fix(gdch): support EC private keys by diegomarquezp · Pull Request #1896 · googleapis/google-auth-library-java

diegomarquezp · 2026-03-04T22:19:21Z

Context: b/488439640

Implementation originally proposed in b/431924643#comment9

The primary objective is to enable support for Elliptic Curve (EC) keys and non-URI audience formats, aligning the Java SDK with the behavior of the Python and Go implementations. Additionally, the GDCH key creation tool creates EC keys only, meaning the GDCH implementation was not following the convention.

Key Changes

Algorithm Support: Updated the credential signing process to use the ES256 (ECDSA) algorithm, which is the required standard for GDCH service accounts.
Audience Flexibility: Changed the apiAudience field from a URI to a String to accommodate "magic" non-URI strings (e.g., specific administrative audiences) required by certain GDCH services.
OAuth2Utils Refactoring: Enhanced privateKeyFromPkcs8 to accept an algorithm parameter, allowing the library to parse EC keys instead of defaulting exclusively to RSA.
Test fixes: Fixes in a couple of test files as per Sonarqube analysis.

Testing

Updated GdchCredentialsTest to include test cases for EC key parsing and token signing.

oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java

marcosgtz7 · 2026-03-24T18:27:19Z

Acceso El martes, 24 de marzo de 2026, Lawrence ***@***.***> escribió:

…

***@***.**** commented on this pull request. ------------------------------ In oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java <#1896 (comment)> : > private static final String PARSE_ERROR_PREFIX = "Error parsing token refresh response. "; + @VisibleForTesting static final String SUPPORTED_FORMAT_VERSION = "1"; + + private static final String SERVICE_ACCOUNT_TOKEN_TYPE = any documentation regarding this specific Uniform Resource Name and the k8s variant? Why does GDCH require this one? — Reply to this email directly, view it on GitHub <#1896?email_source=notifications&email_token=B5MKPO3KWUKTX3EMNGA4SAT4SK7YTA5CNFSNUABKM5UWIORPF5TWS5BNNB2WEL2QOVWGYUTFOF2WK43UKJSXM2LFO4XTIMBQGA4TIMRTGQ3KM4TFMFZW63VHMNXW23LFNZ2KKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#pullrequestreview-4000942346>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/B5MKPO4GWQZHDG3EL3IWC734SK7YTAVCNFSM6AAAAACWHGYLYWVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHM2DAMBQHE2DEMZUGY> . You are receiving this because you commented.Message ID: ***@***.*** com>

oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java

lqiu96 · 2026-03-26T20:48:41Z

oauth2_http/javatests/com/google/auth/oauth2/DefaultCredentialsProviderTest.java

  private static final String SA_PRIVATE_KEY_PKCS8 =
      ServiceAccountCredentialsTest.PRIVATE_KEY_PKCS8;
-  private static final String GDCH_SA_FORMAT_VERSION = GdchCredentials.SUPPORTED_FORMAT_VERSION;
+  private static final String GDCH_SA_FORMAT_VERSION =


can the tests just use GdchCredentials.SUPPORTED_JSON_FORMAT_VERSION constant directly?

Good point, done.

lqiu96 · 2026-03-26T20:50:49Z

oauth2_http/javatests/com/google/auth/oauth2/GdchCredentialsTest.java

+    // SEQUENCE length doesn't match actual length
+    byte[] invalidDer = new byte[] {0x30, 0x05, 0x02, 0x01, 0x01, 0x02, 0x01, 0x02};
+    GoogleAuthException e =
+        assertThrows(
+            GoogleAuthException.class, () -> GdchCredentials.transcodeDerToConcat(invalidDer, 64));
+    assertEquals("Invalid DER signature length.", e.getMessage());
+  }
+
+  @Test
+  void transcodeDerToConcat_invalidRInteger() {
+    // Missing INTEGER for R
+    byte[] invalidDer = new byte[] {0x30, 0x06, 0x03, 0x01, 0x01, 0x02, 0x01, 0x02};
+    GoogleAuthException e =
+        assertThrows(
+            GoogleAuthException.class, () -> GdchCredentials.transcodeDerToConcat(invalidDer, 64));
+    assertEquals("Expected INTEGER for R.", e.getMessage());
+  }
+
+  @Test
+  void transcodeDerToConcat_invalidSInteger() {
+    // Missing INTEGER for S


For these test cases, can the comment show where it's missing the INTEGER value?

// Missing INTEGER for R

Is it missing something from byte[] invalidDer = new byte[] {0x30, 0x06, 0x03, 0x01, 0x01, 0x02, 0x01, 0x02};?

Added a more specific comment

oauth2_http/javatests/com/google/auth/oauth2/GoogleCredentialsTest.java

lqiu96

Changes LGTM. added a few comments.

lqiu96 · 2026-04-03T15:28:10Z

oauth2_http/java/com/google/auth/oauth2/OAuth2Utils.java

+      if (algorithm == Pkcs8Algorithm.EC) {
+        reader = new StringReader(privateKeyPkcs8);
+        section = PemReader.readFirstSectionAndClose(reader, "EC PRIVATE KEY");
+        if (section != null) {
+          return privateKeyFromSec1(section.getBase64DecodedBytes());
+        }
+      }


Is PKCS#8 or SEC1 two different algorithms/ flows? Also Is this logic only needed for GDCH?

If so, can this logic exists inside GDCH itself?
e.g.

Check the first section and determine if we should call pckc8 or sec1 method

call privateKeyFromPkcs8 or privateKeyFromSec1

I think it would better to separate these concerns since it looks like privateKeyFromPkcs8 is now also making a call to privateKeyFromSec1. I think we have added proper checks, but since this resides in OAuth2Utils I'm worried this behavior may have unknown impact.

Done. I still kept the algorithm parameter in OAuth2Utils to parse EC keys. WDYT?

oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java

…alue

sonarqubecloud · 2026-04-08T16:21:17Z

Quality Gate failed

Failed conditions
0.0% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud

@deprecated

* fix: allow for ES algorithm in GdchCredentials * test: partially adapt tests * test: finish adjusting tests * chore: format * fix: restore credential name * docs: restore license * fix: restore removed code * test: increase coverage * test(gdch): parameterize test * test: remove unused var * chore: remove unused throw clause * test: parameterize more * fix: remove unused parameter * fix: make variables final as intended * fix: remove unused throw clause * fix: remove unused throw clause * fix: make OAuth2Credentials clock package private for production code * fix: use non deprecated base 64 encoder * test: parameterize flagged tests * chore: format * test: fix assertion * build: remove unused dependency * test: run linux gce only on linux envs * fix: sonarqube flags (use java.util.Base64) * fix: improve error message template * fix: keep overload of "with audience" that takes an URI * fix: restore public getter of getApiAudience * docs: add javadoc for signing logic * test: test private signature and decode methods * fix: add null and empty check for audience string * docs: add javadoc for audience getters * fix: use enum for possible algorithms * fix: use obsolete javadoc instead of @deprecated * refactor: use OAuth2Utils validate methods in GdchCredentials * fix: restore GoogleAuthException throwing in GdchCredentials * refactor: downgrade Pkcs8Algorithm and privateKeyFromPkcs8 to package-private * refactor: split parseBody into parseJson and parseQuery in test utilities * refactor: remove validation reflection by making signUsingEsSha256 package-private * test: use hardcoded string literal for gdch api audience in test * test: refactor to use assertThrows in GdchCredentialsTest and remove host OS check in DefaultCredentialsProviderTest * fix: add comment about EC algorithm support in GdchCredentials * fix: update GDCH audience error message to be more descriptive * refactor: rename getApiAudienceString to getGdchAudience * fix: Remove unused import * docs: update GDCH audience getter javadocs * test: add null-checks to builder and corresponding tests * refactor: consolidate token type constants using OAuth2Utils * refactor: throw GoogleAuthException for signing and transcoding errors * docs: add javadoc to related test utils * fix: use GoogleAuthException * test: use assertThrows where applicable * refactor: replace Preconditions with Strings.isNullOrEmpty for audience checks * fix: consistent exception message * chore: format * test: use lowercase os name * chore: address review comments for PR #1896 * chore: format * Finalizing GDCH credentials support by addressing reviewer comments * chore: format * fix: parse EC private keys with SEC1 algorithm * chore: format * fix: separate PKCs8 vs SEC1 logic in GdchCredentials * fix: improved exception message, added comments to extractPrivateKeyValue Original-PR: googleapis/google-auth-library-java#1896

diegomarquezp added 4 commits March 4, 2026 16:47

fix: allow for ES algorithm in GdchCredentials

dc5b79c

test: partially adapt tests

0c5e423

test: finish adjusting tests

5851b3e

chore: format

258ac9d

product-auto-label bot added the size: l Pull request size is large. label Mar 4, 2026

diegomarquezp added 4 commits March 4, 2026 17:24

fix: restore credential name

e8511bb

docs: restore license

a4d0f93

fix: restore removed code

e3d5302

test: increase coverage

e6635c6

diegomarquezp marked this pull request as ready for review March 9, 2026 21:36

diegomarquezp requested review from a team as code owners March 9, 2026 21:36

diegomarquezp added 12 commits March 10, 2026 16:52

test(gdch): parameterize test

cc49dba

test: remove unused var

f58f593

chore: remove unused throw clause

42f2662

test: parameterize more

91a3751

fix: remove unused parameter

b83a511

fix: make variables final as intended

625741e

fix: remove unused throw clause

1e0a7c3

fix: remove unused throw clause

24cd25d

fix: make OAuth2Credentials clock package private for production code

027a242

fix: use non deprecated base 64 encoder

a8b459b

test: parameterize flagged tests

4e8af24

chore: format

f257a81

diegomarquezp requested a review from a team as a code owner March 10, 2026 21:22

diegomarquezp added 3 commits March 10, 2026 17:27

test: fix assertion

c523df2

build: remove unused dependency

ed026a4

test: run linux gce only on linux envs

1528e76

diegomarquezp changed the title ~~feat(gdch): support EC private keys~~ fix(gdch): support EC private keys Mar 10, 2026

fix: sonarqube flags (use java.util.Base64)

7300e59

lqiu96 reviewed Mar 24, 2026

View reviewed changes

oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java Show resolved Hide resolved

diegomarquezp added 2 commits March 26, 2026 15:31

chore: address review comments for PR #1896

d0547e3

chore: format

00ff824

lqiu96 reviewed Mar 26, 2026

View reviewed changes

oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java Show resolved Hide resolved

lqiu96 reviewed Mar 26, 2026

View reviewed changes

oauth2_http/javatests/com/google/auth/oauth2/GoogleCredentialsTest.java Outdated Show resolved Hide resolved

lqiu96 approved these changes Mar 26, 2026

View reviewed changes

Finalizing GDCH credentials support by addressing reviewer comments

a57def2

product-auto-label bot added size: xl Pull request size is extra large. and removed size: l Pull request size is large. labels Mar 26, 2026

diegomarquezp added 3 commits March 26, 2026 19:52

chore: format

0465e2c

fix: parse EC private keys with SEC1 algorithm

a885a94

chore: format

3d84edf

lqiu96 reviewed Apr 3, 2026

View reviewed changes

fix: separate PKCs8 vs SEC1 logic in GdchCredentials

e0ae1c1

diegomarquezp added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Apr 7, 2026

yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Apr 7, 2026

lqiu96 reviewed Apr 7, 2026

View reviewed changes

oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java Show resolved Hide resolved

lqiu96 reviewed Apr 7, 2026

View reviewed changes

oauth2_http/java/com/google/auth/oauth2/GdchCredentials.java Outdated Show resolved Hide resolved

diegomarquezp added 2 commits April 7, 2026 17:19

fix: improved exception message, added comments to extractPrivateKeyV…

1d02562

…alue

Merge remote-tracking branch 'origin/main' into b/488439640

7d3458f

product-auto-label bot added size: l Pull request size is large. and removed size: xl Pull request size is extra large. labels Apr 8, 2026

diegomarquezp merged commit 27dac49 into main Apr 8, 2026
26 of 28 checks passed

diegomarquezp deleted the b/488439640 branch April 8, 2026 16:32

release-please bot mentioned this pull request Apr 8, 2026

chore(main): release 1.44.0 #1902

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(gdch): support EC private keys#1896

fix(gdch): support EC private keys#1896
diegomarquezp merged 65 commits intomainfrom
b/488439640

diegomarquezp commented Mar 4, 2026 •

edited

Loading

Uh oh!

Uh oh!

marcosgtz7 commented Mar 24, 2026 via email

Uh oh!

Uh oh!

lqiu96 Mar 26, 2026

Uh oh!

diegomarquezp Mar 26, 2026

Uh oh!

lqiu96 Mar 26, 2026

Uh oh!

diegomarquezp Mar 26, 2026

Uh oh!

Uh oh!

lqiu96 left a comment

Uh oh!

lqiu96 Apr 3, 2026 •

edited

Loading

Uh oh!

diegomarquezp Apr 7, 2026

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud bot commented Apr 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

diegomarquezp commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Key Changes

Testing

Uh oh!

Uh oh!

marcosgtz7 commented Mar 24, 2026 via email

Uh oh!

Uh oh!

lqiu96 Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

diegomarquezp Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

lqiu96 Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

diegomarquezp Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

lqiu96 left a comment

Choose a reason for hiding this comment

Uh oh!

lqiu96 Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

diegomarquezp Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud bot commented Apr 8, 2026

Quality Gate failed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

diegomarquezp commented Mar 4, 2026 •

edited

Loading

lqiu96 Apr 3, 2026 •

edited

Loading