fix(gdch): support EC private keys by diegomarquezp · Pull Request #1896 · googleapis/google-auth-library-java

diegomarquezp · 2026-03-04T22:19:21Z

Context: b/488439640

Implementation originally proposed in b/431924643#comment9

The primary objective is to enable support for Elliptic Curve (EC) keys and non-URI audience formats, aligning the Java SDK with the behavior of the Python and Go implementations. Additionally, the GDCH key creation tool creates EC keys only, meaning the GDCH implementation was not following the convention.

Key Changes

Algorithm Support: Updated the credential signing process to use the ES256 (ECDSA) algorithm, which is the required standard for GDCH service accounts.
Audience Flexibility: Changed the apiAudience field from a URI to a String to accommodate "magic" non-URI strings (e.g., specific administrative audiences) required by certain GDCH services.
OAuth2Utils Refactoring: Enhanced privateKeyFromPkcs8 to accept an algorithm parameter, allowing the library to parse EC keys instead of defaulting exclusively to RSA.
Test fixes: Fixes in a couple of test files as per Sonarqube analysis.

Testing

Updated GdchCredentialsTest to include test cases for EC key parsing and token signing.

…ce checks

lqiu96 · 2026-03-24T17:11:36Z

oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java

      LoggerProvider.forClazz(GdchCredentials.class);
-  static final String SUPPORTED_FORMAT_VERSION = "1";
  private static final String PARSE_ERROR_PREFIX = "Error parsing token refresh response. ";
+  @VisibleForTesting static final String SUPPORTED_FORMAT_VERSION = "1";


nit: Do you have any documentation regarding this format version? What is version 1 refrencing?

It's the format version of the JSON file. I believe this is to track changes such as a new entry in the json file.

I found go/gdch-python-auth-lib as a good source of truth.

Added a code comment to explain that.

oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java

marcosgtz7 · 2026-03-24T17:19:35Z

Acceso El martes, 24 de marzo de 2026, Lawrence ***@***.***> escribió:

…

***@***.**** commented on this pull request. ------------------------------ In oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java <#1896 (comment)> : > + @CanIgnoreReturnValue + @ObsoleteApi("Use setGdchAudience(String) instead") + public Builder setGdchAudience(URI apiAudience) { + if (apiAudience == null) { + throw new IllegalArgumentException( + "Audience cannot be null for GDCH service account credentials."); + } + this.apiAudience = apiAudience.toString(); + return this; + } We probably don't need to add a new setter for an obsolete method. Let's just have the user directly set with the String overload. — Reply to this email directly, view it on GitHub <#1896?email_source=notifications&email_token=B5MKPO7NS274SX7WUFDLRAT4SK7O3A5CNFSNUABKM5UWIORPF5TWS5BNNB2WEL2QOVWGYUTFOF2WK43UKJSXM2LFO4XTIMBQGA4TEMRTGQYKM4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOSWGM33PORSXEX3DNRUWG2Y#pullrequestreview-4000922340>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/B5MKPO66ZOHXBMK6AAJ427L4SK7O3AVCNFSM6AAAAACWHGYLYWVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHM2DAMBQHEZDEMZUGA> . You are receiving this because you are subscribed to this thread.Message ID: <googleapis/google-auth-library-java/pull/1896/review/4000922340@ github.com>

oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java

marcosgtz7 · 2026-03-24T18:27:19Z

Acceso El martes, 24 de marzo de 2026, Lawrence ***@***.***> escribió:

…

***@***.**** commented on this pull request. ------------------------------ In oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java <#1896 (comment)> : > private static final String PARSE_ERROR_PREFIX = "Error parsing token refresh response. "; + @VisibleForTesting static final String SUPPORTED_FORMAT_VERSION = "1"; + + private static final String SERVICE_ACCOUNT_TOKEN_TYPE = any documentation regarding this specific Uniform Resource Name and the k8s variant? Why does GDCH require this one? — Reply to this email directly, view it on GitHub <#1896?email_source=notifications&email_token=B5MKPO3KWUKTX3EMNGA4SAT4SK7YTA5CNFSNUABKM5UWIORPF5TWS5BNNB2WEL2QOVWGYUTFOF2WK43UKJSXM2LFO4XTIMBQGA4TIMRTGQ3KM4TFMFZW63VHMNXW23LFNZ2KKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#pullrequestreview-4000942346>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/B5MKPO4GWQZHDG3EL3IWC734SK7YTAVCNFSM6AAAAACWHGYLYWVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHM2DAMBQHE2DEMZUGY> . You are receiving this because you commented.Message ID: ***@***.*** com>

sonarqubecloud · 2026-03-26T19:46:14Z

Quality Gate failed

Failed conditions
0.0% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud

lqiu96 · 2026-03-26T20:47:36Z

oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java


    @CanIgnoreReturnValue
-    public Builder setGdchAudience(URI apiAudience) {
+    public Builder setGdchAudience(String apiAudience) {


for this public method, add small javadocs and note that it cannot be null or empty.

lqiu96 · 2026-03-26T20:48:41Z

oauth2_http/javatests/com/google/auth/oauth2/DefaultCredentialsProviderTest.java

  private static final String SA_PRIVATE_KEY_PKCS8 =
      ServiceAccountCredentialsTest.PRIVATE_KEY_PKCS8;
-  private static final String GDCH_SA_FORMAT_VERSION = GdchCredentials.SUPPORTED_FORMAT_VERSION;
+  private static final String GDCH_SA_FORMAT_VERSION =


can the tests just use GdchCredentials.SUPPORTED_JSON_FORMAT_VERSION constant directly?

lqiu96 · 2026-03-26T20:50:49Z

oauth2_http/javatests/com/google/auth/oauth2/GdchCredentialsTest.java

+    // SEQUENCE length doesn't match actual length
+    byte[] invalidDer = new byte[] {0x30, 0x05, 0x02, 0x01, 0x01, 0x02, 0x01, 0x02};
+    GoogleAuthException e =
+        assertThrows(
+            GoogleAuthException.class, () -> GdchCredentials.transcodeDerToConcat(invalidDer, 64));
+    assertEquals("Invalid DER signature length.", e.getMessage());
+  }
+
+  @Test
+  void transcodeDerToConcat_invalidRInteger() {
+    // Missing INTEGER for R
+    byte[] invalidDer = new byte[] {0x30, 0x06, 0x03, 0x01, 0x01, 0x02, 0x01, 0x02};
+    GoogleAuthException e =
+        assertThrows(
+            GoogleAuthException.class, () -> GdchCredentials.transcodeDerToConcat(invalidDer, 64));
+    assertEquals("Expected INTEGER for R.", e.getMessage());
+  }
+
+  @Test
+  void transcodeDerToConcat_invalidSInteger() {
+    // Missing INTEGER for S


For these test cases, can the comment show where it's missing the INTEGER value?

// Missing INTEGER for R

Is it missing something from byte[] invalidDer = new byte[] {0x30, 0x06, 0x03, 0x01, 0x01, 0x02, 0x01, 0x02};?

lqiu96 · 2026-03-26T20:51:11Z

oauth2_http/javatests/com/google/auth/oauth2/GoogleCredentialsTest.java

  private static final String SA_PRIVATE_KEY_PKCS8 =
      ServiceAccountCredentialsTest.PRIVATE_KEY_PKCS8;
-  private static final String GDCH_SA_FORMAT_VERSION = GdchCredentials.SUPPORTED_FORMAT_VERSION;
+  private static final String GDCH_SA_FORMAT_VERSION =


same here, is it possible to just use GdchCredentials.SUPPORTED_JSON_FORMAT_VERSION directly in the test?

diegomarquezp added 4 commits March 4, 2026 16:47

fix: allow for ES algorithm in GdchCredentials

dc5b79c

test: partially adapt tests

0c5e423

test: finish adjusting tests

5851b3e

chore: format

258ac9d

product-auto-label bot added the size: l Pull request size is large. label Mar 4, 2026

diegomarquezp added 4 commits March 4, 2026 17:24

fix: restore credential name

e8511bb

docs: restore license

a4d0f93

fix: restore removed code

e3d5302

test: increase coverage

e6635c6

diegomarquezp marked this pull request as ready for review March 9, 2026 21:36

diegomarquezp requested review from a team as code owners March 9, 2026 21:36

diegomarquezp added 12 commits March 10, 2026 16:52

test(gdch): parameterize test

cc49dba

test: remove unused var

f58f593

chore: remove unused throw clause

42f2662

test: parameterize more

91a3751

fix: remove unused parameter

b83a511

fix: make variables final as intended

625741e

fix: remove unused throw clause

1e0a7c3

fix: remove unused throw clause

24cd25d

fix: make OAuth2Credentials clock package private for production code

027a242

fix: use non deprecated base 64 encoder

a8b459b

test: parameterize flagged tests

4e8af24

chore: format

f257a81

diegomarquezp requested a review from a team as a code owner March 10, 2026 21:22

diegomarquezp added 3 commits March 10, 2026 17:27

test: fix assertion

c523df2

build: remove unused dependency

ed026a4

test: run linux gce only on linux envs

1528e76

diegomarquezp changed the title ~~feat(gdch): support EC private keys~~ fix(gdch): support EC private keys Mar 10, 2026

fix: sonarqube flags (use java.util.Base64)

7300e59

diegomarquezp added 7 commits March 23, 2026 22:23

docs: update GDCH audience getter javadocs

3fe0ca5

test: add null-checks to builder and corresponding tests

06982d4

refactor: consolidate token type constants using OAuth2Utils

bd7af8d

refactor: throw GoogleAuthException for signing and transcoding errors

583378e

docs: add javadoc to related test utils

5f59678

fix: use GoogleAuthException

8fefc7b

test: use assertThrows where applicable

fa51f57

product-auto-label bot added size: xl Pull request size is extra large. and removed size: l Pull request size is large. labels Mar 24, 2026

refactor: replace Preconditions with Strings.isNullOrEmpty for audien…

f0873d3

…ce checks

product-auto-label bot added size: l Pull request size is large. and removed size: xl Pull request size is extra large. labels Mar 24, 2026

diegomarquezp added 4 commits March 23, 2026 22:55

fix: consistent exception message

66f8342

Merge origin/main and resolve conflicts

5ec685d

chore: format

4c75b1d

test: use lowercase os name

6980520

lqiu96 reviewed Mar 24, 2026

View reviewed changes

oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java Outdated Show resolved Hide resolved

lqiu96 reviewed Mar 24, 2026

View reviewed changes

oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java Show resolved Hide resolved

lqiu96 reviewed Mar 24, 2026

View reviewed changes

oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java Outdated Show resolved Hide resolved

lqiu96 reviewed Mar 24, 2026

View reviewed changes

oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java Show resolved Hide resolved

diegomarquezp added 2 commits March 26, 2026 15:31

chore: address review comments for PR #1896

d0547e3

chore: format

00ff824

lqiu96 reviewed Mar 26, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(gdch): support EC private keys#1896

fix(gdch): support EC private keys#1896
diegomarquezp wants to merge 58 commits intomainfrom
b/488439640

diegomarquezp commented Mar 4, 2026 •

edited

Loading

Uh oh!

lqiu96 Mar 24, 2026

Uh oh!

diegomarquezp Mar 26, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

marcosgtz7 commented Mar 24, 2026 via email

Uh oh!

Uh oh!

marcosgtz7 commented Mar 24, 2026 via email

Uh oh!

sonarqubecloud bot commented Mar 26, 2026

Uh oh!

lqiu96 Mar 26, 2026

Uh oh!

lqiu96 Mar 26, 2026

Uh oh!

lqiu96 Mar 26, 2026

Uh oh!

lqiu96 Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

diegomarquezp commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Key Changes

Testing

Uh oh!

lqiu96 Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

diegomarquezp Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

marcosgtz7 commented Mar 24, 2026 via email

Uh oh!

Uh oh!

marcosgtz7 commented Mar 24, 2026 via email

Uh oh!

sonarqubecloud bot commented Mar 26, 2026

Quality Gate failed

Uh oh!

lqiu96 Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

lqiu96 Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

lqiu96 Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

lqiu96 Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

diegomarquezp commented Mar 4, 2026 •

edited

Loading