Implement gRFC A97: xDS JWT Call Credentials by khush2520 · Pull Request #12951 · grpc/grpc-java

khush2520 · 2026-07-29T16:05:36Z

Implements gRFC A97 to support file-based JSON Web Token (JWT) Call Credentials for xDS-enabled clients. Implemented using an experimental coding agent.
Summary of Changes

Core JWT Capabilities: Added JwtTokenFileCallCredentials in grpc-auth for lazy-loading, caching, exp-claim validation, and asynchronous token refresh via ExponentialBackoffPolicy.
xDS Bootstrap Parser Integration: Updated BootstrapperImpl and ServerInfo in grpc-xds to parse call_creds JSON lists, combining them utilizing composite credentials. Flag-guarded securely behind GRPC_EXPERIMENTAL_XDS_BOOTSTRAP_CALL_CREDS.
Testing: Added rigorous unit tests and an end-to-end XdsJwtCallCredsIntegrationTest verifying real client-to-server TLS + JWT Authorization transmission.

linux-foundation-easycla · 2026-07-29T16:05:43Z

The committers listed above are authorized under a signed CLA.

✅ login: khush2520 / name: Khooshi Asmi (b7a25c0, e5863c6, 3a6229c, 6bc5e3e, 74a0ff7, 86b77fb, 9f2a2e9, a489b03, be8f911, c048696, c97e6b5, c9803c2, e934d90)

shivaspeaks

Sending what I have with the high level review.

shivaspeaks · 2026-07-31T05:22:40Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces JwtTokenFileCallCredentials to load, parse, cache, and refresh JWT tokens from a file, and integrates it into the xDS bootstrap configuration to support call_creds. The review feedback identifies two bugs in JwtTokenFileCallCredentials: a critical issue where valid cached tokens are ignored during backoff after a failed background refresh, and a potential integer overflow when calculating expirationTimeMillis from large exp claims.

…nces

…to a97-revised

Add a defensive check to prevent overflow by capping the expiration time at Long.MAX_VALUE if expSeconds is too large. Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

khush2520 · 2026-07-31T11:16:28Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces JwtTokenFileCallCredentials to load, parse, and cache JWT tokens from a file, and integrates it into the xDS bootstrap configuration under an experimental flag. It also updates GrpcXdsTransportFactory to support composite call credentials. The review feedback highlights two important safety improvements in JwtTokenFileCallCredentials: using a bounded stream when reading the token file to prevent potential OutOfMemoryError on special devices, and adding a null check on the parsed JSON element to avoid a NullPointerException when handling malformed payloads.

kannanjgithub · 2026-08-04T09:00:10Z

No need for the new overload, as this method is now left with no other callers in non-test code. Just modify signature of existing method.

While it has no production callers left, the 6-argument ServerInfo.create() is heavily used across dozens of test suites. Keeping it as a @VisibleForTesting overload prevents polluting all those test calls with unnecessary null values for CallCredentials.

Modifying a lot of tests to switch over to the new method with CallCredentials is fine. The only cases where we prefer to have overloaded methods omitting certain arguments are if there are legitimate production code callers for it or if the method is public and we dont' want to break downstream projects. But Bootstrapper although public, is an @Internal class, so the 2nd consideration doesn't really apply here.

kannanjgithub · 2026-08-05T06:23:34Z

Modifying a lot of tests to switch over to the new method with CallCredentials is fine. The only cases where we prefer to have overloaded methods omitting certain arguments are if there are legitimate production code callers for it or if the method is public and we dont' want to break downstream projects. But Bootstrapper although public, is an @Internal class, so the 2nd consideration doesn't really apply here.

…ixes)

shivaspeaks · 2026-08-05T14:08:55Z

+      headers.put(AUTHORIZATION_HEADER, "Bearer " + tokenInfo.token);
+      for (MetadataApplier applier : appliersToApply) {
+        try {
+          applier.apply(headers);


Our Metadata.java is not threadsafe.
I believe every RPC should get its own distinct, unshared Metadata because if multiple RPCs process this shared Metadata instance concurrently, or if an interceptor mutates it, you will get data corruption

CC: @kannanjgithub WDYT?

shivaspeaks · 2026-08-05T14:09:02Z

+
+      if (hasValidCache) {
+        tokenToApply = new TokenInfo(cachedToken, expirationTimeMillis);
+        if (readState == ReadState.BACKOFF && now >= nextAttemptTimeMillis) {


Is this redundant?
Because we already execute this exact check at the very beginning of the synchronized block and since this block executes under a lock, readState cannot possibly revert to ReadState.BACKOFF.

shivaspeaks · 2026-08-05T14:09:04Z

+          triggerRead = true;
+        }
+      } else {
+        if (readState == ReadState.BACKOFF && now >= nextAttemptTimeMillis) {


Same applies here.

khush2520 added 3 commits July 29, 2026 16:10

Implement Core JWT Call Credentials (Task 1)

6bc5e3e

Implement xDS Bootstrap Parsing and Transport Integration (Task 2)

86b77fb

Implement Integration Verification (Task 3)

c97e6b5

khush2520 force-pushed the a97-revised branch from 75fe020 to c97e6b5 Compare July 29, 2026 16:15

Add gson in bazel BUILD

e5863c6

shivaspeaks requested review from AgraVator and shivaspeaks and removed request for AgraVator July 30, 2026 06:22

shivaspeaks requested changes Jul 30, 2026

View reviewed changes

gemini-code-assist Bot reviewed Jul 31, 2026

View reviewed changes

Comment thread auth/src/main/java/io/grpc/auth/JwtTokenFileCallCredentials.java

Comment thread auth/src/main/java/io/grpc/auth/JwtTokenFileCallCredentials.java

khush2520 and others added 5 commits July 31, 2026 09:35

Fix JwtTokenFileCallCredentials BACKOFF cache and imports

3a6229c

Make enableXdsBootstrapCallCreds public and fix jwt_token_file refere…

be8f911

…nces

Make enableXdsBootstrapCallCreds public and fix jwt_token_file refere…

c048696

…nces

Merge branch 'a97-revised' of github.com:khush2520/grpc-java-retro in…

e934d90

…to a97-revised

gemini-code-assist Bot reviewed Jul 31, 2026

View reviewed changes

Comment thread auth/src/main/java/io/grpc/auth/JwtTokenFileCallCredentials.java

Comment thread auth/src/main/java/io/grpc/auth/JwtTokenFileCallCredentials.java

Address Gemini review: bounded file read & JsonParser null check

c9803c2

shivaspeaks requested a review from kannanjgithub August 3, 2026 19:19

shivaspeaks reviewed Aug 4, 2026

View reviewed changes

Comment thread auth/src/main/java/io/grpc/auth/JwtTokenFileCallCredentials.java Outdated

kannanjgithub requested changes Aug 4, 2026

View reviewed changes

khush2520 force-pushed the a97-revised branch 2 times, most recently from 1088069 to 535f3c9 Compare August 4, 2026 17:57

Address PR review comments

9f2a2e9

khush2520 force-pushed the a97-revised branch from 535f3c9 to 9f2a2e9 Compare August 4, 2026 18:03

kannanjgithub requested changes Aug 5, 2026

View reviewed changes

kannanjgithub reviewed Aug 5, 2026

View reviewed changes

Comment thread xds/src/main/java/io/grpc/xds/client/Bootstrapper.java

kannanjgithub approved these changes Aug 5, 2026

View reviewed changes

khush2520 added 2 commits August 5, 2026 13:07

Refactor Bootstrapper ServerInfo creation overloads (including test f…

74a0ff7

…ixes)

Add @VisibleForTesting to ServerInfo.create

a489b03

khush2520 force-pushed the a97-revised branch from 0aa8af6 to a489b03 Compare August 5, 2026 13:08

AgraVator approved these changes Aug 5, 2026

View reviewed changes

shivaspeaks reviewed Aug 5, 2026

View reviewed changes

Uh oh!

Conversation

khush2520 commented Jul 29, 2026

Uh oh!

linux-foundation-easycla Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

shivaspeaks left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

shivaspeaks commented Jul 31, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

khush2520 commented Jul 31, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kannanjgithub Aug 4, 2026

Choose a reason for hiding this comment

Uh oh!

khush2520 Aug 4, 2026

Choose a reason for hiding this comment

Uh oh!

kannanjgithub Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kannanjgithub Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

shivaspeaks Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

shivaspeaks Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

shivaspeaks Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

linux-foundation-easycla Bot commented Jul 29, 2026 •

edited

Loading

shivaspeaks left a comment •

edited

Loading