fix: improve errors and warnings related to ADC (#1172)

* fix: update with latest text
* fix: update error texts

oauth2_http/java/com/google/auth/oauth2/DefaultCredentialsProvider.java

@@ -59,8 +59,6 @@ class DefaultCredentialsProvider {
 
   static final String WELL_KNOWN_CREDENTIALS_FILE = "application_default_credentials.json";
   static final String CLOUDSDK_CONFIG_DIRECTORY = "gcloud";
-  static final String HELP_PERMALINK =
-      "https://developers.google.com/accounts/docs/application-default-credentials";
   static final String APP_ENGINE_SIGNAL_CLASS = "com.google.appengine.api.utils.SystemProperty";
   static final String CLOUD_SHELL_ENV_VAR = "DEVSHELL_CLIENT_PORT";
   static final String SKIP_APP_ENGINE_ENV_VAR = "GOOGLE_APPLICATION_CREDENTIALS_SKIP_APP_ENGINE";
@@ -74,12 +72,15 @@ class DefaultCredentialsProvider {
   static final String CLOUDSDK_CLIENT_ID =
       "764086051850-6qr4p6gpi6hn506pt8ejuq83di341hur.apps.googleusercontent.com";
   static final String CLOUDSDK_CREDENTIALS_WARNING =
-      "Your application has authenticated using end user credentials from Google "
-          + "Cloud SDK. We recommend that most server applications use service accounts "
-          + "instead. If your application continues to use end user credentials from Cloud "
-          + "SDK, you might receive a \"quota exceeded\" or \"API not enabled\" error. For "
-          + "more information about service accounts, see "
-          + "https://cloud.google.com/docs/authentication/.";
+      "You are authenticating using user credentials. "
+          + "For production, we recommend using service account credentials.\n\n"
+          + "To learn more about service account credentials, see "
+          + "http://cloud.google.com/docs/authentication/external/set-up-adc-on-cloud";
+
+  static final String CLOUDSDK_MISSING_CREDENTIALS =
+      "Your default credentials were not found. To set up Application Default Credentials "
+          + "for your environment, see "
+          + "https://cloud.google.com/docs/authentication/external/set-up-adc.";
   public static final String SUPPRESS_GCLOUD_CREDS_WARNING_ENV_VAR =
       "SUPPRESS_GCLOUD_CREDS_WARNING";
 
@@ -123,12 +124,7 @@ final GoogleCredentials getDefaultCredentials(HttpTransportFactory transportFact
       }
     }
 
-    throw new IOException(
-        String.format(
-            "The Application Default Credentials are not available. They are available if running"
-                + " in Google Compute Engine. Otherwise, the environment variable %s must be defined"
-                + " pointing to a file defining the credentials. See %s for more information.",
-            CREDENTIAL_ENV_VAR, HELP_PERMALINK));
+    throw new IOException(CLOUDSDK_MISSING_CREDENTIALS);
   }
 
   private final GoogleCredentials getDefaultCredentialsUnsynchronized(
@@ -233,8 +229,8 @@ private final File getWellKnownCredentialsFile() {
 
   private void warnAboutProblematicCredentials(GoogleCredentials credentials) {
     if (credentials instanceof UserCredentials
-        && ((UserCredentials) credentials).getClientId().equals(CLOUDSDK_CLIENT_ID)
-        && !Boolean.parseBoolean(getEnv(SUPPRESS_GCLOUD_CREDS_WARNING_ENV_VAR))) {
+        && !Boolean.parseBoolean(getEnv(SUPPRESS_GCLOUD_CREDS_WARNING_ENV_VAR))
+        && ComputeEngineCredentials.checkStaticGceDetection(this)) {
       LOGGER.log(Level.WARNING, CLOUDSDK_CREDENTIALS_WARNING);
     }
   }

oauth2_http/javatests/com/google/auth/oauth2/DefaultCredentialsProviderTest.java

@@ -128,7 +128,7 @@ public void getDefaultCredentials_noCredentials_throws() {
       fail("No credential expected.");
     } catch (IOException e) {
       String message = e.getMessage();
-      assertTrue(message.contains(DefaultCredentialsProvider.HELP_PERMALINK));
+      assertTrue(message.equals(DefaultCredentialsProvider.CLOUDSDK_MISSING_CREDENTIALS));
     }
   }
 
@@ -143,7 +143,7 @@ public void getDefaultCredentials_noCredentialsSandbox_throwsNonSecurity() {
       fail("No credential expected.");
     } catch (IOException e) {
       String message = e.getMessage();
-      assertTrue(message.contains(DefaultCredentialsProvider.HELP_PERMALINK));
+      assertTrue(message.equals(DefaultCredentialsProvider.CLOUDSDK_MISSING_CREDENTIALS));
     }
   }
 
@@ -164,7 +164,7 @@ public void getDefaultCredentials_envValidSandbox_throwsNonSecurity() throws Exc
       fail("No credential expected.");
     } catch (IOException e) {
       String message = e.getMessage();
-      assertTrue(message.contains(DefaultCredentialsProvider.HELP_PERMALINK));
+      assertTrue(message.equals(DefaultCredentialsProvider.CLOUDSDK_MISSING_CREDENTIALS));
     }
   }
 
@@ -179,7 +179,7 @@ public void getDefaultCredentials_noCredentials_singleGceTestRequest() {
       fail("No credential expected.");
     } catch (IOException expected) {
       String message = expected.getMessage();
-      assertTrue(message.contains(DefaultCredentialsProvider.HELP_PERMALINK));
+      assertTrue(message.equals(DefaultCredentialsProvider.CLOUDSDK_MISSING_CREDENTIALS));
     }
     assertEquals(
         transportFactory.transport.getRequestCount(),
@@ -278,7 +278,7 @@ public void getDefaultCredentials_appEngineClassWithoutRuntime_NotFoundError() {
       fail("No credential expected when not on App Engine.");
     } catch (IOException e) {
       String message = e.getMessage();
-      assertTrue(message.contains(DefaultCredentialsProvider.HELP_PERMALINK));
+      assertTrue(message.equals(DefaultCredentialsProvider.CLOUDSDK_MISSING_CREDENTIALS));
     }
   }
 
@@ -295,7 +295,7 @@ public void getDefaultCredentials_appEngineRuntimeWithoutClass_throwsHelpfulLoad
       fail("Credential expected to fail to load if credential class not present.");
     } catch (IOException e) {
       String message = e.getMessage();
-      assertFalse(message.contains(DefaultCredentialsProvider.HELP_PERMALINK));
+      assertFalse(message.equals(DefaultCredentialsProvider.CLOUDSDK_MISSING_CREDENTIALS));
       assertTrue(message.contains("Check that the App Engine SDK is deployed."));
     }
   }
@@ -633,19 +633,27 @@ public void flush() {}
 
   @Test
   public void getDefaultCredentials_wellKnownFile_logsGcloudWarning() throws IOException {
-    LogRecord message = getCredentialsAndReturnLogMessage(false);
+    LogRecord message = getCredentialsAndReturnLogMessage(false, true);
     assertNotNull(message);
     assertEquals(Level.WARNING, message.getLevel());
-    assertTrue(message.getMessage().contains("end user credentials from Google Cloud SDK"));
+    assertTrue(
+        message.getMessage().equals(DefaultCredentialsProvider.CLOUDSDK_CREDENTIALS_WARNING));
+  }
+
+  @Test
+  public void getDefaultCredentials_wellKnownFile_noGcloudWarning() throws IOException {
+    LogRecord message = getCredentialsAndReturnLogMessage(false, false);
+    assertNull(message);
   }
 
   @Test
   public void getDefaultCredentials_wellKnownFile_suppressGcloudWarning() throws IOException {
-    LogRecord message = getCredentialsAndReturnLogMessage(true);
+    LogRecord message = getCredentialsAndReturnLogMessage(true, true);
     assertNull(message);
   }
 
-  private LogRecord getCredentialsAndReturnLogMessage(boolean suppressWarning) throws IOException {
+  private LogRecord getCredentialsAndReturnLogMessage(boolean suppressWarning, boolean isGce)
+      throws IOException {
     Logger logger = Logger.getLogger(DefaultCredentialsProvider.class.getName());
     LogHandler handler = new LogHandler();
     logger.addHandler(handler);
@@ -664,6 +672,12 @@ private LogRecord getCredentialsAndReturnLogMessage(boolean suppressWarning) thr
         Boolean.toString(suppressWarning));
     testProvider.setProperty("os.name", "linux");
     testProvider.setProperty("user.home", homeDir.getAbsolutePath());
+    if (isGce) {
+      String productFilePath = SMBIOS_PATH_LINUX;
+      File productFile = new File(productFilePath);
+      InputStream productStream = new ByteArrayInputStream("Googlekdjsfhg".getBytes());
+      testProvider.addFile(productFile.getAbsolutePath(), productStream);
+    }
     testProvider.addFile(wellKnownFile.getAbsolutePath(), userStream);
     testUserProvidesToken(testProvider, GCLOUDSDK_CLIENT_ID, USER_CLIENT_SECRET, REFRESH_TOKEN);
     return handler.getRecord();