Open
Description
We would like to implement X.509 WIF mTLS-transport support in Java Gax lib (to bring it to feature-parity with Golang and Python).
The 4-year old mTLS implementation in GAX only supports the legacy SecureConnect based mTLS. We've recently updated the Java Auth lib to support both the old SecureConnect based mTLS as well as the newer X.509 WIF based mTLS. The Gax library needs to be updated to call into the Java Auth Lib for mTLS provider, so it can use either implementation of mTLS based on availability.
Additional Call-outs:
- The existing implementation of "SecureConnect based mTLS in the GAX" library will be considered deprecated and retained for backwards compatibility, but we are not aware of any direct usage of these old classes, since it is an internal feature.
- There is an env var GOOGLE_API_USE_CLIENT_CERTIFICATE that gates the mTLS-usage in the transport layer (for both X.509 based mTLS and SecureConnect based mTLS). Currently, the default behavior in Java Gax lib when this env var is not set on the machine is that we will not use mTLS in the transport layer. This is actually different from the Golang SDK default behavior, where the default semantics is to enable mTLS unless the env var is set to "false". We would like to flip the switch to make mTLS support enabled by default in Java SDK at some point as well, but it will be done as a separate step, after we confirmed the refactoring support in GAX for X.509 based mTLS is stable.
Metadata
Metadata
Assignees
Labels
No labels