersRefreshInGracePeriod() throws InterruptedException {
     final String url =
@@ -410,4 +428,91 @@ public boolean isDisconnected() {
     // Verify that MtlsHttpTransportFactory.create() was called to retrieve the mTLS transport
     Mockito.verify(mockMtlsFactory, Mockito.times(2)).create();
   }
+
+  @Test
+  public void
+      regionalAccessBoundary_withMtlsEnabledButInitializationFailed_shouldFallbackToNonMtlsEndpoint()
+          throws IOException, InterruptedException {
+
+    MockExternalAccountCredentialsTransport transport =
+        new MockExternalAccountCredentialsTransport();
+
+    // Configure the environment provider to enable mTLS.
+    // X509Provider will use the invalid certificate config.
+    TestEnvironmentProvider testEnvProvider = new TestEnvironmentProvider();
+    testEnvProvider.setEnv("GOOGLE_API_USE_CLIENT_CERTIFICATE", "true");
+    testEnvProvider.setEnv(
+        "GOOGLE_API_CERTIFICATE_CONFIG",
+        new File("testresources/mtls/invalid_certificate_config.json").getAbsolutePath());
+
+    final String url =
+        "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/default:allowedLocations";
+    final AccessToken token =
+        new AccessToken(
+            "token", new java.util.Date(System.currentTimeMillis() + 10 * 3600000L));
+
+    RegionalAccessBoundaryProvider provider = () -> url;
+
+    // Use default OAuth2Utils.HTTP_TRANSPORT_FACTORY
+    HttpTransportFactory transportFactory = OAuth2Utils.HTTP_TRANSPORT_FACTORY;
+
+    RegionalAccessBoundaryManager manager =
+        new RegionalAccessBoundaryManager(
+            testClock,
+            RegionalAccessBoundaryManager.DEFAULT_MAX_RETRY_ELAPSED_TIME_MILLIS,
+            com.google.common.util.concurrent.MoreExecutors.newDirectExecutorService());
+
+    // Mock static RegionalAccessBoundary.refresh method to intercept the call
+    try (org.mockito.MockedStatic<RegionalAccessBoundary> rabMock =
+        org.mockito.Mockito.mockStatic(RegionalAccessBoundary.class)) {
+
+      RegionalAccessBoundary mockRab =
+          new RegionalAccessBoundary(
+              "fallback-encoded", Arrays.asList("fallback-loc"), testClock.currentTimeMillis(), testClock);
+
+      rabMock
+          .when(
+              () ->
+                  RegionalAccessBoundary.refresh(
+                      org.mockito.ArgumentMatchers.any(),
+                      org.mockito.ArgumentMatchers.any(),
+                      org.mockito.ArgumentMatchers.any(),
+                      org.mockito.ArgumentMatchers.any(),
+                      org.mockito.ArgumentMatchers.anyInt()))
+          .thenReturn(mockRab);
+
+      // Trigger refresh
+      manager.triggerAsyncRefresh(
+          transportFactory,
+          provider,
+          token,
+          testEnvProvider,
+          SystemPropertyProvider.getInstance());
+
+      // Verify it was cached
+      assertEquals("fallback-encoded", manager.getCachedRAB().getEncodedLocations());
+
+      final org.mockito.ArgumentCaptor<String> urlCaptor =
+          org.mockito.ArgumentCaptor.forClass(String.class);
+      final org.mockito.ArgumentCaptor<HttpTransportFactory> factoryCaptor =
+          org.mockito.ArgumentCaptor.forClass(HttpTransportFactory.class);
+
+      // Verify static call and capture arguments
+      rabMock.verify(
+          () ->
+              RegionalAccessBoundary.refresh(
+                  factoryCaptor.capture(),
+                  urlCaptor.capture(),
+                  org.mockito.ArgumentMatchers.any(),
+                  org.mockito.ArgumentMatchers.any(),
+                  org.mockito.ArgumentMatchers.anyInt()),
+          org.mockito.Mockito.times(1));
+
+      // Verify the URL passed to refresh did NOT get changed to the mTLS endpoint
+      assertEquals(url, urlCaptor.getValue());
+      // Verify that the transport factory used is the default one
+      assertEquals(OAuth2Utils.HTTP_TRANSPORT_FACTORY, factoryCaptor.getValue());
+    }
+  }
 }
+