feat(auth): mTLS endpoint for Regional Access Boundaries by vverman · Pull Request #13318 · googleapis/google-cloud-java

Commits on Jul 15, 2026

Added changes to enable cert-discovery and mtls by default in the auth library.
vverman
committed
88d72e6
Added changes for RAB mtls endpoint.
vverman
committed
9744fbc
Removed redundant call to canMtlsbeEnabled.
vverman
committed
0f854b2
Added GOOGLE_API_USE_MTLS_ENDPOINT check to canMtlsBeEnabled.
vverman
committed
e39f22b
RAB lookup url replacement to mtls is made more robust.
vverman
committed
cc55e6f
Added changes to always call mTLS RAB endpoint. Removed SPIFFE fallback.
vverman
committed
f277608
nit Fixes.
vverman
committed
c9bd60b
Moved cert-discovery to a common function. Addressed PR comments.
vverman
committed
4ba1d2f
cache userMtlsPolicy so we read only once other comment addressals.
vverman
committed
9bd60fd
lint fixes.
vverman
committed
e6d3be9
canMtlsBeEnabled changes.
vverman
committed
dcb4c18
userMtlsPolicy DCL lock check for concurrency.
vverman
committed
afde0d3
fix: address technical review findings for regional access boundary mTLS refresh
vverman
committed
b65c895
lint fixes.
vverman
committed
579f4bf
Changed check to enable mTLS so we only do it once every ~5 hours.
vverman
committed
76a22bb
lint fixes.
vverman
committed
3fed9f7
feat(mtls): support custom HttpTransportFactory with mTLS and improve exception wrapping
vverman
committed
d6331d9
test fix.
vverman
committed
13c69af
Improves regional access boundary cooldown on task submission failures, adds 3-minute token clock skew buffer, and fixes mTLS fallback logic.
vverman
committed
ba2d3ca
removed test which needed static mocking.
vverman
committed
bcc2932
Added double check when refreshing RAB to ensure no duplicated refreshes are queued.
vverman
committed
99d19a0

Commits on Jul 16, 2026

Commits on Jul 17, 2026

Added check in canBeEnabled to check for cert & key file presence.
vverman
committed
863e964

Commits on Jul 20, 2026

Commits on Jul 30, 2026

test fix.
vverman
committed
0d37a43

Navigation Menu

Uh oh!

feat(auth): mTLS endpoint for Regional Access Boundaries - #13318

feat(auth): mTLS endpoint for Regional Access Boundaries#13318
lqiu96 merged 30 commits into
googleapis:new-regional-access-boundaries-july2026from
vverman:regional-access-boundaries

Commits on Jul 15, 2026

Added changes to enable cert-discovery and mtls by default in the auth library.

Added changes for RAB mtls endpoint.

Removed redundant call to canMtlsbeEnabled.

Added GOOGLE_API_USE_MTLS_ENDPOINT check to canMtlsBeEnabled.

RAB lookup url replacement to mtls is made more robust.

Added changes to always call mTLS RAB endpoint. Removed SPIFFE fallback.

nit Fixes.

Moved cert-discovery to a common function. Addressed PR comments.

cache userMtlsPolicy so we read only once other comment addressals.

lint fixes.

canMtlsBeEnabled changes.

userMtlsPolicy DCL lock check for concurrency.

fix: address technical review findings for regional access boundary mTLS refresh

lint fixes.

Changed check to enable mTLS so we only do it once every ~5 hours.

lint fixes.

feat(mtls): support custom HttpTransportFactory with mTLS and improve exception wrapping

test fix.

Improves regional access boundary cooldown on task submission failures, adds 3-minute token clock skew buffer, and fixes mTLS fallback logic.

removed test which needed static mocking.

Added double check when refreshing RAB to ensure no duplicated refreshes are queued.

Commits on Jul 16, 2026

decouple mTLS endpoint selection and certificate availability checks per AIP-4114, removing fail-fast exceptions when client certificates are unavailable under always policy.

restore X509Provider.isAvailable to check certificate store availability rather than configuration flags, and add unit tests.

Commits on Jul 17, 2026

Added check in canBeEnabled to check for cert & key file presence.

Commits on Jul 20, 2026

Removed duplicate call to handleRefreshFailure.

Removed redundant check for user-transport-override in prepareTransportFactoryIfMtlsEnabled.

Added a shouldStartBackgroundRefresh check before and after acquiring a lock for RAB background refresh as a guard against multiple duplicated refreshes.

Commits on Jul 30, 2026

test fix.

Commits on Aug 5, 2026

chore(auth): resolve merge conflicts and migrate to JSpecify annotations

chore: Update mockito to support java 8 jspecify annotations