Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): Update dependency com.google.auth:google-auth-library-oauth2-http to v1.16.0 #1321

Closed
wants to merge 20 commits into from

Conversation

hessjcg
Copy link
Collaborator

@hessjcg hessjcg commented Jun 8, 2023

Manual update of this dependency. Something changed between versions 1.13.0 and 1.14.0 that broke authentication across all versions for GitHub Action service account impersonation.

I suspect it has something to do with the bugfix where quota project was handeled improperly in 1.13 and fixed in 1.14. We probably need to set GOOGLE_CLOUD_QUOTA_PROJECT to an appropriate value to fix the tests in the github runner.

See googleapis/google-auth-library-java#1082

Error:  Tests run: 1, Failures: 0, Errors: 1, Skipped: 0, Time elapsed: 12.232 s <<< FAILURE! - in com.google.cloud.sql.mariadb.JdbcMariaDBIamAuthIntegrationTests
Error:  com.google.cloud.sql.mariadb.JdbcMariaDBIamAuthIntegrationTests.pooledConnectionTest  Time elapsed: 12.225 s  <<< ERROR!
com.zaxxer.hikari.pool.HikariPool$PoolInitializationException: Failed to initialize pool: Socket fail to connect to host:address=(host=ignoreme)(port=123)(type=primary). Socket factory failed to initialized with option "socketFactory" set to "com.google.cloud.sql.mariadb.SocketFactory"
	at com.zaxxer.hikari.pool.HikariPool.throwPoolInitializationException(HikariPool.java:596)
	at com.zaxxer.hikari.pool.HikariPool.checkFailFast(HikariPool.java:582)
	at com.zaxxer.hikari.pool.HikariPool.<init>(HikariPool.java:115)
	at com.zaxxer.hikari.HikariDataSource.<init>(HikariDataSource.java:81)
	at com.google.cloud.sql.mariadb.JdbcMariaDBIamAuthIntegrationTests.setUpPool(JdbcMariaDBIamAuthIntegrationTests.java:82)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:568)
	at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:59)
	at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
	at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:56)
	at org.junit.internal.runners.statements.RunBefores.invokeMethod(RunBefores.java:33)
	at org.junit.internal.runners.statements.RunBefores.evaluate(RunBefores.java:24)
	at org.junit.internal.runners.statements.FailOnTimeout$CallableStatement.call(FailOnTimeout.java:299)
	at org.junit.internal.runners.statements.FailOnTimeout$CallableStatement.call(FailOnTimeout.java:293)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.lang.Thread.run(Thread.java:833)
Caused by: java.sql.SQLNonTransientConnectionException: Socket fail to connect to host:address=(host=ignoreme)(port=123)(type=primary). Socket factory failed to initialized with option "socketFactory" set to "com.google.cloud.sql.mariadb.SocketFactory"
	at org.mariadb.jdbc.client.impl.ConnectionHelper.connectSocket(ConnectionHelper.java:137)
	at org.mariadb.jdbc.client.impl.StandardClient.<init>(StandardClient.java:99)
	at org.mariadb.jdbc.Driver.connect(Driver.java:70)
	at org.mariadb.jdbc.Driver.connect(Driver.java:101)
	at org.mariadb.jdbc.Driver.connect(Driver.java:27)
	at com.zaxxer.hikari.util.DriverDataSource.getConnection(DriverDataSource.java:121)
	at com.zaxxer.hikari.pool.PoolBase.newConnection(PoolBase.java:364)
	at com.zaxxer.hikari.pool.PoolBase.newPoolEntry(PoolBase.java:206)
	at com.zaxxer.hikari.pool.HikariPool.createPoolEntry(HikariPool.java:476)
	at com.zaxxer.hikari.pool.HikariPool.checkFailFast(HikariPool.java:561)
	... 16 more
Caused by: java.io.IOException: Socket factory failed to initialized with option "socketFactory" set to "com.google.cloud.sql.mariadb.SocketFactory"
	at org.mariadb.jdbc.client.impl.ConnectionHelper.standardSocket(ConnectionHelper.java:100)
	at org.mariadb.jdbc.client.socket.impl.SocketUtility.lambda$getSocketHandler$0(SocketUtility.java:38)
	at org.mariadb.jdbc.client.impl.ConnectionHelper.createSocket(ConnectionHelper.java:69)
	at org.mariadb.jdbc.client.impl.ConnectionHelper.connectSocket(ConnectionHelper.java:124)
	... 25 more
Caused by: java.lang.RuntimeException: java.util.concurrent.ExecutionException: java.lang.RuntimeException: An exception occurred while fetching IAM auth token:
	at com.google.cloud.sql.core.CloudSqlInstance.getInstanceData(CloudSqlInstance.java:165)
	at com.google.cloud.sql.core.CloudSqlInstance.createSslSocket(CloudSqlInstance.java:174)
	at com.google.cloud.sql.core.CoreSocketFactory.createSslSocket(CoreSocketFactory.java:329)
	at com.google.cloud.sql.core.CoreSocketFactory.connect(CoreSocketFactory.java:199)
	at com.google.cloud.sql.core.CoreSocketFactory.connect(CoreSocketFactory.java:157)
	at com.google.cloud.sql.mariadb.SocketFactory.createSocket(SocketFactory.java:51)
	at org.mariadb.jdbc.client.impl.ConnectionHelper.standardSocket(ConnectionHelper.java:96)
	... 28 more
Caused by: java.util.concurrent.ExecutionException: java.lang.RuntimeException: An exception occurred while fetching IAM auth token:
	at com.google.common.util.concurrent.AbstractFuture.getDoneValue(AbstractFuture.java:588)
	at com.google.common.util.concurrent.AbstractFuture.get(AbstractFuture.java:567)
	at com.google.common.util.concurrent.AbstractFuture$TrustedFuture.get(AbstractFuture.java:113)
	at com.google.cloud.sql.core.SqlAdminApiFetcher.getInstanceData(SqlAdminApiFetcher.java:158)
	at com.google.cloud.sql.core.CloudSqlInstance.performRefresh(CloudSqlInstance.java:237)
	at com.google.common.util.concurrent.TrustedListenableFutureTask$TrustedFutureInterruptibleTask.runInterruptibly(TrustedListenableFutureTask.java:131)
	at com.google.common.util.concurrent.InterruptibleTask.run(InterruptibleTask.java:74)
	at com.google.common.util.concurrent.TrustedListenableFutureTask.run(TrustedListenableFutureTask.java:82)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:304)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
	... 1 more
Caused by: java.lang.RuntimeException: An exception occurred while fetching IAM auth token:
	at com.google.cloud.sql.core.SqlAdminApiFetcher.addExceptionContext(SqlAdminApiFetcher.java:426)
	at com.google.cloud.sql.core.SqlAdminApiFetcher.fetchEphemeralCertificate(SqlAdminApiFetcher.java:258)
	at com.google.cloud.sql.core.SqlAdminApiFetcher.lambda$getInstanceData$1(SqlAdminApiFetcher.java:114)
	at com.google.common.util.concurrent.CombinedFuture$CallableInterruptibleTask.runInterruptibly(CombinedFuture.java:196)
	at com.google.common.util.concurrent.InterruptibleTask.run(InterruptibleTask.java:74)
	... 6 more
Caused by: java.io.IOException: Error requesting access token
	at com.google.auth.oauth2.ImpersonatedCredentials.refreshAccessToken(ImpersonatedCredentials.java:511)
	at com.google.auth.oauth2.ExternalAccountCredentials.exchangeExternalCredentialForAccessToken(ExternalAccountCredentials.java:480)
	at com.google.auth.oauth2.IdentityPoolCredentials.refreshAccessToken(IdentityPoolCredentials.java:179)
	at com.google.auth.oauth2.OAuth2Credentials$1.call(OAuth2Credentials.java:257)
	at com.google.auth.oauth2.OAuth2Credentials$1.call(OAuth2Credentials.java:254)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at com.google.auth.oauth2.OAuth2Credentials$RefreshTask.run(OAuth2Credentials.java:623)
	at com.google.common.util.concurrent.DirectExecutor.execute(DirectExecutor.java:31)
	at com.google.auth.oauth2.OAuth2Credentials$AsyncRefreshResult.executeIfNew(OAuth2Credentials.java:571)
	at com.google.auth.oauth2.OAuth2Credentials.refresh(OAuth2Credentials.java:180)
	at com.google.cloud.sql.core.SqlAdminApiFetcher.lambda$refreshWithRetry$5(SqlAdminApiFetcher.java:304)
	at com.google.cloud.sql.core.RetryingCallable.call(RetryingCallable.java:67)
	at com.google.cloud.sql.core.SqlAdminApiFetcher.refreshWithRetry(SqlAdminApiFetcher.java:311)
	at com.google.cloud.sql.core.SqlAdminApiFetcher.fetchEphemeralCertificate(SqlAdminApiFetcher.java:248)
	... 9 more
Caused by: com.google.api.client.http.HttpResponseException: 403 Forbidden
POST https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/***:generateAccessToken
{
  "error": {
    "code": 403,
    "message": "Permission 'iam.serviceAccounts.getAccessToken' denied on resource (or it may not exist).",
    "errors": [
      {
        "message": "Permission 'iam.serviceAccounts.getAccessToken' denied on resource (or it may not exist).",
        "domain": "global",
        "reason": "forbidden"
      }
    ],
    "status": "PERMISSION_DENIED",
    "details": [
      {
        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
        "reason": "IAM_PERMISSION_DENIED",
        "domain": "iam.googleapis.com",
        "metadata": {
          "permission": "iam.serviceAccounts.getAccessToken"
        }
      }
    ]
  }
}

	at com.google.api.client.http.HttpResponseException$Builder.build(HttpResponseException.java:293)
	at com.google.api.client.http.HttpRequest.execute(HttpRequest.java:1118)
	at com.google.auth.oauth2.ImpersonatedCredentials.refreshAccessToken(ImpersonatedCredentials.java:509)
	... 22 more

@hessjcg
Copy link
Collaborator Author

hessjcg commented Jun 15, 2023

Closing. I will provide a different approach to these changes split into a few PRs.

@hessjcg hessjcg closed this Jun 15, 2023
@enocom enocom deleted the gh-1294-oauth2-version branch July 18, 2023 01:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant