From 751f292a39078d7dcc1c523cde18847182bb9641 Mon Sep 17 00:00:00 2001
From: stim <timur@sadykov.me>
Date: Mon, 10 May 2021 10:43:11 -0700
Subject: [PATCH 1/6] logging issuer claim for service account on errors

---
 .../auth/oauth2/ServiceAccountCredentials.java | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java b/oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java
index c0b3cab98..40fd60147 100644
--- a/oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java
+++ b/oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java
@@ -648,7 +648,13 @@ public IdToken idTokenWithAudience(String targetAudience, List<Option> options)
     HttpRequestFactory requestFactory = transportFactory.create().createRequestFactory();
     HttpRequest request = requestFactory.buildPostRequest(new GenericUrl(tokenServerUri), content);
     request.setParser(new JsonObjectParser(jsonFactory));
-    HttpResponse response = request.execute();
+    HttpResponse response;
+    try {
+      response = request.execute();
+    } catch (IOException e) {
+      throw new IOException(
+          String.format("Error getting id token for service account: %s, iss: %s", e.getMessage(), getIssuer()), e);
+    }
 
     GenericData responseData = response.parseAs(GenericData.class);
     String rawToken = OAuth2Utils.validateString(responseData, "id_token", PARSE_ERROR_PREFIX);
@@ -755,6 +761,10 @@ public final URI getTokenServerUri() {
     return tokenServerUri;
   }
 
+  private String getIssuer() {
+    return this.clientEmail; 
+  }
+
   @VisibleForTesting
   int getLifetime() {
     return lifetime;
@@ -787,7 +797,7 @@ public byte[] sign(byte[] toSign) {
   @Override
   public JwtCredentials jwtWithClaims(JwtClaims newClaims) {
     JwtClaims.Builder claimsBuilder =
-        JwtClaims.newBuilder().setIssuer(clientEmail).setSubject(clientEmail);
+        JwtClaims.newBuilder().setIssuer(getIssuer()).setSubject(getIssuer());
     return JwtCredentials.newBuilder()
         .setPrivateKey(privateKey)
         .setPrivateKeyId(privateKeyId)
@@ -862,7 +872,7 @@ String createAssertion(JsonFactory jsonFactory, long currentTime, String audienc
     header.setKeyId(privateKeyId);
 
     JsonWebToken.Payload payload = new JsonWebToken.Payload();
-    payload.setIssuer(clientEmail);
+    payload.setIssuer(getIssuer());
     payload.setIssuedAtTimeSeconds(currentTime / 1000);
     payload.setExpirationTimeSeconds(currentTime / 1000 + this.lifetime);
     payload.setSubject(serviceAccountUser);
@@ -898,7 +908,7 @@ String createAssertionForIdToken(
     header.setKeyId(privateKeyId);
 
     JsonWebToken.Payload payload = new JsonWebToken.Payload();
-    payload.setIssuer(clientEmail);
+    payload.setIssuer(getIssuer());
     payload.setIssuedAtTimeSeconds(currentTime / 1000);
     payload.setExpirationTimeSeconds(currentTime / 1000 + this.lifetime);
     payload.setSubject(serviceAccountUser);

From 4ba54c08de3a1cf31643e4b7ceba7234104a668f Mon Sep 17 00:00:00 2001
From: stim <timur@sadykov.me>
Date: Mon, 10 May 2021 10:48:01 -0700
Subject: [PATCH 2/6] reverting setSubject

---
 .../com/google/auth/oauth2/ServiceAccountCredentials.java     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java b/oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java
index 40fd60147..ddab7acc3 100644
--- a/oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java
+++ b/oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java
@@ -609,7 +609,7 @@ public boolean isRequired(HttpResponse response) {
       response = request.execute();
     } catch (IOException e) {
       throw new IOException(
-          String.format("Error getting access token for service account: %s", e.getMessage()), e);
+          String.format("Error getting access token for service account: %s, iss: %s", e.getMessage(), getIssuer()), e);
     }
 
     GenericData responseData = response.parseAs(GenericData.class);
@@ -797,7 +797,7 @@ public byte[] sign(byte[] toSign) {
   @Override
   public JwtCredentials jwtWithClaims(JwtClaims newClaims) {
     JwtClaims.Builder claimsBuilder =
-        JwtClaims.newBuilder().setIssuer(getIssuer()).setSubject(getIssuer());
+        JwtClaims.newBuilder().setIssuer(getIssuer()).setSubject(clientEmail);
     return JwtCredentials.newBuilder()
         .setPrivateKey(privateKey)
         .setPrivateKeyId(privateKeyId)

From 26a1fcbd26c2207149fc04d94f33be7dfe8eb75a Mon Sep 17 00:00:00 2001
From: Timur Sadykov <stim@google.com>
Date: Tue, 11 May 2021 01:14:23 -0700
Subject: [PATCH 3/6] linter fixes

---
 .../auth/oauth2/ServiceAccountCredentials.java       | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java b/oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java
index ddab7acc3..377b4dbf1 100644
--- a/oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java
+++ b/oauth2_http/java/com/google/auth/oauth2/ServiceAccountCredentials.java
@@ -609,7 +609,10 @@ public boolean isRequired(HttpResponse response) {
       response = request.execute();
     } catch (IOException e) {
       throw new IOException(
-          String.format("Error getting access token for service account: %s, iss: %s", e.getMessage(), getIssuer()), e);
+          String.format(
+              "Error getting access token for service account: %s, iss: %s",
+              e.getMessage(), getIssuer()),
+          e);
     }
 
     GenericData responseData = response.parseAs(GenericData.class);
@@ -653,7 +656,10 @@ public IdToken idTokenWithAudience(String targetAudience, List<Option> options)
       response = request.execute();
     } catch (IOException e) {
       throw new IOException(
-          String.format("Error getting id token for service account: %s, iss: %s", e.getMessage(), getIssuer()), e);
+          String.format(
+              "Error getting id token for service account: %s, iss: %s",
+              e.getMessage(), getIssuer()),
+          e);
     }
 
     GenericData responseData = response.parseAs(GenericData.class);
@@ -762,7 +768,7 @@ public final URI getTokenServerUri() {
   }
 
   private String getIssuer() {
-    return this.clientEmail; 
+    return this.clientEmail;
   }
 
   @VisibleForTesting

From b7692954efeef5479861ae6082a0c732b388b5cd Mon Sep 17 00:00:00 2001
From: Timur Sadykov <stim@google.com>
Date: Fri, 14 May 2021 12:22:47 -0700
Subject: [PATCH 4/6] stub for the test

---
 .../oauth2/ServiceAccountCredentialsTest.java | 31 +++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/oauth2_http/javatests/com/google/auth/oauth2/ServiceAccountCredentialsTest.java b/oauth2_http/javatests/com/google/auth/oauth2/ServiceAccountCredentialsTest.java
index e75a70257..1213f0b57 100644
--- a/oauth2_http/javatests/com/google/auth/oauth2/ServiceAccountCredentialsTest.java
+++ b/oauth2_http/javatests/com/google/auth/oauth2/ServiceAccountCredentialsTest.java
@@ -1189,6 +1189,37 @@ public void fromStream_noClientEmail_throws() throws IOException {
     testFromStreamException(serviceAccountStream, "client_email");
   }
 
+  @Test
+  public void getIdTokenWithAudience_noClientEmail_throws() throws IOException {
+    String accessToken1 = "1/MkSJoj1xsli0AccessToken_NKPY2";
+    MockTokenServerTransportFactory transportFactory = new MockTokenServerTransportFactory();
+    MockTokenServerTransport transport = transportFactory.transport;
+    ServiceAccountCredentials credentials =
+        ServiceAccountCredentials.fromPkcs8(
+            CLIENT_ID,
+            CLIENT_EMAIL,
+            PRIVATE_KEY_PKCS8,
+            PRIVATE_KEY_ID,
+            SCOPES,
+            transportFactory,
+            null);
+
+    transport.addServiceAccount("sdfgkjl", accessToken1);
+    TestUtils.assertContainsBearerToken(credentials.getRequestMetadata(CALL_URI), accessToken1);
+
+    String targetAudience = "https://bar";
+    IdTokenCredentials tokenCredential =
+        IdTokenCredentials.newBuilder()
+            .setIdTokenProvider(credentials)
+            .setTargetAudience(targetAudience)
+            .build();
+    tokenCredential.refresh();
+    assertNotEquals(
+        targetAudience,
+        (String) tokenCredential.getIdToken().getJsonWebSignature().getPayload().getAudience());
+  
+  }
+
   @Test
   public void fromStream_noPrivateKey_throws() throws IOException {
     InputStream serviceAccountStream =

From 8f3cd8c95b7d68531cbc0cdfb0577da5db5cdb5b Mon Sep 17 00:00:00 2001
From: TimurSadykov <stim@google.com>
Date: Mon, 17 May 2021 01:48:42 -0700
Subject: [PATCH 5/6] test for modified error message

---
 .../oauth2/ServiceAccountCredentialsTest.java | 20 +++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/oauth2_http/javatests/com/google/auth/oauth2/ServiceAccountCredentialsTest.java b/oauth2_http/javatests/com/google/auth/oauth2/ServiceAccountCredentialsTest.java
index 1213f0b57..c8abab2eb 100644
--- a/oauth2_http/javatests/com/google/auth/oauth2/ServiceAccountCredentialsTest.java
+++ b/oauth2_http/javatests/com/google/auth/oauth2/ServiceAccountCredentialsTest.java
@@ -1190,10 +1190,10 @@ public void fromStream_noClientEmail_throws() throws IOException {
   }
 
   @Test
-  public void getIdTokenWithAudience_noClientEmail_throws() throws IOException {
-    String accessToken1 = "1/MkSJoj1xsli0AccessToken_NKPY2";
+  public void getIdTokenWithAudience_badEmailError_issClaimTraced() throws IOException {
     MockTokenServerTransportFactory transportFactory = new MockTokenServerTransportFactory();
     MockTokenServerTransport transport = transportFactory.transport;
+    transport.setError(new IOException("Invalid grant: Account not found"));
     ServiceAccountCredentials credentials =
         ServiceAccountCredentials.fromPkcs8(
             CLIENT_ID,
@@ -1204,20 +1204,20 @@ public void getIdTokenWithAudience_noClientEmail_throws() throws IOException {
             transportFactory,
             null);
 
-    transport.addServiceAccount("sdfgkjl", accessToken1);
-    TestUtils.assertContainsBearerToken(credentials.getRequestMetadata(CALL_URI), accessToken1);
-
     String targetAudience = "https://bar";
     IdTokenCredentials tokenCredential =
         IdTokenCredentials.newBuilder()
             .setIdTokenProvider(credentials)
             .setTargetAudience(targetAudience)
             .build();
-    tokenCredential.refresh();
-    assertNotEquals(
-        targetAudience,
-        (String) tokenCredential.getIdToken().getJsonWebSignature().getPayload().getAudience());
-  
+            
+    String expectedErrorMessage = String.format("iss: %s", CLIENT_EMAIL);
+
+    try {
+      tokenCredential.refresh();
+    } catch (IOException expected) {
+      assertTrue(expected.getMessage().contains(expectedErrorMessage));
+    }
   }
 
   @Test

From 8301d56b8b1542f44dcbe83ed3d189c4abfcbe44 Mon Sep 17 00:00:00 2001
From: TimurSadykov <stim@google.com>
Date: Mon, 17 May 2021 01:51:04 -0700
Subject: [PATCH 6/6] linter fix

---
 .../com/google/auth/oauth2/ServiceAccountCredentialsTest.java   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/oauth2_http/javatests/com/google/auth/oauth2/ServiceAccountCredentialsTest.java b/oauth2_http/javatests/com/google/auth/oauth2/ServiceAccountCredentialsTest.java
index c8abab2eb..3fc903d73 100644
--- a/oauth2_http/javatests/com/google/auth/oauth2/ServiceAccountCredentialsTest.java
+++ b/oauth2_http/javatests/com/google/auth/oauth2/ServiceAccountCredentialsTest.java
@@ -1210,7 +1210,7 @@ public void getIdTokenWithAudience_badEmailError_issClaimTraced() throws IOExcep
             .setIdTokenProvider(credentials)
             .setTargetAudience(targetAudience)
             .build();
-            
+
     String expectedErrorMessage = String.format("iss: %s", CLIENT_EMAIL);
 
     try {