grpc 1.42.0 → 1.46.3

data/src/core/lib/security/credentials/external/url_external_account_credentials.h

@@ -51,6 +51,7 @@ class UrlExternalAccountCredentials final : public ExternalAccountCredentials {
   std::string format_type_;
   std::string format_subject_token_field_name_;
 
+  OrphanablePtr<HttpRequest> http_request_;
   HTTPRequestContext* ctx_ = nullptr;
   std::function<void(std::string, grpc_error_handle)> cb_ = nullptr;
 };

data/src/core/lib/security/credentials/fake/fake_credentials.cc

@@ -29,6 +29,7 @@
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gpr/string.h"
 #include "src/core/lib/iomgr/executor.h"
+#include "src/core/lib/promise/promise.h"
 #include "src/core/lib/security/security_connector/fake/fake_security_connector.h"
 
 /* -- Fake transport security credentials. -- */
@@ -36,11 +37,6 @@
 namespace {
 class grpc_fake_channel_credentials final : public grpc_channel_credentials {
  public:
-  grpc_fake_channel_credentials()
-      : grpc_channel_credentials(
-            GRPC_CHANNEL_CREDENTIALS_TYPE_FAKE_TRANSPORT_SECURITY) {}
-  ~grpc_fake_channel_credentials() override = default;
-
   grpc_core::RefCountedPtr<grpc_channel_security_connector>
   create_security_connector(
       grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
@@ -49,19 +45,25 @@ class grpc_fake_channel_credentials final : public grpc_channel_credentials {
     return grpc_fake_channel_security_connector_create(
         this->Ref(), std::move(call_creds), target, args);
   }
+
+  const char* type() const override { return "Fake"; }
+
+ private:
+  int cmp_impl(const grpc_channel_credentials* other) const override {
+    // TODO(yashykt): Check if we can do something better here
+    return grpc_core::QsortCompare(
+        static_cast<const grpc_channel_credentials*>(this), other);
+  }
 };
 
 class grpc_fake_server_credentials final : public grpc_server_credentials {
  public:
-  grpc_fake_server_credentials()
-      : grpc_server_credentials(
-            GRPC_CHANNEL_CREDENTIALS_TYPE_FAKE_TRANSPORT_SECURITY) {}
-  ~grpc_fake_server_credentials() override = default;
-
   grpc_core::RefCountedPtr<grpc_server_security_connector>
   create_security_connector(const grpc_channel_args* /*args*/) override {
     return grpc_fake_server_security_connector_create(this->Ref());
   }
+
+  const char* type() const override { return "Fake"; }
 };
 }  // namespace
 
@@ -89,25 +91,19 @@ const char* grpc_fake_transport_get_expected_targets(
 
 /* -- Metadata-only test credentials. -- */
 
-bool grpc_md_only_test_credentials::get_request_metadata(
-    grpc_polling_entity* /*pollent*/, grpc_auth_metadata_context /*context*/,
-    grpc_credentials_mdelem_array* md_array, grpc_closure* on_request_metadata,
-    grpc_error_handle* /*error*/) {
-  grpc_credentials_mdelem_array_add(md_array, md_);
-  if (is_async_) {
-    grpc_core::ExecCtx::Run(DEBUG_LOCATION, on_request_metadata,
-                            GRPC_ERROR_NONE);
-    return false;
-  }
-  return true;
+grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
+grpc_md_only_test_credentials::GetRequestMetadata(
+    grpc_core::ClientMetadataHandle initial_metadata,
+    const grpc_call_credentials::GetRequestMetadataArgs*) {
+  initial_metadata->Append(
+      key_.as_string_view(), value_.Ref(),
+      [](absl::string_view, const grpc_core::Slice&) { abort(); });
+  return grpc_core::Immediate(std::move(initial_metadata));
 }
 
-void grpc_md_only_test_credentials::cancel_get_request_metadata(
-    grpc_credentials_mdelem_array* /*md_array*/, grpc_error_handle error) {
-  GRPC_ERROR_UNREF(error);
-}
+const char* grpc_md_only_test_credentials::Type() { return "MdOnlyTest"; }
 
 grpc_call_credentials* grpc_md_only_test_credentials_create(
-    const char* md_key, const char* md_value, bool is_async) {
-  return new grpc_md_only_test_credentials(md_key, md_value, is_async);
+    const char* md_key, const char* md_value) {
+  return new grpc_md_only_test_credentials(md_key, md_value);
 }

data/src/core/lib/security/credentials/fake/fake_credentials.h

@@ -59,29 +59,30 @@ const char* grpc_fake_transport_get_expected_targets(
 
 class grpc_md_only_test_credentials : public grpc_call_credentials {
  public:
-  grpc_md_only_test_credentials(const char* md_key, const char* md_value,
-                                bool is_async)
-      : grpc_call_credentials(GRPC_CALL_CREDENTIALS_TYPE_OAUTH2,
-                              GRPC_SECURITY_NONE),
-        md_(grpc_mdelem_from_slices(grpc_slice_from_copied_string(md_key),
-                                    grpc_slice_from_copied_string(md_value))),
-        is_async_(is_async) {}
-  ~grpc_md_only_test_credentials() override { GRPC_MDELEM_UNREF(md_); }
-
-  bool get_request_metadata(grpc_polling_entity* pollent,
-                            grpc_auth_metadata_context context,
-                            grpc_credentials_mdelem_array* md_array,
-                            grpc_closure* on_request_metadata,
-                            grpc_error_handle* error) override;
-
-  void cancel_get_request_metadata(grpc_credentials_mdelem_array* md_array,
-                                   grpc_error_handle error) override;
-
-  std::string debug_string() override { return "MD only Test Credentials"; };
+  grpc_md_only_test_credentials(const char* md_key, const char* md_value)
+      : grpc_call_credentials(GRPC_SECURITY_NONE),
+        key_(grpc_core::Slice::FromCopiedString(md_key)),
+        value_(grpc_core::Slice::FromCopiedString(md_value)) {}
+
+  grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
+  GetRequestMetadata(grpc_core::ClientMetadataHandle initial_metadata,
+                     const GetRequestMetadataArgs* args) override;
+
+  std::string debug_string() override { return "MD only Test Credentials"; }
+
+  static const char* Type();
+
+  const char* type() const override { return Type(); }
 
  private:
-  grpc_mdelem md_;
-  bool is_async_;
+  int cmp_impl(const grpc_call_credentials* other) const override {
+    // TODO(yashykt): Check if we can do something better here
+    return grpc_core::QsortCompare(
+        static_cast<const grpc_call_credentials*>(this), other);
+  }
+
+  grpc_core::Slice key_;
+  grpc_core::Slice value_;
 };
 
 #endif /* GRPC_CORE_LIB_SECURITY_CREDENTIALS_FAKE_FAKE_CREDENTIALS_H */

data/src/core/lib/security/credentials/google_default/google_default_credentials.cc

@@ -138,6 +138,10 @@ grpc_channel_args* grpc_google_default_channel_credentials::update_arguments(
   return updated;
 }
 
+const char* grpc_google_default_channel_credentials::type() const {
+  return "GoogleDefault";
+}
+
 static void on_metadata_server_detection_http_response(
     void* user_data, grpc_error_handle error) {
   metadata_server_detector* detector =
@@ -171,30 +175,31 @@ static void destroy_pollset(void* p, grpc_error_handle /*e*/) {
 
 static int is_metadata_server_reachable() {
   metadata_server_detector detector;
-  grpc_httpcli_request request;
-  grpc_httpcli_context context;
+  grpc_http_request request;
   grpc_closure destroy_closure;
   /* The http call is local. If it takes more than one sec, it is for sure not
      on compute engine. */
-  grpc_millis max_detection_delay = GPR_MS_PER_SEC;
+  const auto max_detection_delay = grpc_core::Duration::Seconds(1);
   grpc_pollset* pollset =
       static_cast<grpc_pollset*>(gpr_zalloc(grpc_pollset_size()));
   grpc_pollset_init(pollset, &g_polling_mu);
   detector.pollent = grpc_polling_entity_create_from_pollset(pollset);
   detector.is_done = 0;
   detector.success = 0;
-  memset(&request, 0, sizeof(grpc_httpcli_request));
-  request.host = const_cast<char*>(GRPC_COMPUTE_ENGINE_DETECTION_HOST);
-  request.http.path = const_cast<char*>("/");
-  grpc_httpcli_context_init(&context);
-  grpc_resource_quota* resource_quota =
-      grpc_resource_quota_create("google_default_credentials");
-  grpc_httpcli_get(
-      &context, &detector.pollent, resource_quota, &request,
+  memset(&request, 0, sizeof(grpc_http_request));
+  auto uri =
+      grpc_core::URI::Create("http", GRPC_COMPUTE_ENGINE_DETECTION_HOST, "/",
+                             {} /* query params */, "" /* fragment */);
+  GPR_ASSERT(uri.ok());  // params are hardcoded
+  auto http_request = grpc_core::HttpRequest::Get(
+      std::move(*uri), nullptr /* channel args */, &detector.pollent, &request,
       grpc_core::ExecCtx::Get()->Now() + max_detection_delay,
       GRPC_CLOSURE_CREATE(on_metadata_server_detection_http_response, &detector,
                           grpc_schedule_on_exec_ctx),
-      &detector.response);
+      &detector.response,
+      grpc_core::RefCountedPtr<grpc_channel_credentials>(
+          grpc_insecure_credentials_create()));
+  http_request->Start();
   grpc_core::ExecCtx::Get()->Flush();
   /* Block until we get the response. This is not ideal but this should only be
     called once for the lifetime of the process by the default credentials. */
@@ -204,13 +209,13 @@ static int is_metadata_server_reachable() {
     if (!GRPC_LOG_IF_ERROR(
             "pollset_work",
             grpc_pollset_work(grpc_polling_entity_pollset(&detector.pollent),
-                              &worker, GRPC_MILLIS_INF_FUTURE))) {
+                              &worker, grpc_core::Timestamp::InfFuture()))) {
       detector.is_done = 1;
       detector.success = 0;
     }
   }
   gpr_mu_unlock(g_polling_mu);
-  grpc_httpcli_context_destroy(&context);
+  http_request.reset();
   GRPC_CLOSURE_INIT(&destroy_closure, destroy_pollset,
                     grpc_polling_entity_pollset(&detector.pollent),
                     grpc_schedule_on_exec_ctx);
@@ -441,9 +446,9 @@ void set_gce_tenancy_checker_for_testing(grpc_gce_tenancy_checker checker) {
 }
 
 void grpc_flush_cached_google_default_credentials(void) {
-  grpc_core::ExecCtx exec_ctx;
+  ExecCtx exec_ctx;
   gpr_once_init(&g_once, init_default_credentials);
-  grpc_core::MutexLock lock(g_state_mu);
+  MutexLock lock(g_state_mu);
   g_metadata_server_available = 0;
 }
 

data/src/core/lib/security/credentials/google_default/google_default_credentials.h

@@ -46,9 +46,7 @@ class grpc_google_default_channel_credentials
   grpc_google_default_channel_credentials(
       grpc_core::RefCountedPtr<grpc_channel_credentials> alts_creds,
       grpc_core::RefCountedPtr<grpc_channel_credentials> ssl_creds)
-      : grpc_channel_credentials(GRPC_CHANNEL_CREDENTIALS_TYPE_GOOGLE_DEFAULT),
-        alts_creds_(std::move(alts_creds)),
-        ssl_creds_(std::move(ssl_creds)) {}
+      : alts_creds_(std::move(alts_creds)), ssl_creds_(std::move(ssl_creds)) {}
 
   ~grpc_google_default_channel_credentials() override = default;
 
@@ -60,12 +58,20 @@ class grpc_google_default_channel_credentials
 
   grpc_channel_args* update_arguments(grpc_channel_args* args) override;
 
+  const char* type() const override;
+
   const grpc_channel_credentials* alts_creds() const {
     return alts_creds_.get();
   }
   const grpc_channel_credentials* ssl_creds() const { return ssl_creds_.get(); }
 
  private:
+  int cmp_impl(const grpc_channel_credentials* other) const override {
+    // TODO(yashykt): Check if we can do something better here
+    return grpc_core::QsortCompare(
+        static_cast<const grpc_channel_credentials*>(this), other);
+  }
+
   grpc_core::RefCountedPtr<grpc_channel_credentials> alts_creds_;
   grpc_core::RefCountedPtr<grpc_channel_credentials> ssl_creds_;
 };

data/src/core/lib/security/credentials/iam/iam_credentials.cc

@@ -28,42 +28,35 @@
 #include <grpc/support/sync.h>
 
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/promise/promise.h"
 #include "src/core/lib/surface/api_trace.h"
 
-grpc_google_iam_credentials::~grpc_google_iam_credentials() {
-  grpc_credentials_mdelem_array_destroy(&md_array_);
-}
-
-bool grpc_google_iam_credentials::get_request_metadata(
-    grpc_polling_entity* /*pollent*/, grpc_auth_metadata_context /*context*/,
-    grpc_credentials_mdelem_array* md_array,
-    grpc_closure* /*on_request_metadata*/, grpc_error_handle* /*error*/) {
-  grpc_credentials_mdelem_array_append(md_array, &md_array_);
-  return true;
-}
-
-void grpc_google_iam_credentials::cancel_get_request_metadata(
-    grpc_credentials_mdelem_array* /*md_array*/, grpc_error_handle error) {
-  GRPC_ERROR_UNREF(error);
+grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
+grpc_google_iam_credentials::GetRequestMetadata(
+    grpc_core::ClientMetadataHandle initial_metadata,
+    const grpc_call_credentials::GetRequestMetadataArgs*) {
+  if (token_.has_value()) {
+    initial_metadata->Append(
+        GRPC_IAM_AUTHORIZATION_TOKEN_METADATA_KEY, token_->Ref(),
+        [](absl::string_view, const grpc_core::Slice&) { abort(); });
+  }
+  initial_metadata->Append(
+      GRPC_IAM_AUTHORITY_SELECTOR_METADATA_KEY, authority_selector_.Ref(),
+      [](absl::string_view, const grpc_core::Slice&) { abort(); });
+  return grpc_core::Immediate(std::move(initial_metadata));
 }
 
 grpc_google_iam_credentials::grpc_google_iam_credentials(
     const char* token, const char* authority_selector)
-    : grpc_call_credentials(GRPC_CALL_CREDENTIALS_TYPE_IAM),
+    : token_(token == nullptr ? absl::optional<grpc_core::Slice>()
+                              : grpc_core::Slice::FromCopiedString(token)),
+      authority_selector_(
+          grpc_core::Slice::FromCopiedString(authority_selector)),
       debug_string_(absl::StrFormat(
           "GoogleIAMCredentials{Token:%s,AuthoritySelector:%s}",
-          token != nullptr ? "present" : "absent", authority_selector)) {
-  grpc_mdelem md = grpc_mdelem_from_slices(
-      grpc_slice_from_static_string(GRPC_IAM_AUTHORIZATION_TOKEN_METADATA_KEY),
-      grpc_slice_from_copied_string(token));
-  grpc_credentials_mdelem_array_add(&md_array_, md);
-  GRPC_MDELEM_UNREF(md);
-  md = grpc_mdelem_from_slices(
-      grpc_slice_from_static_string(GRPC_IAM_AUTHORITY_SELECTOR_METADATA_KEY),
-      grpc_slice_from_copied_string(authority_selector));
-  grpc_credentials_mdelem_array_add(&md_array_, md);
-  GRPC_MDELEM_UNREF(md);
-}
+          token != nullptr ? "present" : "absent", authority_selector)) {}
+
+const char* grpc_google_iam_credentials::Type() { return "Iam"; }
 
 grpc_call_credentials* grpc_google_iam_credentials_create(
     const char* token, const char* authority_selector, void* reserved) {

data/src/core/lib/security/credentials/iam/iam_credentials.h

@@ -29,20 +29,26 @@ class grpc_google_iam_credentials : public grpc_call_credentials {
  public:
   grpc_google_iam_credentials(const char* token,
                               const char* authority_selector);
-  ~grpc_google_iam_credentials() override;
 
-  bool get_request_metadata(grpc_polling_entity* pollent,
-                            grpc_auth_metadata_context context,
-                            grpc_credentials_mdelem_array* md_array,
-                            grpc_closure* on_request_metadata,
-                            grpc_error_handle* error) override;
+  grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
+  GetRequestMetadata(grpc_core::ClientMetadataHandle initial_metadata,
+                     const GetRequestMetadataArgs* args) override;
 
-  void cancel_get_request_metadata(grpc_credentials_mdelem_array* md_array,
-                                   grpc_error_handle error) override;
   std::string debug_string() override { return debug_string_; }
 
+  static const char* Type();
+
+  const char* type() const override { return Type(); }
+
  private:
-  grpc_credentials_mdelem_array md_array_;
+  int cmp_impl(const grpc_call_credentials* other) const override {
+    // TODO(yashykt): Check if we can do something better here
+    return grpc_core::QsortCompare(
+        static_cast<const grpc_call_credentials*>(this), other);
+  }
+
+  const absl::optional<grpc_core::Slice> token_;
+  const grpc_core::Slice authority_selector_;
   const std::string debug_string_;
 };
 

data/src/core/lib/security/credentials/insecure/insecure_credentials.cc

@@ -18,45 +18,44 @@
 
 #include <grpc/support/port_platform.h>
 
-#include <grpc/grpc_security.h>
+#include "src/core/lib/security/credentials/insecure/insecure_credentials.h"
 
-#include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/security_connector/insecure/insecure_security_connector.h"
 
 namespace grpc_core {
-namespace {
 
-constexpr char kCredentialsTypeInsecure[] = "insecure";
+RefCountedPtr<grpc_channel_security_connector>
+InsecureCredentials::create_security_connector(
+    RefCountedPtr<grpc_call_credentials> request_metadata_creds,
+    const char* /* target_name */, const grpc_channel_args* /* args */,
+    grpc_channel_args** /* new_args */) {
+  return MakeRefCounted<InsecureChannelSecurityConnector>(
+      Ref(), std::move(request_metadata_creds));
+}
 
-class InsecureCredentials final : public grpc_channel_credentials {
- public:
-  InsecureCredentials() : grpc_channel_credentials(kCredentialsTypeInsecure) {}
+const char* InsecureCredentials::Type() { return "Insecure"; }
 
-  RefCountedPtr<grpc_channel_security_connector> create_security_connector(
-      RefCountedPtr<grpc_call_credentials> call_creds,
-      const char* /* target_name */, const grpc_channel_args* /* args */,
-      grpc_channel_args** /* new_args */) override {
-    return MakeRefCounted<InsecureChannelSecurityConnector>(
-        Ref(), std::move(call_creds));
-  }
-};
+int InsecureCredentials::cmp_impl(
+    const grpc_channel_credentials* /* other */) const {
+  // All insecure credentials objects should compare equal.
+  return 0;
+}
 
-class InsecureServerCredentials final : public grpc_server_credentials {
- public:
-  InsecureServerCredentials()
-      : grpc_server_credentials(kCredentialsTypeInsecure) {}
+RefCountedPtr<grpc_server_security_connector>
+InsecureServerCredentials::create_security_connector(
+    const grpc_channel_args* /* args */) {
+  return MakeRefCounted<InsecureServerSecurityConnector>(Ref());
+}
 
-  RefCountedPtr<grpc_server_security_connector> create_security_connector(
-      const grpc_channel_args* /* args */) override {
-    return MakeRefCounted<InsecureServerSecurityConnector>(Ref());
-  }
-};
+const char* InsecureServerCredentials::Type() { return "Insecure"; }
 
-}  // namespace
 }  // namespace grpc_core
 
 grpc_channel_credentials* grpc_insecure_credentials_create() {
-  return new grpc_core::InsecureCredentials();
+  // Create a singleton object for InsecureCredentials so that channels to the
+  // same target with InsecureCredentials can reuse the subchannels.
+  static auto* creds = new grpc_core::InsecureCredentials();
+  return creds->Ref().release();
 }
 
 grpc_server_credentials* grpc_insecure_server_credentials_create() {

data/src/core/lib/security/credentials/insecure/insecure_credentials.h

@@ -0,0 +1,57 @@
+//
+//
+// Copyright 2022 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPC_CORE_LIB_SECURITY_CREDENTIALS_INSECURE_INSECURE_CREDENTIALS_H
+#define GRPC_CORE_LIB_SECURITY_CREDENTIALS_INSECURE_INSECURE_CREDENTIALS_H
+
+#include <grpc/support/port_platform.h>
+
+#include <grpc/grpc_security.h>
+
+#include "src/core/lib/security/credentials/credentials.h"
+
+namespace grpc_core {
+
+class InsecureCredentials final : public grpc_channel_credentials {
+ public:
+  RefCountedPtr<grpc_channel_security_connector> create_security_connector(
+      RefCountedPtr<grpc_call_credentials> request_metadata_creds,
+      const char* /* target_name */, const grpc_channel_args* /* args */,
+      grpc_channel_args** /* new_args */) override;
+
+  static const char* Type();
+
+  const char* type() const override { return Type(); }
+
+ private:
+  int cmp_impl(const grpc_channel_credentials* other) const override;
+};
+
+class InsecureServerCredentials final : public grpc_server_credentials {
+ public:
+  RefCountedPtr<grpc_server_security_connector> create_security_connector(
+      const grpc_channel_args* /* args */) override;
+
+  static const char* Type();
+
+  const char* type() const override { return Type(); }
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_LIB_SECURITY_CREDENTIALS_INSECURE_INSECURE_CREDENTIALS_H

data/src/core/lib/security/credentials/jwt/json_token.cc

@@ -22,6 +22,10 @@
 
 #include <string.h>
 
+#include <openssl/bio.h>
+#include <openssl/evp.h>
+#include <openssl/pem.h>
+
 #include <grpc/grpc_security.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
@@ -33,12 +37,6 @@
 #include "src/core/lib/security/util/json_util.h"
 #include "src/core/lib/slice/b64.h"
 
-extern "C" {
-#include <openssl/bio.h>
-#include <openssl/evp.h>
-#include <openssl/pem.h>
-}
-
 using grpc_core::Json;
 
 /* --- Constants. --- */

data/src/core/lib/security/credentials/jwt/jwt_credentials.cc

@@ -34,6 +34,8 @@
 
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/promise/promise.h"
+#include "src/core/lib/security/credentials/call_creds_util.h"
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/lib/surface/api_trace.h"
 #include "src/core/lib/transport/error_utils.h"
@@ -41,87 +43,70 @@
 
 using grpc_core::Json;
 
-void grpc_service_account_jwt_access_credentials::reset_cache() {
-  GRPC_MDELEM_UNREF(cached_.jwt_md);
-  cached_.jwt_md = GRPC_MDNULL;
-  cached_.service_url.clear();
-  cached_.jwt_expiration = gpr_inf_past(GPR_CLOCK_REALTIME);
-}
-
 grpc_service_account_jwt_access_credentials::
     ~grpc_service_account_jwt_access_credentials() {
   grpc_auth_json_key_destruct(&key_);
-  reset_cache();
   gpr_mu_destroy(&cache_mu_);
 }
 
-bool grpc_service_account_jwt_access_credentials::get_request_metadata(
-    grpc_polling_entity* /*pollent*/, grpc_auth_metadata_context context,
-    grpc_credentials_mdelem_array* md_array,
-    grpc_closure* /*on_request_metadata*/, grpc_error_handle* error) {
+grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
+grpc_service_account_jwt_access_credentials::GetRequestMetadata(
+    grpc_core::ClientMetadataHandle initial_metadata,
+    const grpc_call_credentials::GetRequestMetadataArgs* args) {
   gpr_timespec refresh_threshold = gpr_time_from_seconds(
       GRPC_SECURE_TOKEN_REFRESH_THRESHOLD_SECS, GPR_TIMESPAN);
 
   // Remove service name from service_url to follow the audience format
   // dictated in https://google.aip.dev/auth/4111.
-  absl::StatusOr<std::string> uri =
-      grpc_core::RemoveServiceNameFromJwtUri(context.service_url);
+  absl::StatusOr<std::string> uri = grpc_core::RemoveServiceNameFromJwtUri(
+      grpc_core::MakeJwtServiceUrl(initial_metadata, args));
   if (!uri.ok()) {
-    *error = absl_status_to_grpc_error(uri.status());
-    return true;
+    return grpc_core::Immediate(uri.status());
   }
-  /* See if we can return a cached jwt. */
-  grpc_mdelem jwt_md = GRPC_MDNULL;
+  // See if we can return a cached jwt.
+  absl::optional<grpc_core::Slice> jwt_value;
   {
     gpr_mu_lock(&cache_mu_);
-    if (!cached_.service_url.empty() && cached_.service_url == *uri &&
-        !GRPC_MDISNULL(cached_.jwt_md) &&
+    if (cached_.has_value() && cached_->service_url == *uri &&
         (gpr_time_cmp(
-             gpr_time_sub(cached_.jwt_expiration, gpr_now(GPR_CLOCK_REALTIME)),
+             gpr_time_sub(cached_->jwt_expiration, gpr_now(GPR_CLOCK_REALTIME)),
              refresh_threshold) > 0)) {
-      jwt_md = GRPC_MDELEM_REF(cached_.jwt_md);
+      jwt_value = cached_->jwt_value.Ref();
     }
     gpr_mu_unlock(&cache_mu_);
   }
 
-  if (GRPC_MDISNULL(jwt_md)) {
+  if (!jwt_value.has_value()) {
     char* jwt = nullptr;
-    /* Generate a new jwt. */
+    // Generate a new jwt.
     gpr_mu_lock(&cache_mu_);
-    reset_cache();
+    cached_.reset();
     jwt = grpc_jwt_encode_and_sign(&key_, uri->c_str(), jwt_lifetime_, nullptr);
     if (jwt != nullptr) {
       std::string md_value = absl::StrCat("Bearer ", jwt);
       gpr_free(jwt);
-      cached_.jwt_expiration =
-          gpr_time_add(gpr_now(GPR_CLOCK_REALTIME), jwt_lifetime_);
-      cached_.service_url = std::move(*uri);
-      cached_.jwt_md = grpc_mdelem_from_slices(
-          grpc_slice_from_static_string(GRPC_AUTHORIZATION_METADATA_KEY),
-          grpc_slice_from_cpp_string(std::move(md_value)));
-      jwt_md = GRPC_MDELEM_REF(cached_.jwt_md);
+      jwt_value = grpc_core::Slice::FromCopiedString(md_value);
+      cached_ = {jwt_value->Ref(), std::move(*uri),
+                 gpr_time_add(gpr_now(GPR_CLOCK_REALTIME), jwt_lifetime_)};
     }
     gpr_mu_unlock(&cache_mu_);
   }
 
-  if (!GRPC_MDISNULL(jwt_md)) {
-    grpc_credentials_mdelem_array_add(md_array, jwt_md);
-    GRPC_MDELEM_UNREF(jwt_md);
-  } else {
-    *error = GRPC_ERROR_CREATE_FROM_STATIC_STRING("Could not generate JWT.");
+  if (!jwt_value.has_value()) {
+    return grpc_core::Immediate(
+        absl::UnauthenticatedError("Could not generate JWT."));
   }
-  return true;
-}
 
-void grpc_service_account_jwt_access_credentials::cancel_get_request_metadata(
-    grpc_credentials_mdelem_array* /*md_array*/, grpc_error_handle error) {
-  GRPC_ERROR_UNREF(error);
+  initial_metadata->Append(
+      GRPC_AUTHORIZATION_METADATA_KEY, std::move(*jwt_value),
+      [](absl::string_view, const grpc_core::Slice&) { abort(); });
+  return grpc_core::Immediate(std::move(initial_metadata));
 }
 
 grpc_service_account_jwt_access_credentials::
     grpc_service_account_jwt_access_credentials(grpc_auth_json_key key,
                                                 gpr_timespec token_lifetime)
-    : grpc_call_credentials(GRPC_CALL_CREDENTIALS_TYPE_JWT), key_(key) {
+    : key_(key) {
   gpr_timespec max_token_lifetime = grpc_max_auth_token_lifetime();
   if (gpr_time_cmp(token_lifetime, max_token_lifetime) > 0) {
     gpr_log(GPR_INFO,
@@ -131,7 +116,10 @@ grpc_service_account_jwt_access_credentials::
   }
   jwt_lifetime_ = token_lifetime;
   gpr_mu_init(&cache_mu_);
-  reset_cache();
+}
+
+const char* grpc_service_account_jwt_access_credentials::Type() {
+  return "Jwt";
 }
 
 grpc_core::RefCountedPtr<grpc_call_credentials>
@@ -182,7 +170,7 @@ grpc_call_credentials* grpc_service_account_jwt_access_credentials_create(
 namespace grpc_core {
 
 absl::StatusOr<std::string> RemoveServiceNameFromJwtUri(absl::string_view uri) {
-  auto parsed = grpc_core::URI::Parse(uri);
+  auto parsed = URI::Parse(uri);
   if (!parsed.ok()) {
     return parsed.status();
   }