feat: Async Refresh for Regional Access Boundaries by vverman · Pull Request #1880 · googleapis/google-auth-library-java

vverman · 2026-01-25T21:35:27Z

Contains changes for the feature Regional Access Boundary (Previously Called Trust Boundaries).

The following are salient changes:

Calls to refresh RAB are now all async and in a separate thread.
Logic for refreshing RAB now exists in its own class for cleaner maintenance.
Self-signed jwts are within scope.
Changes to how we trigger RAB refresh and deal with refresh errors.

…pe. Updated tests.

…rors are now retryable.

oauth2_http/java/com/google/auth/http/HttpCredentialsAdapter.java

oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java

oauth2_http/java/com/google/auth/oauth2/RABManager.java

oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundaryManager.java

oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundary.java

oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java

oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundaryManager.java

…nce.

oauth2_http/java/com/google/auth/oauth2/ImpersonatedCredentials.java

oauth2_http/java/com/google/auth/oauth2/OAuth2Utils.java

oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundaryProvider.java

oauth2_http/java/com/google/auth/http/HttpCredentialsAdapter.java

oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundaryManager.java

lqiu96 · 2026-02-10T21:51:06Z

oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundary.java

@@ -193,33 +228,41 @@ static TrustBoundary refresh(
            .setInitialIntervalMillis(OAuth2Utils.INITIAL_RETRY_INTERVAL_MILLIS)
            .setRandomizationFactor(OAuth2Utils.RETRY_RANDOMIZATION_FACTOR)
            .setMultiplier(OAuth2Utils.RETRY_MULTIPLIER)
+            .setMaxElapsedTimeMillis(maxRetryElapsedTimeMillis)
            .build();

    HttpUnsuccessfulResponseHandler unsuccessfulResponseHandler =
-        new HttpBackOffUnsuccessfulResponseHandler(backoff);
+        new HttpBackOffUnsuccessfulResponseHandler(backoff)
+            .setBackOffRequired(
+                response -> {
+                  int statusCode = response.getStatusCode();
+                  return statusCode == 500
+                      || statusCode == 502
+                      || statusCode == 503
+                      || statusCode == 504;
+                });


qq, since the server-side will still make the RAB call if we have failure (e.g. no header is attached), can we have this call not have any retries and max duration of like 1-2s?

The reason I'm thinking this way is that the async RAB call uses ForkJoinPool's commonPool. I think we should try to time bound the IO requests that go to that executor pool since that is a JDK executor pool that is shared with the customer's application.

Yes, while requests will succeed without the RAB header, they are expected to encounter significant latency, hence we retry only on transient server errors which are expected to be short lived.

We'd like to ensure that there are as few requests as possible that go without the x-allowed-locations header.

oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java

oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundary.java

oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundaryManager.java

oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java

oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java

lqiu96 · 2026-02-10T22:12:57Z

Thanks for the clarification @vverman! Would it be possible to split the stable RAB + seeding logic into a separate PR?

…nted. Nit fixes.

nbayati · 2026-02-26T18:50:39Z

oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundary.java

+  public static final String X_ALLOWED_LOCATIONS_HEADER_KEY = "x-allowed-locations";
+  private static final long serialVersionUID = -2428522338274020302L;
+
+  static final String ENABLE_EXPERIMENT_ENV_VAR = "GOOGLE_AUTH_TRUST_BOUNDARY_ENABLE_EXPERIMENT";


I think we can remove the env var altogether since this is going to a feature branch and we don't need the feature gate for the release.

nbayati · 2026-02-26T20:00:23Z

oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundary.java

-   * Checks if the trust boundary feature is enabled based on an environment variable. The feature
-   * is enabled if the environment variable is set to "true" or "1" (case-insensitive). Any other
-   * value, or if the variable is unset, will result in the feature being disabled.
+   * Checks if the regional access boundary feature is enabled. The feature is enabled if the


Similar to my other comment, I think we can remove this method along with all env var related code, as they shouldn't be present in the final code being merged to main.

oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundary.java

oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundaryManager.java

nbayati · 2026-02-26T22:18:24Z

oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java

+        // Self-signed JWT do not go through the typical OAuth2Credentials.getRequestMetadata()
+        // flow.
+        // We explicitly trigger it here to ensure the RAB cache is populated/maintained.
+        refreshRegionalAccessBoundaryIfExpired(uri, wrappedToken);


IIUC, we're triggering a refresh here, but we're not attaching the RAB value to the metadata header if it already exists. It seems like the self signed jwt would never have this header.

Thank you for this very important observation. Turns out this wasn't caught because my test only checked whether the RABManager had the RAB property set to the expected value and I wasn't checking for whether the header was attached. Which is why this was missed.

I have corrected the logic and the test. I also checked tests of other supported clients and verified that they check the header!

oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java

…now considers expiryTime as opposed to start time. Minor fixes.

Added async logic for RAB refresh/ Now self-signed JWT are in RAB sco…

1b160a8

…pe. Updated tests.

vverman requested review from a team January 25, 2026 21:35

product-auto-label bot added the size: xl Pull request size is extra large. label Jan 25, 2026

Lint fixes.

525ae6d

vverman requested review from lqiu96 and nbayati January 25, 2026 21:49

Url for RAB to include only GDU. Only 500, 502, 503 and 504 lookup er…

b7058ea

…rors are now retryable.

lqiu96 changed the base branch from feat-tb-sa to feat/agentic-identities-cloudrun February 3, 2026 19:16

lqiu96 requested a review from a team as a code owner February 3, 2026 19:16

lqiu96 reviewed Feb 5, 2026

View reviewed changes

oauth2_http/java/com/google/auth/http/HttpCredentialsAdapter.java Outdated Show resolved Hide resolved

lqiu96 reviewed Feb 5, 2026

View reviewed changes

oauth2_http/java/com/google/auth/http/HttpCredentialsAdapter.java Outdated Show resolved Hide resolved

lqiu96 reviewed Feb 5, 2026

View reviewed changes

oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java Outdated Show resolved Hide resolved

lqiu96 reviewed Feb 5, 2026

View reviewed changes

oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java Outdated Show resolved Hide resolved

lqiu96 reviewed Feb 5, 2026

View reviewed changes

oauth2_http/java/com/google/auth/oauth2/RABManager.java Outdated Show resolved Hide resolved

lqiu96 reviewed Feb 6, 2026

View reviewed changes

oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundaryManager.java Show resolved Hide resolved

lqiu96 reviewed Feb 6, 2026

View reviewed changes

oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundary.java Outdated Show resolved Hide resolved

lqiu96 reviewed Feb 6, 2026

View reviewed changes

oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java Show resolved Hide resolved

lqiu96 reviewed Feb 6, 2026

View reviewed changes

oauth2_http/java/com/google/auth/oauth2/GoogleCredentials.java Show resolved Hide resolved

lqiu96 reviewed Feb 6, 2026

View reviewed changes

oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundaryManager.java Outdated Show resolved Hide resolved

vverman changed the base branch from feat/agentic-identities-cloudrun to feat-tb-sa February 6, 2026 22:40

vverman added 2 commits February 6, 2026 15:28

Addressed some PR comments.

e8832a1

Made cooldown into an AtomicReference removed the synchronized refere…

cf1a5e8

…nce.

lqiu96 reviewed Feb 9, 2026

View reviewed changes

oauth2_http/java/com/google/auth/oauth2/ImpersonatedCredentials.java Show resolved Hide resolved

lqiu96 reviewed Feb 9, 2026

View reviewed changes

oauth2_http/java/com/google/auth/oauth2/OAuth2Utils.java Show resolved Hide resolved

lqiu96 reviewed Feb 9, 2026

View reviewed changes

oauth2_http/java/com/google/auth/oauth2/RegionalAccessBoundaryProvider.java Show resolved Hide resolved

nbayati reviewed Feb 10, 2026

View reviewed changes

oauth2_http/java/com/google/auth/http/HttpCredentialsAdapter.java Outdated Show resolved Hide resolved