grpc 1.41.1 → 1.44.0.pre2

data/src/core/lib/security/authorization/rbac_policy.h

@@ -0,0 +1,170 @@
+// Copyright 2021 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_RBAC_POLICY_H
+#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_RBAC_POLICY_H
+
+#include <grpc/support/port_platform.h>
+
+#include <memory>
+
+#include "src/core/lib/matchers/matchers.h"
+
+namespace grpc_core {
+
+// Represents Envoy RBAC Proto. [See
+// https://github.com/envoyproxy/envoy/blob/release/v1.17/api/envoy/config/rbac/v3/rbac.proto]
+struct Rbac {
+  enum class Action {
+    kAllow,
+    kDeny,
+  };
+
+  struct CidrRange {
+    CidrRange() = default;
+    CidrRange(std::string address_prefix, uint32_t prefix_len);
+
+    CidrRange(CidrRange&& other) noexcept;
+    CidrRange& operator=(CidrRange&& other) noexcept;
+
+    std::string ToString() const;
+
+    std::string address_prefix;
+    uint32_t prefix_len;
+  };
+
+  // TODO(ashithasantosh): Support for destination_port_range.
+  struct Permission {
+    enum class RuleType {
+      kAnd,
+      kOr,
+      kNot,
+      kAny,
+      kHeader,
+      kPath,
+      kDestIp,
+      kDestPort,
+      kMetadata,
+      kReqServerName,
+    };
+
+    static Permission MakeAndPermission(
+        std::vector<std::unique_ptr<Permission>> permissions);
+    static Permission MakeOrPermission(
+        std::vector<std::unique_ptr<Permission>> permissions);
+    static Permission MakeNotPermission(Permission permission);
+    static Permission MakeAnyPermission();
+    static Permission MakeHeaderPermission(HeaderMatcher header_matcher);
+    static Permission MakePathPermission(StringMatcher string_matcher);
+    static Permission MakeDestIpPermission(CidrRange ip);
+    static Permission MakeDestPortPermission(int port);
+    // All the other fields in MetadataMatcher are ignored except invert.
+    static Permission MakeMetadataPermission(bool invert);
+    static Permission MakeReqServerNamePermission(StringMatcher string_matcher);
+
+    Permission() = default;
+
+    Permission(Permission&& other) noexcept;
+    Permission& operator=(Permission&& other) noexcept;
+
+    std::string ToString() const;
+
+    RuleType type = RuleType::kAnd;
+    HeaderMatcher header_matcher;
+    StringMatcher string_matcher;
+    CidrRange ip;
+    int port;
+    // For type kAnd/kOr/kNot. For kNot type, the vector will have only one
+    // element.
+    std::vector<std::unique_ptr<Permission>> permissions;
+    // For kMetadata
+    bool invert = false;
+  };
+
+  struct Principal {
+    enum class RuleType {
+      kAnd,
+      kOr,
+      kNot,
+      kAny,
+      kPrincipalName,
+      kSourceIp,
+      kDirectRemoteIp,
+      kRemoteIp,
+      kHeader,
+      kPath,
+      kMetadata,
+    };
+
+    static Principal MakeAndPrincipal(
+        std::vector<std::unique_ptr<Principal>> principals);
+    static Principal MakeOrPrincipal(
+        std::vector<std::unique_ptr<Principal>> principals);
+    static Principal MakeNotPrincipal(Principal principal);
+    static Principal MakeAnyPrincipal();
+    static Principal MakeAuthenticatedPrincipal(StringMatcher string_matcher);
+    static Principal MakeSourceIpPrincipal(CidrRange ip);
+    static Principal MakeDirectRemoteIpPrincipal(CidrRange ip);
+    static Principal MakeRemoteIpPrincipal(CidrRange ip);
+    static Principal MakeHeaderPrincipal(HeaderMatcher header_matcher);
+    static Principal MakePathPrincipal(StringMatcher string_matcher);
+    // All the other fields in MetadataMatcher are ignored except invert.
+    static Principal MakeMetadataPrincipal(bool invert);
+
+    Principal() = default;
+
+    Principal(Principal&& other) noexcept;
+    Principal& operator=(Principal&& other) noexcept;
+
+    std::string ToString() const;
+
+    RuleType type = RuleType::kAnd;
+    HeaderMatcher header_matcher;
+    StringMatcher string_matcher;
+    CidrRange ip;
+    // For type kAnd/kOr/kNot. For kNot type, the vector will have only one
+    // element.
+    std::vector<std::unique_ptr<Principal>> principals;
+    // For kMetadata
+    bool invert = false;
+  };
+
+  struct Policy {
+    Policy() = default;
+    Policy(Permission permissions, Principal principals);
+
+    Policy(Policy&& other) noexcept;
+    Policy& operator=(Policy&& other) noexcept;
+
+    std::string ToString() const;
+
+    Permission permissions;
+    Principal principals;
+  };
+
+  Rbac() = default;
+  Rbac(Rbac::Action action, std::map<std::string, Policy> policies);
+
+  Rbac(Rbac&& other) noexcept;
+  Rbac& operator=(Rbac&& other) noexcept;
+
+  std::string ToString() const;
+
+  Action action;
+  std::map<std::string, Policy> policies;
+};
+
+}  // namespace grpc_core
+
+#endif /* GRPC_CORE_LIB_SECURITY_AUTHORIZATION_RBAC_POLICY_H */

data/src/core/lib/security/authorization/sdk_server_authz_filter.cc

@@ -92,6 +92,20 @@ void SdkServerAuthzFilter::CallData::Destroy(
 bool SdkServerAuthzFilter::CallData::IsAuthorized(SdkServerAuthzFilter* chand) {
   EvaluateArgs args(recv_initial_metadata_batch_,
                     &chand->per_channel_evaluate_args_);
+  if (GRPC_TRACE_FLAG_ENABLED(grpc_sdk_authz_trace)) {
+    gpr_log(
+        GPR_DEBUG,
+        "checking request: url_path=%s, transport_security_type=%s, "
+        "uri_sans=[%s], dns_sans=[%s], subject=%s, local_address=%s:%d, "
+        "peer_address=%s:%d",
+        std::string(args.GetPath()).c_str(),
+        std::string(args.GetTransportSecurityType()).c_str(),
+        absl::StrJoin(args.GetUriSans(), ",").c_str(),
+        absl::StrJoin(args.GetDnsSans(), ",").c_str(),
+        std::string(args.GetSubject()).c_str(),
+        std::string(args.GetLocalAddressString()).c_str(), args.GetLocalPort(),
+        std::string(args.GetPeerAddressString()).c_str(), args.GetPeerPort());
+  }
   grpc_authorization_policy_provider::AuthorizationEngines engines =
       chand->provider_->engines();
   if (engines.deny_engine != nullptr) {
@@ -137,7 +151,7 @@ void SdkServerAuthzFilter::CallData::RecvInitialMetadataReady(
                                  GRPC_STATUS_PERMISSION_DENIED);
     }
   } else {
-    GRPC_ERROR_REF(error);
+    (void)GRPC_ERROR_REF(error);
   }
   Closure::Run(DEBUG_LOCATION, calld->original_recv_initial_metadata_ready_,
                error);

data/src/core/lib/security/context/security_context.cc

@@ -29,9 +29,9 @@
 
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gpr/string.h"
-#include "src/core/lib/gprpp/arena.h"
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/resource_quota/arena.h"
 #include "src/core/lib/surface/api_trace.h"
 #include "src/core/lib/surface/call.h"
 
@@ -223,7 +223,7 @@ grpc_auth_property_iterator grpc_auth_context_peer_identity(
 void grpc_auth_context::ensure_capacity() {
   if (properties_.count == properties_.capacity) {
     properties_.capacity =
-        GPR_MAX(properties_.capacity + 8, properties_.capacity * 2);
+        std::max(properties_.capacity + 8, properties_.capacity * 2);
     properties_.array = static_cast<grpc_auth_property*>(gpr_realloc(
         properties_.array, properties_.capacity * sizeof(grpc_auth_property)));
   }
@@ -235,7 +235,9 @@ void grpc_auth_context::add_property(const char* name, const char* value,
   grpc_auth_property* prop = &properties_.array[properties_.count++];
   prop->name = gpr_strdup(name);
   prop->value = static_cast<char*>(gpr_malloc(value_length + 1));
-  memcpy(prop->value, value, value_length);
+  if (value != nullptr) {
+    memcpy(prop->value, value, value_length);
+  }
   prop->value[value_length] = '\0';
   prop->value_length = value_length;
 }
@@ -289,7 +291,9 @@ static void* auth_context_pointer_arg_copy(void* p) {
              : ctx->Ref(DEBUG_LOCATION, "auth_context_pointer_arg").release();
 }
 
-static int auth_context_pointer_cmp(void* a, void* b) { return GPR_ICMP(a, b); }
+static int auth_context_pointer_cmp(void* a, void* b) {
+  return grpc_core::QsortCompare(a, b);
+}
 
 static const grpc_arg_pointer_vtable auth_context_pointer_vtable = {
     auth_context_pointer_arg_copy, auth_context_pointer_arg_destroy,

data/src/core/lib/security/context/security_context.h

@@ -21,10 +21,10 @@
 
 #include <grpc/support/port_platform.h>
 
-#include "src/core/lib/gprpp/arena.h"
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/iomgr/pollset.h"
+#include "src/core/lib/resource_quota/arena.h"
 #include "src/core/lib/security/credentials/credentials.h"
 
 extern grpc_core::DebugOnlyTraceFlag grpc_trace_auth_context_refcount;

data/src/core/lib/security/credentials/composite/composite_credentials.cc

@@ -44,7 +44,7 @@ struct grpc_composite_call_credentials_metadata_context {
   grpc_composite_call_credentials_metadata_context(
       grpc_composite_call_credentials* composite_creds,
       grpc_polling_entity* pollent, grpc_auth_metadata_context auth_md_context,
-      grpc_credentials_mdelem_array* md_array,
+      grpc_core::CredentialsMetadataArray* md_array,
       grpc_closure* on_request_metadata)
       : composite_creds(composite_creds),
         pollent(pollent),
@@ -59,7 +59,7 @@ struct grpc_composite_call_credentials_metadata_context {
   size_t creds_index = 0;
   grpc_polling_entity* pollent;
   grpc_auth_metadata_context auth_md_context;
-  grpc_credentials_mdelem_array* md_array;
+  grpc_core::CredentialsMetadataArray* md_array;
   grpc_closure* on_request_metadata;
   grpc_closure internal_on_request_metadata;
 };
@@ -91,8 +91,8 @@ static void composite_call_metadata_cb(void* arg, grpc_error_handle error) {
 
 bool grpc_composite_call_credentials::get_request_metadata(
     grpc_polling_entity* pollent, grpc_auth_metadata_context auth_md_context,
-    grpc_credentials_mdelem_array* md_array, grpc_closure* on_request_metadata,
-    grpc_error_handle* error) {
+    grpc_core::CredentialsMetadataArray* md_array,
+    grpc_closure* on_request_metadata, grpc_error_handle* error) {
   grpc_composite_call_credentials_metadata_context* ctx;
   ctx = new grpc_composite_call_credentials_metadata_context(
       this, pollent, auth_md_context, md_array, on_request_metadata);
@@ -113,7 +113,7 @@ bool grpc_composite_call_credentials::get_request_metadata(
 }
 
 void grpc_composite_call_credentials::cancel_get_request_metadata(
-    grpc_credentials_mdelem_array* md_array, grpc_error_handle error) {
+    grpc_core::CredentialsMetadataArray* md_array, grpc_error_handle error) {
   for (size_t i = 0; i < inner_.size(); ++i) {
     inner_[i]->cancel_get_request_metadata(md_array, GRPC_ERROR_REF(error));
   }
@@ -147,7 +147,7 @@ void grpc_composite_call_credentials::push_to_inner(
   auto composite_creds =
       static_cast<grpc_composite_call_credentials*>(creds.get());
   for (size_t i = 0; i < composite_creds->inner().size(); ++i) {
-    inner_.push_back(std::move(composite_creds->inner_[i]));
+    inner_.push_back(composite_creds->inner_[i]);
   }
 }
 

data/src/core/lib/security/credentials/composite/composite_credentials.h

@@ -81,12 +81,13 @@ class grpc_composite_call_credentials : public grpc_call_credentials {
 
   bool get_request_metadata(grpc_polling_entity* pollent,
                             grpc_auth_metadata_context context,
-                            grpc_credentials_mdelem_array* md_array,
+                            grpc_core::CredentialsMetadataArray* md_array,
                             grpc_closure* on_request_metadata,
                             grpc_error_handle* error) override;
 
-  void cancel_get_request_metadata(grpc_credentials_mdelem_array* md_array,
-                                   grpc_error_handle error) override;
+  void cancel_get_request_metadata(
+      grpc_core::CredentialsMetadataArray* md_array,
+      grpc_error_handle error) override;
 
   grpc_security_level min_security_level() const override {
     return min_security_level_;

data/src/core/lib/security/credentials/credentials.cc

@@ -59,7 +59,9 @@ static void* credentials_pointer_arg_copy(void* p) {
   return static_cast<grpc_channel_credentials*>(p)->Ref().release();
 }
 
-static int credentials_pointer_cmp(void* a, void* b) { return GPR_ICMP(a, b); }
+static int credentials_pointer_cmp(void* a, void* b) {
+  return grpc_core::QsortCompare(a, b);
+}
 
 static const grpc_arg_pointer_vtable credentials_pointer_vtable = {
     credentials_pointer_arg_copy, credentials_pointer_arg_destroy,
@@ -127,7 +129,7 @@ static void* server_credentials_pointer_arg_copy(void* p) {
 }
 
 static int server_credentials_pointer_cmp(void* a, void* b) {
-  return GPR_ICMP(a, b);
+  return grpc_core::QsortCompare(a, b);
 }
 
 static const grpc_arg_pointer_vtable cred_ptr_vtable = {

data/src/core/lib/security/credentials/credentials.h

@@ -93,7 +93,7 @@ void grpc_override_well_known_credentials_path_getter(
 
 /* --- grpc_channel_credentials. --- */
 
-#define GRPC_ARG_CHANNEL_CREDENTIALS "grpc.channel_credentials"
+#define GRPC_ARG_CHANNEL_CREDENTIALS "grpc.internal.channel_credentials"
 
 // This type is forward declared as a C struct and we cannot define it as a
 // class. Otherwise, compiler will complain about type mismatch due to
@@ -137,6 +137,11 @@ struct grpc_channel_credentials
   const char* type_;
 };
 
+// TODO(roth): Once we eliminate insecure builds, find a better way to
+// plumb credentials so that it doesn't need to flow through channel
+// args.  For example, we'll want to expose it to LB policies by adding
+// methods on the helper API.
+
 /* Util to encapsulate the channel credentials in a channel arg. */
 grpc_arg grpc_channel_credentials_to_arg(grpc_channel_credentials* credentials);
 
@@ -148,21 +153,11 @@ grpc_channel_credentials* grpc_channel_credentials_from_arg(
 grpc_channel_credentials* grpc_channel_credentials_find_in_args(
     const grpc_channel_args* args);
 
-/* --- grpc_credentials_mdelem_array. --- */
-
-struct grpc_credentials_mdelem_array {
-  grpc_mdelem* md = nullptr;
-  size_t size = 0;
-};
-/// Takes a new ref to \a md.
-void grpc_credentials_mdelem_array_add(grpc_credentials_mdelem_array* list,
-                                       grpc_mdelem md);
+/* --- grpc_core::CredentialsMetadataArray. --- */
 
-/// Appends all elements from \a src to \a dst, taking a new ref to each one.
-void grpc_credentials_mdelem_array_append(grpc_credentials_mdelem_array* dst,
-                                          grpc_credentials_mdelem_array* src);
-
-void grpc_credentials_mdelem_array_destroy(grpc_credentials_mdelem_array* list);
+namespace grpc_core {
+using CredentialsMetadataArray = std::vector<std::pair<Slice, Slice>>;
+}
 
 /* --- grpc_call_credentials. --- */
 
@@ -183,17 +178,17 @@ struct grpc_call_credentials
   // be set to indicate the result.  Otherwise, \a on_request_metadata will
   // be invoked asynchronously when complete.  \a md_array will be populated
   // with the resulting metadata once complete.
-  virtual bool get_request_metadata(grpc_polling_entity* pollent,
-                                    grpc_auth_metadata_context context,
-                                    grpc_credentials_mdelem_array* md_array,
-                                    grpc_closure* on_request_metadata,
-                                    grpc_error_handle* error) = 0;
+  virtual bool get_request_metadata(
+      grpc_polling_entity* pollent, grpc_auth_metadata_context context,
+      grpc_core::CredentialsMetadataArray* md_array,
+      grpc_closure* on_request_metadata, grpc_error_handle* error) = 0;
 
   // Cancels a pending asynchronous operation started by
   // grpc_call_credentials_get_request_metadata() with the corresponding
   // value of \a md_array.
   virtual void cancel_get_request_metadata(
-      grpc_credentials_mdelem_array* md_array, grpc_error_handle error) = 0;
+      grpc_core::CredentialsMetadataArray* md_array,
+      grpc_error_handle error) = 0;
 
   virtual grpc_security_level min_security_level() const {
     return min_security_level_;

data/src/core/lib/security/credentials/external/aws_external_account_credentials.cc

@@ -166,13 +166,11 @@ void AwsExternalAccountCredentials::RetrieveRegion() {
   request.http.path = gpr_strdup(uri->path().c_str());
   request.handshaker =
       uri->scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
-  grpc_resource_quota* resource_quota =
-      grpc_resource_quota_create("external_account_credentials");
   grpc_http_response_destroy(&ctx_->response);
   ctx_->response = {};
   GRPC_CLOSURE_INIT(&ctx_->closure, OnRetrieveRegion, this, nullptr);
-  grpc_httpcli_get(ctx_->httpcli_context, ctx_->pollent, resource_quota,
-                   &request, ctx_->deadline, &ctx_->closure, &ctx_->response);
+  grpc_httpcli_get(ctx_->pollent, ResourceQuota::Default(), &request,
+                   ctx_->deadline, &ctx_->closure, &ctx_->response);
   grpc_http_request_destroy(&request.http);
 }
 
@@ -214,13 +212,12 @@ void AwsExternalAccountCredentials::RetrieveRoleName() {
   request.http.path = gpr_strdup(uri->path().c_str());
   request.handshaker =
       uri->scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
-  grpc_resource_quota* resource_quota =
-      grpc_resource_quota_create("external_account_credentials");
   grpc_http_response_destroy(&ctx_->response);
   ctx_->response = {};
   GRPC_CLOSURE_INIT(&ctx_->closure, OnRetrieveRoleName, this, nullptr);
-  grpc_httpcli_get(ctx_->httpcli_context, ctx_->pollent, resource_quota,
-                   &request, ctx_->deadline, &ctx_->closure, &ctx_->response);
+  // TODO(ctiller): use the caller's resource quota.
+  grpc_httpcli_get(ctx_->pollent, ResourceQuota::Default(), &request,
+                   ctx_->deadline, &ctx_->closure, &ctx_->response);
   grpc_http_request_destroy(&request.http);
 }
 
@@ -274,13 +271,12 @@ void AwsExternalAccountCredentials::RetrieveSigningKeys() {
   request.http.path = gpr_strdup(uri->path().c_str());
   request.handshaker =
       uri->scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
-  grpc_resource_quota* resource_quota =
-      grpc_resource_quota_create("external_account_credentials");
   grpc_http_response_destroy(&ctx_->response);
   ctx_->response = {};
   GRPC_CLOSURE_INIT(&ctx_->closure, OnRetrieveSigningKeys, this, nullptr);
-  grpc_httpcli_get(ctx_->httpcli_context, ctx_->pollent, resource_quota,
-                   &request, ctx_->deadline, &ctx_->closure, &ctx_->response);
+  // TODO(ctiller): use the caller's resource quota.
+  grpc_httpcli_get(ctx_->pollent, ResourceQuota::Default(), &request,
+                   ctx_->deadline, &ctx_->closure, &ctx_->response);
   grpc_http_request_destroy(&request.http);
 }
 

data/src/core/lib/security/credentials/external/external_account_credentials.cc

@@ -17,9 +17,11 @@
 
 #include "src/core/lib/security/credentials/external/external_account_credentials.h"
 
+#include "absl/strings/match.h"
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_join.h"
 #include "absl/strings/str_split.h"
+#include "absl/strings/strip.h"
 #include "absl/time/clock.h"
 #include "absl/time/time.h"
 
@@ -59,6 +61,23 @@ std::string UrlEncode(const absl::string_view& s) {
   return result;
 }
 
+// Expression to match:
+// //iam.googleapis.com/locations/[^/]+/workforcePools/[^/]+/providers/.+
+bool MatchWorkforcePoolAudience(absl::string_view audience) {
+  // Match "//iam.googleapis.com/locations/"
+  if (!absl::ConsumePrefix(&audience, "//iam.googleapis.com")) return false;
+  if (!absl::ConsumePrefix(&audience, "/locations/")) return false;
+  // Match "[^/]+/workforcePools/"
+  std::pair<absl::string_view, absl::string_view> workforce_pools_split_result =
+      absl::StrSplit(audience, absl::MaxSplits("/workforcePools/", 1));
+  if (absl::StrContains(workforce_pools_split_result.first, '/')) return false;
+  // Match "[^/]+/providers/.+"
+  std::pair<absl::string_view, absl::string_view> providers_split_result =
+      absl::StrSplit(workforce_pools_split_result.second,
+                     absl::MaxSplits("/providers/", 1));
+  return !absl::StrContains(providers_split_result.first, '/');
+}
+
 }  // namespace
 
 RefCountedPtr<ExternalAccountCredentials> ExternalAccountCredentials::Create(
@@ -151,6 +170,17 @@ RefCountedPtr<ExternalAccountCredentials> ExternalAccountCredentials::Create(
   if (it != json.object_value().end()) {
     options.client_secret = it->second.string_value();
   }
+  it = json.object_value().find("workforce_pool_user_project");
+  if (it != json.object_value().end()) {
+    if (MatchWorkforcePoolAudience(options.audience)) {
+      options.workforce_pool_user_project = it->second.string_value();
+    } else {
+      *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
+          "workforce_pool_user_project should not be set for non-workforce "
+          "pool credentials");
+      return nullptr;
+    }
+  }
   RefCountedPtr<ExternalAccountCredentials> creds;
   if (options.credential_source.object_value().find("environment_id") !=
       options.credential_source.object_value().end()) {
@@ -207,10 +237,10 @@ std::string ExternalAccountCredentials::debug_string() {
 // down.
 void ExternalAccountCredentials::fetch_oauth2(
     grpc_credentials_metadata_request* metadata_req,
-    grpc_httpcli_context* httpcli_context, grpc_polling_entity* pollent,
-    grpc_iomgr_cb_func response_cb, grpc_millis deadline) {
+    grpc_polling_entity* pollent, grpc_iomgr_cb_func response_cb,
+    grpc_millis deadline) {
   GPR_ASSERT(ctx_ == nullptr);
-  ctx_ = new HTTPRequestContext(httpcli_context, pollent, deadline);
+  ctx_ = new HTTPRequestContext(pollent, deadline);
   metadata_req_ = metadata_req;
   response_cb_ = response_cb;
   auto cb = [this](std::string token, grpc_error_handle error) {
@@ -267,34 +297,38 @@ void ExternalAccountCredentials::ExchangeToken(
   request.handshaker =
       uri->scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
   std::vector<std::string> body_parts;
-  body_parts.push_back(absl::StrFormat("%s=%s", "audience",
-                                       UrlEncode(options_.audience).c_str()));
+  body_parts.push_back(
+      absl::StrFormat("audience=%s", UrlEncode(options_.audience).c_str()));
   body_parts.push_back(absl::StrFormat(
-      "%s=%s", "grant_type",
+      "grant_type=%s",
       UrlEncode(EXTERNAL_ACCOUNT_CREDENTIALS_GRANT_TYPE).c_str()));
   body_parts.push_back(absl::StrFormat(
-      "%s=%s", "requested_token_type",
+      "requested_token_type=%s",
       UrlEncode(EXTERNAL_ACCOUNT_CREDENTIALS_REQUESTED_TOKEN_TYPE).c_str()));
+  body_parts.push_back(absl::StrFormat(
+      "subject_token_type=%s", UrlEncode(options_.subject_token_type).c_str()));
   body_parts.push_back(
-      absl::StrFormat("%s=%s", "subject_token_type",
-                      UrlEncode(options_.subject_token_type).c_str()));
-  body_parts.push_back(absl::StrFormat("%s=%s", "subject_token",
-                                       UrlEncode(subject_token).c_str()));
+      absl::StrFormat("subject_token=%s", UrlEncode(subject_token).c_str()));
   std::string scope = GOOGLE_CLOUD_PLATFORM_DEFAULT_SCOPE;
   if (options_.service_account_impersonation_url.empty()) {
     scope = absl::StrJoin(scopes_, " ");
   }
-  body_parts.push_back(
-      absl::StrFormat("%s=%s", "scope", UrlEncode(scope).c_str()));
+  body_parts.push_back(absl::StrFormat("scope=%s", UrlEncode(scope).c_str()));
+  Json::Object addtional_options_json_object;
+  if (options_.client_id.empty() && options_.client_secret.empty()) {
+    addtional_options_json_object["userProject"] =
+        options_.workforce_pool_user_project;
+  }
+  Json addtional_options_json(std::move(addtional_options_json_object));
+  body_parts.push_back(absl::StrFormat(
+      "options=%s", UrlEncode(addtional_options_json.Dump()).c_str()));
   std::string body = absl::StrJoin(body_parts, "&");
-  grpc_resource_quota* resource_quota =
-      grpc_resource_quota_create("external_account_credentials");
   grpc_http_response_destroy(&ctx_->response);
   ctx_->response = {};
   GRPC_CLOSURE_INIT(&ctx_->closure, OnExchangeToken, this, nullptr);
-  grpc_httpcli_post(ctx_->httpcli_context, ctx_->pollent, resource_quota,
-                    &request, body.c_str(), body.size(), ctx_->deadline,
-                    &ctx_->closure, &ctx_->response);
+  grpc_httpcli_post(ctx_->pollent, ResourceQuota::Default(), &request,
+                    body.c_str(), body.size(), ctx_->deadline, &ctx_->closure,
+                    &ctx_->response);
   grpc_http_request_destroy(&request.http);
 }
 
@@ -372,15 +406,14 @@ void ExternalAccountCredentials::ImpersenateServiceAccount() {
   request.handshaker =
       uri->scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
   std::string scope = absl::StrJoin(scopes_, " ");
-  std::string body = absl::StrFormat("%s=%s", "scope", scope);
-  grpc_resource_quota* resource_quota =
-      grpc_resource_quota_create("external_account_credentials");
+  std::string body = absl::StrFormat("scope=%s", scope);
   grpc_http_response_destroy(&ctx_->response);
   ctx_->response = {};
   GRPC_CLOSURE_INIT(&ctx_->closure, OnImpersenateServiceAccount, this, nullptr);
-  grpc_httpcli_post(ctx_->httpcli_context, ctx_->pollent, resource_quota,
-                    &request, body.c_str(), body.size(), ctx_->deadline,
-                    &ctx_->closure, &ctx_->response);
+  // TODO(ctiller): Use the callers resource quota.
+  grpc_httpcli_post(ctx_->pollent, ResourceQuota::Default(), &request,
+                    body.c_str(), body.size(), ctx_->deadline, &ctx_->closure,
+                    &ctx_->response);
   grpc_http_request_destroy(&request.http);
 }
 

data/src/core/lib/security/credentials/external/external_account_credentials.h

@@ -46,6 +46,7 @@ class ExternalAccountCredentials
     std::string quota_project_id;
     std::string client_id;
     std::string client_secret;
+    std::string workforce_pool_user_project;
   };
 
   static RefCountedPtr<ExternalAccountCredentials> Create(
@@ -60,16 +61,12 @@ class ExternalAccountCredentials
   // This is a helper struct to pass information between multiple callback based
   // asynchronous calls.
   struct HTTPRequestContext {
-    HTTPRequestContext(grpc_httpcli_context* httpcli_context,
-                       grpc_polling_entity* pollent, grpc_millis deadline)
-        : httpcli_context(httpcli_context),
-          pollent(pollent),
-          deadline(deadline) {}
+    HTTPRequestContext(grpc_polling_entity* pollent, grpc_millis deadline)
+        : pollent(pollent), deadline(deadline) {}
     ~HTTPRequestContext() { grpc_http_response_destroy(&response); }
 
     // Contextual parameters passed from
     // grpc_oauth2_token_fetcher_credentials::fetch_oauth2().
-    grpc_httpcli_context* httpcli_context;
     grpc_polling_entity* pollent;
     grpc_millis deadline;
 
@@ -91,7 +88,6 @@ class ExternalAccountCredentials
   // This method implements the common token fetch logic and it will be called
   // when grpc_oauth2_token_fetcher_credentials request a new access token.
   void fetch_oauth2(grpc_credentials_metadata_request* req,
-                    grpc_httpcli_context* httpcli_context,
                     grpc_polling_entity* pollent, grpc_iomgr_cb_func cb,
                     grpc_millis deadline) override;
 

data/src/core/lib/security/credentials/external/url_external_account_credentials.cc

@@ -139,13 +139,11 @@ void UrlExternalAccountCredentials::RetrieveSubjectToken(
   request.http.hdrs = headers;
   request.handshaker =
       url_.scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
-  grpc_resource_quota* resource_quota =
-      grpc_resource_quota_create("external_account_credentials");
   grpc_http_response_destroy(&ctx_->response);
   ctx_->response = {};
   GRPC_CLOSURE_INIT(&ctx_->closure, OnRetrieveSubjectToken, this, nullptr);
-  grpc_httpcli_get(ctx_->httpcli_context, ctx_->pollent, resource_quota,
-                   &request, ctx_->deadline, &ctx_->closure, &ctx_->response);
+  grpc_httpcli_get(ctx_->pollent, ResourceQuota::Default(), &request,
+                   ctx_->deadline, &ctx_->closure, &ctx_->response);
   grpc_http_request_destroy(&request.http);
 }