fix(oauth2): strictly require key_path and verifyKeyPair for bound token credentials

Author: macastelaz

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AgentIdentityUtils.java

@@ -454,8 +454,6 @@ static CertInfo loadAndVerifyCredentials(final String certPath, final String key
             if (currentKeyMeta != null && currentKeyMeta.matches(cached.keyMetadata)) {
               return cached.certInfo;
             }
-          } else if (cached.keyMetadata == null) {
-            return cached.certInfo;
           }
         }
       } catch (IOException ignored) {
@@ -478,13 +476,21 @@ static CertInfo loadAndVerifyCredentials(final String certPath, final String key
         }
 
         if (Strings.isNullOrEmpty(keyPath)) {
-          // Certificate-only configuration (e.g. sidecar/proxy mTLS termination where the
-          // private key is isolated from the application container).
-          CertInfo info = new CertInfo(cert, certContent);
-          if (certMeta != null && certMeta.matches(FileMetadata.of(certPath))) {
-            cachedCredentials = new CachedCredentials(certMeta, null, true, info);
+          boolean explicitConfigOrMtls =
+              !Strings.isNullOrEmpty(envReader.getEnv(GOOGLE_API_CERTIFICATE_CONFIG))
+                  || "true".equalsIgnoreCase(envReader.getEnv(GOOGLE_API_USE_CLIENT_CERTIFICATE));
+          if (explicitConfigOrMtls) {
+            throw new IOException(
+                "Private key is required for Agent Identity bound token request, but key path is"
+                    + " missing.");
           }
-          return info;
+          Slf4jUtils.log(
+              LOGGER,
+              org.slf4j.event.Level.WARN,
+              Collections.emptyMap(),
+              "Private key path is missing for Agent Identity certificate. Falling back to unbound"
+                  + " token.");
+          return null;
         }
 
         FileMetadata keyMeta = FileMetadata.of(keyPath);
@@ -514,6 +520,11 @@ static CertInfo loadAndVerifyCredentials(final String certPath, final String key
             "Permission denied reading certificate or key files. Falling back to"
                 + " unbound token.");
         return null;
+      } catch (IOException e) {
+        if (Strings.isNullOrEmpty(keyPath)) {
+          throw e;
+        }
+        LOGGER.warn("Failed to read or verify cert/key, retrying...", e);
       } catch (Exception e) {
         LOGGER.warn("Failed to read or verify cert/key, retrying...", e);
       }

google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/AgentIdentityUtilsTest.java

@@ -1001,7 +1001,7 @@ public void getAgentIdentityCertInfo_explicitMtlsEnabled_missingPrivateKey_throw
   }
 
   @Test
-  public void getAgentIdentityCertInfo_certificateOnlyConfig_omittedKeyPath_returnsCertInfo()
+  public void getAgentIdentityCertInfo_certificateOnlyConfig_omittedKeyPath_throwsIOException()
       throws Exception {
     URL certUrl = getClass().getClassLoader().getResource("agent/agent_spiffe_cert.pem");
     assertNotNull(certUrl);
@@ -1024,13 +1024,13 @@ public void getAgentIdentityCertInfo_certificateOnlyConfig_omittedKeyPath_return
     FakeTimeService fakeTime = new FakeTimeService();
     AgentIdentityUtils.setTimeService(fakeTime);
 
-    AgentIdentityUtils.CertInfo info1 = AgentIdentityUtils.getAgentIdentityCertInfo();
-    assertNotNull(info1);
+    IOException e = assertThrows(IOException.class, AgentIdentityUtils::getAgentIdentityCertInfo);
+    assertTrue(
+        e.getMessage()
+            .contains(
+                "Private key is required for Agent Identity bound token request, but key path is"
+                    + " missing."));
     assertEquals(0, fakeTime.getSleepCount());
-
-    // Subsequent call returns cached instance
-    AgentIdentityUtils.CertInfo info2 = AgentIdentityUtils.getAgentIdentityCertInfo();
-    assertSame(info1, info2);
   }
 
   @Test