grpc 1.33.0.pre1 → 1.34.0

data/src/core/lib/security/authorization/mock_cel/cel_value.h

@@ -32,7 +32,11 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <memory>
+
+#include "absl/memory/memory.h"
 #include "absl/strings/string_view.h"
+#include "absl/types/span.h"
 
 namespace grpc_core {
 namespace mock_cel {

data/src/core/lib/security/authorization/mock_cel/evaluator_core.h

@@ -21,11 +21,12 @@
 #include <set>
 #include <vector>
 
+#include "absl/status/statusor.h"
+
 #include "google/api/expr/v1alpha1/syntax.upb.h"
 #include "src/core/lib/security/authorization/mock_cel/activation.h"
 #include "src/core/lib/security/authorization/mock_cel/cel_expression.h"
 #include "src/core/lib/security/authorization/mock_cel/cel_value.h"
-#include "src/core/lib/security/authorization/mock_cel/statusor.h"
 
 namespace grpc_core {
 namespace mock_cel {
@@ -33,13 +34,11 @@ namespace mock_cel {
 // This is a temporary stub implementation of CEL APIs.
 // Once gRPC imports the CEL library, this file will be removed.
 
-class ExpressionStep {
+class ExecutionPath {
  public:
-  virtual ~ExpressionStep() = default;
+  ExecutionPath() = default;
 };
 
-using ExecutionPath = std::vector<std::unique_ptr<const ExpressionStep>>;
-
 // Implementation of the CelExpression that utilizes flattening
 // of the expression tree.
 class CelExpressionFlatImpl : public CelExpression {
@@ -56,7 +55,8 @@ class CelExpressionFlatImpl : public CelExpression {
                         bool enable_unknown_function_results = false) {}
 
   // Implementation of CelExpression evaluate method.
-  StatusOr<CelValue> Evaluate(const BaseActivation& activation) const override {
+  absl::StatusOr<CelValue> Evaluate(
+      const BaseActivation& activation) const override {
     return CelValue::CreateNull();
   }
 };

data/src/core/lib/security/authorization/mock_cel/flat_expr_builder.h

@@ -33,20 +33,21 @@ class FlatExprBuilder : public CelExpressionBuilder {
  public:
   FlatExprBuilder() = default;
 
-  cel_base::StatusOr<std::unique_ptr<CelExpression>> CreateExpression(
-      const google::api::expr::v1alpha1::Expr* expr,
-      const google::api::expr::v1alpha1::SourceInfo* source_info)
-      const override {
+  absl::StatusOr<std::unique_ptr<CelExpression>> CreateExpression(
+      const google_api_expr_v1alpha1_Expr* expr,
+      const google_api_expr_v1alpha1_SourceInfo* source_info) const override {
     ExecutionPath path;
-    return absl::make_unique<CelExpressionFlatImpl>(nullptr, path, 0);
+    return absl::make_unique<CelExpressionFlatImpl>(nullptr, path, 0,
+                                                    std::set<std::string>{});
   }
 
-  cel_base::StatusOr<std::unique_ptr<CelExpression>> CreateExpression(
-      const google::api::expr::v1alpha1::Expr* expr,
-      const google::api::expr::v1alpha1::SourceInfo* source_info,
+  absl::StatusOr<std::unique_ptr<CelExpression>> CreateExpression(
+      const google_api_expr_v1alpha1_Expr* expr,
+      const google_api_expr_v1alpha1_SourceInfo* source_info,
       std::vector<absl::Status>* warnings) const override {
     ExecutionPath path;
-    return absl::make_unique<CelExpressionFlatImpl>(nullptr, path, 0);
+    return absl::make_unique<CelExpressionFlatImpl>(nullptr, path, 0,
+                                                    std::set<std::string>{});
   }
 };
 

data/src/core/lib/security/context/security_context.h

@@ -54,7 +54,9 @@ struct grpc_auth_context
       grpc_core::RefCountedPtr<grpc_auth_context> chained)
       : grpc_core::RefCounted<grpc_auth_context,
                               grpc_core::NonPolymorphicRefCount>(
-            &grpc_trace_auth_context_refcount),
+            GRPC_TRACE_FLAG_ENABLED(grpc_trace_auth_context_refcount)
+                ? "auth_context_refcount"
+                : nullptr),
         chained_(std::move(chained)) {
     if (chained_ != nullptr) {
       peer_identity_property_name_ = chained_->peer_identity_property_name_;

data/src/core/lib/security/credentials/credentials.cc

@@ -74,7 +74,7 @@ grpc_arg grpc_channel_credentials_to_arg(
 
 grpc_channel_credentials* grpc_channel_credentials_from_arg(
     const grpc_arg* arg) {
-  if (strcmp(arg->key, GRPC_ARG_CHANNEL_CREDENTIALS)) return nullptr;
+  if (strcmp(arg->key, GRPC_ARG_CHANNEL_CREDENTIALS) != 0) return nullptr;
   if (arg->type != GRPC_ARG_POINTER) {
     gpr_log(GPR_ERROR, "Invalid type %d for arg %s", arg->type,
             GRPC_ARG_CHANNEL_CREDENTIALS);

data/src/core/lib/security/credentials/credentials.h

@@ -102,7 +102,7 @@ struct grpc_channel_credentials
     : grpc_core::RefCounted<grpc_channel_credentials> {
  public:
   explicit grpc_channel_credentials(const char* type) : type_(type) {}
-  virtual ~grpc_channel_credentials() = default;
+  ~grpc_channel_credentials() override = default;
 
   // Creates a security connector for the channel. May also create new channel
   // args for the channel to be used in place of the passed in const args if
@@ -177,7 +177,7 @@ struct grpc_call_credentials
       grpc_security_level min_security_level = GRPC_PRIVACY_AND_INTEGRITY)
       : type_(type), min_security_level_(min_security_level) {}
 
-  virtual ~grpc_call_credentials() = default;
+  ~grpc_call_credentials() override = default;
 
   // Returns true if completed synchronously, in which case \a error will
   // be set to indicate the result.  Otherwise, \a on_request_metadata will
@@ -225,7 +225,7 @@ struct grpc_server_credentials
  public:
   explicit grpc_server_credentials(const char* type) : type_(type) {}
 
-  virtual ~grpc_server_credentials() { DestroyProcessor(); }
+  ~grpc_server_credentials() override { DestroyProcessor(); }
 
   virtual grpc_core::RefCountedPtr<grpc_server_security_connector>
   create_security_connector() = 0;

data/src/core/lib/security/credentials/external/aws_request_signer.cc

@@ -0,0 +1,208 @@
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/credentials/external/aws_request_signer.h"
+
+#include "absl/strings/ascii.h"
+#include "absl/strings/escaping.h"
+#include "absl/strings/str_format.h"
+#include "absl/strings/str_join.h"
+#include "absl/strings/str_split.h"
+#include "absl/time/clock.h"
+#include "absl/time/time.h"
+
+#include <openssl/hmac.h>
+#include <openssl/sha.h>
+
+namespace grpc_core {
+
+namespace {
+
+const char kAlgorithm[] = "AWS4-HMAC-SHA256";
+const char kDateFormat[] = "%a, %d %b %E4Y %H:%M:%S %Z";
+const char kXAmzDateFormat[] = "%Y%m%dT%H%M%SZ";
+
+void SHA256(const std::string& str, unsigned char out[SHA256_DIGEST_LENGTH]) {
+  SHA256_CTX sha256;
+  SHA256_Init(&sha256);
+  SHA256_Update(&sha256, str.c_str(), str.size());
+  SHA256_Final(out, &sha256);
+}
+
+std::string SHA256Hex(const std::string& str) {
+  unsigned char hash[SHA256_DIGEST_LENGTH];
+  SHA256(str, hash);
+  std::string hash_str(reinterpret_cast<char const*>(hash),
+                       SHA256_DIGEST_LENGTH);
+  return absl::BytesToHexString(hash_str);
+}
+
+std::string HMAC(const std::string& key, const std::string& msg) {
+  unsigned int len;
+  unsigned char digest[EVP_MAX_MD_SIZE];
+  HMAC(EVP_sha256(), key.c_str(), key.length(),
+       (const unsigned char*)msg.c_str(), msg.length(), digest, &len);
+  return std::string(digest, digest + len);
+}
+
+}  // namespace
+
+AwsRequestSigner::AwsRequestSigner(
+    std::string access_key_id, std::string secret_access_key, std::string token,
+    std::string method, std::string url, std::string region,
+    std::string request_payload,
+    std::map<std::string, std::string> additional_headers, grpc_error** error)
+    : access_key_id_(std::move(access_key_id)),
+      secret_access_key_(std::move(secret_access_key)),
+      token_(std::move(token)),
+      method_(std::move(method)),
+      region_(std::move(region)),
+      request_payload_(std::move(request_payload)),
+      additional_headers_(std::move(additional_headers)) {
+  auto amz_date_it = additional_headers_.find("x-amz-date");
+  auto date_it = additional_headers_.find("date");
+  if (amz_date_it != additional_headers_.end() &&
+      date_it != additional_headers_.end()) {
+    *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "Only one of {date, x-amz-date} can be specified, not both.");
+    return;
+  }
+  if (amz_date_it != additional_headers_.end()) {
+    static_request_date_ = amz_date_it->second;
+  } else if (date_it != additional_headers_.end()) {
+    absl::Time request_date;
+    std::string err_str;
+    if (!absl::ParseTime(kDateFormat, date_it->second, &request_date,
+                         &err_str)) {
+      *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(err_str.c_str());
+      return;
+    }
+    static_request_date_ =
+        absl::FormatTime(kXAmzDateFormat, request_date, absl::UTCTimeZone());
+  }
+  url_ = grpc_uri_parse(url, false);
+  if (url_ == nullptr) {
+    *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING("Invalid Aws request url.");
+    return;
+  }
+}
+
+AwsRequestSigner::~AwsRequestSigner() { grpc_uri_destroy(url_); }
+
+std::map<std::string, std::string> AwsRequestSigner::GetSignedRequestHeaders() {
+  std::string request_date_full;
+  if (!static_request_date_.empty()) {
+    if (!request_headers_.empty()) {
+      return request_headers_;
+    }
+    request_date_full = static_request_date_;
+  } else {
+    absl::Time request_date = absl::Now();
+    request_date_full =
+        absl::FormatTime(kXAmzDateFormat, request_date, absl::UTCTimeZone());
+  }
+  std::string request_date_short = request_date_full.substr(0, 8);
+  // TASK 1: Create a canonical request for Signature Version 4
+  // https://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html
+  std::vector<absl::string_view> canonical_request_vector;
+  // 1. HTTPRequestMethod
+  canonical_request_vector.emplace_back(method_);
+  canonical_request_vector.emplace_back("\n");
+  // 2. CanonicalURI
+
+  canonical_request_vector.emplace_back(*url_->path == '\0' ? "/" : url_->path);
+  canonical_request_vector.emplace_back("\n");
+  // 3. CanonicalQueryString
+  canonical_request_vector.emplace_back(url_->query);
+  canonical_request_vector.emplace_back("\n");
+  // 4. CanonicalHeaders
+  if (request_headers_.empty()) {
+    request_headers_.insert({"host", url_->authority});
+    if (!token_.empty()) {
+      request_headers_.insert({"x-amz-security-token", token_});
+    }
+    for (const auto& header : additional_headers_) {
+      request_headers_.insert(
+          {absl::AsciiStrToLower(header.first), header.second});
+    }
+  }
+  if (additional_headers_.find("date") == additional_headers_.end()) {
+    request_headers_["x-amz-date"] = request_date_full;
+  }
+  std::vector<absl::string_view> canonical_headers_vector;
+  for (const auto& header : request_headers_) {
+    canonical_headers_vector.emplace_back(header.first);
+    canonical_headers_vector.emplace_back(":");
+    canonical_headers_vector.emplace_back(header.second);
+    canonical_headers_vector.emplace_back("\n");
+  }
+  std::string canonical_headers = absl::StrJoin(canonical_headers_vector, "");
+  canonical_request_vector.emplace_back(canonical_headers);
+  canonical_request_vector.emplace_back("\n");
+  // 5. SignedHeaders
+  std::vector<absl::string_view> signed_headers_vector;
+  for (const auto& header : request_headers_) {
+    signed_headers_vector.emplace_back(header.first);
+  }
+  std::string signed_headers = absl::StrJoin(signed_headers_vector, ";");
+  canonical_request_vector.emplace_back(signed_headers);
+  canonical_request_vector.emplace_back("\n");
+  // 6. RequestPayload
+  std::string hashed_request_payload = SHA256Hex(request_payload_);
+  canonical_request_vector.emplace_back(hashed_request_payload);
+  std::string canonical_request = absl::StrJoin(canonical_request_vector, "");
+  // TASK 2: Create a string to sign for Signature Version 4
+  // https://docs.aws.amazon.com/general/latest/gr/sigv4-create-string-to-sign.html
+  std::vector<absl::string_view> string_to_sign_vector;
+  // 1. Algorithm
+  string_to_sign_vector.emplace_back("AWS4-HMAC-SHA256");
+  string_to_sign_vector.emplace_back("\n");
+  // 2. RequestDateTime
+  string_to_sign_vector.emplace_back(request_date_full);
+  string_to_sign_vector.emplace_back("\n");
+  // 3. CredentialScope
+  std::pair<absl::string_view, absl::string_view> host_parts =
+      absl::StrSplit(url_->authority, absl::MaxSplits('.', 1));
+  std::string service_name(host_parts.first);
+  std::string credential_scope = absl::StrFormat(
+      "%s/%s/%s/aws4_request", request_date_short, region_, service_name);
+  string_to_sign_vector.emplace_back(credential_scope);
+  string_to_sign_vector.emplace_back("\n");
+  // 4. HashedCanonicalRequest
+  std::string hashed_canonical_request = SHA256Hex(canonical_request);
+  string_to_sign_vector.emplace_back(hashed_canonical_request);
+  std::string string_to_sign = absl::StrJoin(string_to_sign_vector, "");
+  // TASK 3: Task 3: Calculate the signature for AWS Signature Version 4
+  // https://docs.aws.amazon.com/general/latest/gr/sigv4-calculate-signature.html
+  // 1. Derive your signing key.
+  std::string date = HMAC("AWS4" + secret_access_key_, request_date_short);
+  std::string region = HMAC(date, region_);
+  std::string service = HMAC(region, service_name);
+  std::string signing = HMAC(service, "aws4_request");
+  // 2. Calculate the signature.
+  std::string signature_str = HMAC(signing, string_to_sign);
+  std::string signature = absl::BytesToHexString(signature_str);
+  // TASK 4: Add the signature to the HTTP request
+  // https://docs.aws.amazon.com/general/latest/gr/sigv4-add-signature-to-request.html
+  std::string authorization_header = absl::StrFormat(
+      "%s Credential=%s/%s, SignedHeaders=%s, Signature=%s", kAlgorithm,
+      access_key_id_, credential_scope, signed_headers, signature);
+  request_headers_["Authorization"] = authorization_header;
+  return request_headers_;
+}
+
+}  // namespace grpc_core

data/src/core/lib/security/credentials/external/aws_request_signer.h

@@ -0,0 +1,73 @@
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_AWS_REQUEST_SIGNER_H
+#define GRPC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_AWS_REQUEST_SIGNER_H
+
+#include <grpc/support/port_platform.h>
+
+#include <map>
+#include <string>
+
+#include "src/core/lib/iomgr/error.h"
+#include "src/core/lib/uri/uri_parser.h"
+
+namespace grpc_core {
+
+// Implements an AWS API request signer based on the AWS Signature Version 4
+// signing process.
+// https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html
+// To retrieve the subject token in AwsExternalAccountCredentials, we need to
+// sign an AWS request server and use the signed request as the subject token.
+// This class is a utility to sign an AWS request.
+class AwsRequestSigner {
+ public:
+  // Construct a signer with the necessary information to sign a request.
+  // `access_key_id`, `secret_access_key` and `token` are the AWS credentials
+  // required for signing. `method` and `url` are the HTTP method and url of the
+  // request. `region` is the region of the AWS environment. `request_payload`
+  // is the payload of the HTTP request. `additional_headers` are additional
+  // headers to be inject into the request.
+  AwsRequestSigner(std::string access_key_id, std::string secret_access_key,
+                   std::string token, std::string method, std::string url,
+                   std::string region, std::string request_payload,
+                   std::map<std::string, std::string> additional_headers,
+                   grpc_error** error);
+  ~AwsRequestSigner();
+
+  // This method triggers the signing process then returns the headers of the
+  // signed request as a map. In case there is an error, the input `error`
+  // parameter will be updated and an empty map will be returned if there is
+  // error.
+  std::map<std::string, std::string> GetSignedRequestHeaders();
+
+ private:
+  std::string access_key_id_;
+  std::string secret_access_key_;
+  std::string token_;
+  std::string method_;
+  grpc_uri* url_ = nullptr;
+  std::string region_;
+  std::string request_payload_;
+  std::map<std::string, std::string> additional_headers_;
+
+  std::string static_request_date_;
+  std::map<std::string, std::string> request_headers_;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_AWS_REQUEST_SIGNER_H

data/src/core/lib/security/credentials/external/external_account_credentials.cc

@@ -0,0 +1,311 @@
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/credentials/external/external_account_credentials.h"
+
+#include "absl/strings/str_format.h"
+#include "absl/strings/str_join.h"
+#include "absl/time/clock.h"
+#include "absl/time/time.h"
+
+#include "src/core/lib/http/parser.h"
+#include "src/core/lib/security/util/json_util.h"
+#include "src/core/lib/slice/b64.h"
+
+#define EXTERNAL_ACCOUNT_CREDENTIALS_GRANT_TYPE \
+  "urn:ietf:params:oauth:grant-type:token-exchange"
+#define EXTERNAL_ACCOUNT_CREDENTIALS_REQUESTED_TOKEN_TYPE \
+  "urn:ietf:params:oauth:token-type:access_token"
+#define GOOGLE_CLOUD_PLATFORM_DEFAULT_SCOPE \
+  "https://www.googleapis.com/auth/cloud-platform"
+
+namespace grpc_core {
+
+ExternalAccountCredentials::ExternalAccountCredentials(
+    ExternalAccountCredentialsOptions options, std::vector<std::string> scopes)
+    : options_(std::move(options)) {
+  if (scopes.empty()) {
+    scopes.push_back(GOOGLE_CLOUD_PLATFORM_DEFAULT_SCOPE);
+  }
+  scopes_ = std::move(scopes);
+}
+
+ExternalAccountCredentials::~ExternalAccountCredentials() {}
+
+std::string ExternalAccountCredentials::debug_string() {
+  return absl::StrFormat("ExternalAccountCredentials{Audience:%s,%s}",
+                         options_.audience,
+                         grpc_oauth2_token_fetcher_credentials::debug_string());
+}
+
+// The token fetching flow:
+// 1. Retrieve subject token - Subclass's RetrieveSubjectToken() gets called
+// and the subject token is received in OnRetrieveSubjectTokenInternal().
+// 2. Exchange token - ExchangeToken() gets called with the
+// subject token from #1. Receive the response in OnExchangeTokenInternal().
+// 3. (Optional) Impersonate service account - ImpersenateServiceAccount() gets
+// called with the access token of the response from #2. Get an impersonated
+// access token in OnImpersenateServiceAccountInternal().
+// 4. Finish token fetch - Return back the response that contains an access
+// token in FinishTokenFetch().
+// TODO(chuanr): Avoid starting the remaining requests if the channel gets shut
+// down.
+void ExternalAccountCredentials::fetch_oauth2(
+    grpc_credentials_metadata_request* metadata_req,
+    grpc_httpcli_context* httpcli_context, grpc_polling_entity* pollent,
+    grpc_iomgr_cb_func response_cb, grpc_millis deadline) {
+  GPR_ASSERT(ctx_ == nullptr);
+  ctx_ = new HTTPRequestContext(httpcli_context, pollent, deadline);
+  metadata_req_ = metadata_req;
+  response_cb_ = response_cb;
+  auto cb = [this](std::string token, grpc_error* error) {
+    OnRetrieveSubjectTokenInternal(token, error);
+  };
+  RetrieveSubjectToken(ctx_, options_, cb);
+}
+
+void ExternalAccountCredentials::OnRetrieveSubjectTokenInternal(
+    absl::string_view subject_token, grpc_error* error) {
+  if (error != GRPC_ERROR_NONE) {
+    FinishTokenFetch(error);
+  } else {
+    ExchangeToken(subject_token);
+  }
+}
+
+void ExternalAccountCredentials::ExchangeToken(
+    absl::string_view subject_token) {
+  grpc_uri* uri = grpc_uri_parse(options_.token_url, false);
+  if (uri == nullptr) {
+    FinishTokenFetch(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrFormat("Invalid token url: %s.", options_.token_url).c_str()));
+    return;
+  }
+  grpc_httpcli_request request;
+  memset(&request, 0, sizeof(grpc_httpcli_request));
+  request.host = const_cast<char*>(uri->authority);
+  request.http.path = gpr_strdup(uri->path);
+  grpc_http_header* headers = nullptr;
+  if (!options_.client_id.empty() && !options_.client_secret.empty()) {
+    request.http.hdr_count = 2;
+    headers = static_cast<grpc_http_header*>(
+        gpr_malloc(sizeof(grpc_http_header) * request.http.hdr_count));
+    headers[0].key = gpr_strdup("Content-Type");
+    headers[0].value = gpr_strdup("application/x-www-form-urlencoded");
+    std::string raw_cred =
+        absl::StrFormat("%s:%s", options_.client_id, options_.client_secret);
+    char* encoded_cred =
+        grpc_base64_encode(raw_cred.c_str(), raw_cred.length(), 0, 0);
+    std::string str = absl::StrFormat("Basic %s", std::string(encoded_cred));
+    headers[1].key = gpr_strdup("Authorization");
+    headers[1].value = gpr_strdup(str.c_str());
+    gpr_free(encoded_cred);
+  } else {
+    request.http.hdr_count = 1;
+    headers = static_cast<grpc_http_header*>(
+        gpr_malloc(sizeof(grpc_http_header) * request.http.hdr_count));
+    headers[0].key = gpr_strdup("Content-Type");
+    headers[0].value = gpr_strdup("application/x-www-form-urlencoded");
+  }
+  request.http.hdrs = headers;
+  request.handshaker = (strcmp(uri->scheme, "https") == 0)
+                           ? &grpc_httpcli_ssl
+                           : &grpc_httpcli_plaintext;
+  std::vector<std::string> body_parts;
+  body_parts.push_back(absl::StrFormat("%s=%s", "audience", options_.audience));
+  body_parts.push_back(absl::StrFormat(
+      "%s=%s", "grant_type", EXTERNAL_ACCOUNT_CREDENTIALS_GRANT_TYPE));
+  body_parts.push_back(
+      absl::StrFormat("%s=%s", "requested_token_type",
+                      EXTERNAL_ACCOUNT_CREDENTIALS_REQUESTED_TOKEN_TYPE));
+  body_parts.push_back(absl::StrFormat("%s=%s", "subject_token_type",
+                                       options_.subject_token_type));
+  body_parts.push_back(
+      absl::StrFormat("%s=%s", "subject_token", subject_token));
+  std::string scope = GOOGLE_CLOUD_PLATFORM_DEFAULT_SCOPE;
+  if (options_.service_account_impersonation_url.empty()) {
+    scope = absl::StrJoin(scopes_, " ");
+  }
+  body_parts.push_back(absl::StrFormat("%s=%s", "scope", scope));
+  std::string body = absl::StrJoin(body_parts, "&");
+  grpc_resource_quota* resource_quota =
+      grpc_resource_quota_create("external_account_credentials");
+  grpc_http_response_destroy(&ctx_->response);
+  ctx_->response = {};
+  GRPC_CLOSURE_INIT(&ctx_->closure, OnExchangeToken, this, nullptr);
+  grpc_httpcli_post(ctx_->httpcli_context, ctx_->pollent, resource_quota,
+                    &request, body.c_str(), body.size(), ctx_->deadline,
+                    &ctx_->closure, &ctx_->response);
+  grpc_resource_quota_unref_internal(resource_quota);
+  grpc_http_request_destroy(&request.http);
+  grpc_uri_destroy(uri);
+}
+
+void ExternalAccountCredentials::OnExchangeToken(void* arg, grpc_error* error) {
+  ExternalAccountCredentials* self =
+      static_cast<ExternalAccountCredentials*>(arg);
+  self->OnExchangeTokenInternal(GRPC_ERROR_REF(error));
+}
+
+void ExternalAccountCredentials::OnExchangeTokenInternal(grpc_error* error) {
+  if (error != GRPC_ERROR_NONE) {
+    FinishTokenFetch(error);
+  } else {
+    if (options_.service_account_impersonation_url.empty()) {
+      metadata_req_->response = ctx_->response;
+      metadata_req_->response.body = gpr_strdup(ctx_->response.body);
+      FinishTokenFetch(GRPC_ERROR_NONE);
+    } else {
+      ImpersenateServiceAccount();
+    }
+  }
+}
+
+void ExternalAccountCredentials::ImpersenateServiceAccount() {
+  grpc_error* error = GRPC_ERROR_NONE;
+  absl::string_view response_body(ctx_->response.body,
+                                  ctx_->response.body_length);
+  Json json = Json::Parse(response_body, &error);
+  if (error != GRPC_ERROR_NONE || json.type() != Json::Type::OBJECT) {
+    FinishTokenFetch(GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
+        "Invalid token exchange response.", &error, 1));
+    GRPC_ERROR_UNREF(error);
+    return;
+  }
+  auto it = json.object_value().find("access_token");
+  if (it == json.object_value().end() ||
+      it->second.type() != Json::Type::STRING) {
+    FinishTokenFetch(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrFormat("Missing or invalid access_token in %s.", response_body)
+            .c_str()));
+    return;
+  }
+  std::string access_token = it->second.string_value();
+  grpc_uri* uri =
+      grpc_uri_parse(options_.service_account_impersonation_url, false);
+  if (uri == nullptr) {
+    FinishTokenFetch(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrFormat("Invalid service account impersonation url: %s.",
+                        options_.service_account_impersonation_url)
+            .c_str()));
+    return;
+  }
+  grpc_httpcli_request request;
+  memset(&request, 0, sizeof(grpc_httpcli_request));
+  request.host = const_cast<char*>(uri->authority);
+  request.http.path = gpr_strdup(uri->path);
+  request.http.hdr_count = 2;
+  grpc_http_header* headers = static_cast<grpc_http_header*>(
+      gpr_malloc(sizeof(grpc_http_header) * request.http.hdr_count));
+  headers[0].key = gpr_strdup("Content-Type");
+  headers[0].value = gpr_strdup("application/x-www-form-urlencoded");
+  std::string str = absl::StrFormat("Bearer %s", access_token);
+  headers[1].key = gpr_strdup("Authorization");
+  headers[1].value = gpr_strdup(str.c_str());
+  request.http.hdrs = headers;
+  request.handshaker = (strcmp(uri->scheme, "https") == 0)
+                           ? &grpc_httpcli_ssl
+                           : &grpc_httpcli_plaintext;
+  std::string scope = absl::StrJoin(scopes_, " ");
+  std::string body = absl::StrFormat("%s=%s", "scope", scope);
+  grpc_resource_quota* resource_quota =
+      grpc_resource_quota_create("external_account_credentials");
+  grpc_http_response_destroy(&ctx_->response);
+  ctx_->response = {};
+  GRPC_CLOSURE_INIT(&ctx_->closure, OnImpersenateServiceAccount, this, nullptr);
+  grpc_httpcli_post(ctx_->httpcli_context, ctx_->pollent, resource_quota,
+                    &request, body.c_str(), body.size(), ctx_->deadline,
+                    &ctx_->closure, &ctx_->response);
+  grpc_resource_quota_unref_internal(resource_quota);
+  grpc_http_request_destroy(&request.http);
+  grpc_uri_destroy(uri);
+}
+
+void ExternalAccountCredentials::OnImpersenateServiceAccount(
+    void* arg, grpc_error* error) {
+  ExternalAccountCredentials* self =
+      static_cast<ExternalAccountCredentials*>(arg);
+  self->OnImpersenateServiceAccountInternal(GRPC_ERROR_REF(error));
+}
+
+void ExternalAccountCredentials::OnImpersenateServiceAccountInternal(
+    grpc_error* error) {
+  if (error != GRPC_ERROR_NONE) {
+    FinishTokenFetch(error);
+    return;
+  }
+  absl::string_view response_body(ctx_->response.body,
+                                  ctx_->response.body_length);
+  Json json = Json::Parse(response_body, &error);
+  if (error != GRPC_ERROR_NONE || json.type() != Json::Type::OBJECT) {
+    FinishTokenFetch(GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
+        "Invalid service account impersonation response.", &error, 1));
+    GRPC_ERROR_UNREF(error);
+    return;
+  }
+  auto it = json.object_value().find("accessToken");
+  if (it == json.object_value().end() ||
+      it->second.type() != Json::Type::STRING) {
+    FinishTokenFetch(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrFormat("Missing or invalid accessToken in %s.", response_body)
+            .c_str()));
+    return;
+  }
+  std::string access_token = it->second.string_value();
+  it = json.object_value().find("expireTime");
+  if (it == json.object_value().end() ||
+      it->second.type() != Json::Type::STRING) {
+    FinishTokenFetch(GRPC_ERROR_CREATE_FROM_COPIED_STRING(
+        absl::StrFormat("Missing or invalid expireTime in %s.", response_body)
+            .c_str()));
+    return;
+  }
+  std::string expire_time = it->second.string_value();
+  absl::Time t;
+  if (!absl::ParseTime(absl::RFC3339_full, expire_time, &t, nullptr)) {
+    FinishTokenFetch(GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+        "Invalid expire time of service account impersonation response."));
+    return;
+  }
+  int expire_in = (t - absl::Now()) / absl::Seconds(1);
+  std::string body = absl::StrFormat(
+      "{\"access_token\":\"%s\",\"expires_in\":%d,\"token_type\":\"Bearer\"}",
+      access_token, expire_in);
+  metadata_req_->response = ctx_->response;
+  metadata_req_->response.body = gpr_strdup(body.c_str());
+  metadata_req_->response.body_length = body.length();
+  FinishTokenFetch(GRPC_ERROR_NONE);
+}
+
+void ExternalAccountCredentials::FinishTokenFetch(grpc_error* error) {
+  GRPC_LOG_IF_ERROR("Fetch external account credentials access token",
+                    GRPC_ERROR_REF(error));
+  // Move object state into local variables.
+  auto* cb = response_cb_;
+  response_cb_ = nullptr;
+  auto* metadata_req = metadata_req_;
+  metadata_req_ = nullptr;
+  auto* ctx = ctx_;
+  ctx_ = nullptr;
+  // Invoke the callback.
+  cb(metadata_req, error);
+  // Delete context.
+  delete ctx;
+  GRPC_ERROR_UNREF(error);
+}
+
+}  // namespace grpc_core