Skip to content

Implement gRFC A97: xDS JWT Call Credentials - #12951

Open
khush2520 wants to merge 11 commits into
grpc:masterfrom
khush2520:a97-revised
Open

Implement gRFC A97: xDS JWT Call Credentials#12951
khush2520 wants to merge 11 commits into
grpc:masterfrom
khush2520:a97-revised

Conversation

@khush2520

@khush2520 khush2520 commented Jul 29, 2026

Copy link
Copy Markdown

Implements gRFC A97 to support file-based JSON Web Token (JWT) Call Credentials for xDS-enabled clients. Implemented using an experimental coding agent.
Summary of Changes

  • Core JWT Capabilities: Added JwtTokenFileCallCredentials in grpc-auth for lazy-loading, caching, exp-claim validation, and asynchronous token refresh via ExponentialBackoffPolicy.
  • xDS Bootstrap Parser Integration: Updated BootstrapperImpl and ServerInfo in grpc-xds to parse call_creds JSON lists, combining them utilizing composite credentials. Flag-guarded securely behind GRPC_EXPERIMENTAL_XDS_BOOTSTRAP_CALL_CREDS.
  • Testing: Added rigorous unit tests and an end-to-end XdsJwtCallCredsIntegrationTest verifying real client-to-server TLS + JWT Authorization transmission.

@linux-foundation-easycla

linux-foundation-easycla Bot commented Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown

CLA Signed
The committers listed above are authorized under a signed CLA.

@shivaspeaks
shivaspeaks requested review from AgraVator and shivaspeaks and removed request for AgraVator July 30, 2026 06:22
shivaspeaks
shivaspeaks requested changes Jul 30, 2026
View reviewed changes

@shivaspeaks shivaspeaks left a comment •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sending what I have with the high level review.

Comment thread auth/src/main/java/io/grpc/auth/JwtTokenFileCallCredentials.java Outdated
Comment thread auth/src/main/java/io/grpc/auth/JwtTokenFileCallCredentials.java Outdated
Comment thread xds/src/main/java/io/grpc/xds/client/BootstrapperImpl.java
Comment thread xds/src/main/java/io/grpc/xds/client/BootstrapperImpl.java Outdated
Comment thread xds/src/test/java/io/grpc/xds/GrpcBootstrapperImplTest.java
Comment thread xds/src/test/java/io/grpc/xds/GrpcBootstrapperImplTest.java Outdated
Comment thread xds/src/test/java/io/grpc/xds/XdsJwtCallCredsIntegrationTest.java Outdated
@shivaspeaks

shivaspeaks commented Jul 31, 2026

Copy link
Copy Markdown
Member

/gemini review

gemini-code-assist[bot]
gemini-code-assist Bot reviewed Jul 31, 2026
View reviewed changes

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces JwtTokenFileCallCredentials to load, parse, cache, and refresh JWT tokens from a file, and integrates it into the xDS bootstrap configuration to support call_creds. The review feedback identifies two bugs in JwtTokenFileCallCredentials: a critical issue where valid cached tokens are ignored during backoff after a failed background refresh, and a potential integer overflow when calculating expirationTimeMillis from large exp claims.

Comment thread auth/src/main/java/io/grpc/auth/JwtTokenFileCallCredentials.java
Comment thread auth/src/main/java/io/grpc/auth/JwtTokenFileCallCredentials.java
khush2520 and others added 5 commits July 31, 2026 09:35
@khush2520
Fix JwtTokenFileCallCredentials BACKOFF cache and imports
3a6229c
@khush2520
Make enableXdsBootstrapCallCreds public and fix jwt_token_file refere…
be8f911 
…nces
@khush2520
Make enableXdsBootstrapCallCreds public and fix jwt_token_file refere…
c048696 
…nces
@khush2520
Merge branch 'a97-revised' of github.com:khush2520/grpc-java-retro in…
e934d90 
…to a97-revised
@khush2520 @gemini-code-assist
Update auth/src/main/java/io/grpc/auth/JwtTokenFileCallCredentials.java
b7a25c0 
Add a defensive check to prevent overflow by capping the expiration time at Long.MAX_VALUE if expSeconds is too large.

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
@khush2520

khush2520 commented Jul 31, 2026

Copy link
Copy Markdown
Author

/gemini review

gemini-code-assist[bot]
gemini-code-assist Bot reviewed Jul 31, 2026
View reviewed changes

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces JwtTokenFileCallCredentials to load, parse, and cache JWT tokens from a file, and integrates it into the xDS bootstrap configuration under an experimental flag. It also updates GrpcXdsTransportFactory to support composite call credentials. The review feedback highlights two important safety improvements in JwtTokenFileCallCredentials: using a bounded stream when reading the token file to prevent potential OutOfMemoryError on special devices, and adding a null check on the parsed JSON element to avoid a NullPointerException when handling malformed payloads.

Comment thread auth/src/main/java/io/grpc/auth/JwtTokenFileCallCredentials.java
Comment thread auth/src/main/java/io/grpc/auth/JwtTokenFileCallCredentials.java
shivaspeaks
shivaspeaks reviewed Aug 4, 2026
View reviewed changes
Comment thread auth/src/main/java/io/grpc/auth/JwtTokenFileCallCredentials.java Outdated
kannanjgithub
kannanjgithub requested changes Aug 4, 2026
View reviewed changes
Comment thread xds/src/main/java/io/grpc/xds/client/LoadStatsManager2.java
*/
@ThreadSafe
@Internal
public final class LoadStatsManager2 {

@kannanjgithub kannanjgithub Aug 4, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The changes in LoadStatsManager2.java, LoadReportClientTest.java and LoadStatsManager2Test.java are unrelated to gRPC A97.

Comment thread xds/src/main/java/io/grpc/xds/client/Bootstrapper.java
}

@VisibleForTesting
public static ServerInfo create(

@kannanjgithub kannanjgithub Aug 4, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No need for the new overload, as this method is now left with no other callers in non-test code. Just modify signature of existing method.

@khush2520 khush2520 Aug 4, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

While it has no production callers left, the 6-argument ServerInfo.create() is heavily used across dozens of test suites. Keeping it as a @VisibleForTesting overload prevents polluting all those test calls with unnecessary null values for CallCredentials.

Comment thread auth/src/main/java/io/grpc/auth/JwtTokenFileCallCredentials.java Outdated
Comment thread auth/src/main/java/io/grpc/auth/JwtTokenFileCallCredentials.java Outdated
Comment thread auth/src/main/java/io/grpc/auth/JwtTokenFileCallCredentials.java Outdated
Comment thread xds/src/test/java/io/grpc/xds/GrpcBootstrapperImplTest.java
Comment thread xds/src/main/java/io/grpc/xds/client/BootstrapperImpl.java
Comment thread auth/src/main/java/io/grpc/auth/JwtTokenFileCallCredentials.java
Comment thread auth/src/main/java/io/grpc/auth/JwtTokenFileCallCredentials.java
@khush2520
khush2520 force-pushed the a97-revised branch 2 times, most recently from 1088069 to 535f3c9 Compare August 4, 2026 17:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@shivaspeaks shivaspeaks shivaspeaks requested changes
@kannanjgithub kannanjgithub kannanjgithub requested changes
@AgraVator AgraVator Awaiting requested review from AgraVator
+1 more reviewer
@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Requested changes must be addressed to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@khush2520 @shivaspeaks @kannanjgithub