feat(oauth2): support non-mTLS token URLs and unbound actor tokens in IdentityPoolCredentials

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java

@@ -363,7 +363,7 @@
    * external source for authentication to Google Cloud Platform, you must validate it before
    * providing it to any Google API or library. Providing an unvalidated credential configuration to
    * Google APIs can compromise the security of your systems and data. For more information, refer
    * to {@see <a
    * href="https://cloud.google.com/docs/authentication/external/externally-sourced-credentials">documentation</a>}.
    *
    * @param credentialsStream the stream with the credential definition
@@ -384,7 +384,7 @@
    * external source for authentication to Google Cloud Platform, you must validate it before
    * providing it to any Google API or library. Providing an unvalidated credential configuration to
    * Google APIs can compromise the security of your systems and data. For more information, refer
    * to {@see <a
    * href="https://cloud.google.com/docs/authentication/external/externally-sourced-credentials">documentation</a>}.
    *
    * @param credentialsStream the stream with the credential definition
@@ -522,8 +522,21 @@
         && ((String) credentialSource.get("environment_id")).startsWith("aws");
   }
 
-  private boolean shouldBuildImpersonatedCredential() {
-    return this.serviceAccountImpersonationUrl != null && this.impersonatedCredentials == null;
+  @Nullable ImpersonatedCredentials getImpersonatedCredentials() {
+    if (this.serviceAccountImpersonationUrl == null) {
+      return null;
+    }
+    ImpersonatedCredentials local = this.impersonatedCredentials;
+    if (local == null) {
+      synchronized (this) {
+        local = this.impersonatedCredentials;
+        if (local == null) {
+          local = this.buildImpersonatedCredentials();
+          this.impersonatedCredentials = local;
+        }
+      }
+    }
+    return local;
   }
 
   /**
@@ -552,11 +565,9 @@
       StsTokenExchangeRequest stsTokenExchangeRequest, HttpTransportFactory cycleTransportFactory)
       throws IOException {
     // Handle service account impersonation if necessary.
-    if (this.shouldBuildImpersonatedCredential()) {
-      this.impersonatedCredentials = this.buildImpersonatedCredentials();
-    }
-    if (this.impersonatedCredentials != null) {
-      return this.impersonatedCredentials.refreshAccessToken();
+    ImpersonatedCredentials impersonated = getImpersonatedCredentials();
+    if (impersonated != null) {
+      return impersonated.refreshAccessToken();
     }
 
     StsRequestHandler.Builder requestHandler =

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/FileIdentityPoolSubjectTokenSupplier.java

@@ -172,7 +172,12 @@ private static String extractField(GenericJson json, String fieldName) throws IO
               + " must be a String but was: "
               + value.getClass().getName());
     }
-    return (String) value;
+    String token = (String) value;
+    if (token.trim().isEmpty()) {
+      throw new IOException(
+          "Invalid token field value. Empty token was found for field: " + fieldName);
+    }
+    return token;
   }
 
   /** Used primarily for UrlIdentityPoolSubjectTokenSupplier */
@@ -195,19 +200,7 @@ static String parseToken(
       GenericJson fileContents =
           parser.parseAndClose(in, StandardCharsets.UTF_8, GenericJson.class);
 
-      Object value = fileContents.get(targetFieldName);
-      if (value == null || Data.isNull(value)) {
-        throw new IOException(
-            "Invalid token field name. No token was found for field: " + targetFieldName);
-      }
-      if (!(value instanceof String)) {
-        throw new IOException(
-            "Token field value for "
-                + targetFieldName
-                + " must be a String but was: "
-                + value.getClass().getName());
-      }
-      return (String) value;
+      return extractField(fileContents, targetFieldName);
     }
   }