grpc 1.44.0.pre2 → 1.45.0

data/src/core/lib/security/credentials/composite/composite_credentials.cc

@@ -33,91 +33,27 @@
 
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/iomgr/polling_entity.h"
+#include "src/core/lib/promise/try_seq.h"
 #include "src/core/lib/surface/api_trace.h"
+#include "src/core/lib/transport/transport.h"
 
-/* -- Composite call credentials. -- */
-
-static void composite_call_metadata_cb(void* arg, grpc_error_handle error);
-
-namespace {
-struct grpc_composite_call_credentials_metadata_context {
-  grpc_composite_call_credentials_metadata_context(
-      grpc_composite_call_credentials* composite_creds,
-      grpc_polling_entity* pollent, grpc_auth_metadata_context auth_md_context,
-      grpc_core::CredentialsMetadataArray* md_array,
-      grpc_closure* on_request_metadata)
-      : composite_creds(composite_creds),
-        pollent(pollent),
-        auth_md_context(auth_md_context),
-        md_array(md_array),
-        on_request_metadata(on_request_metadata) {
-    GRPC_CLOSURE_INIT(&internal_on_request_metadata, composite_call_metadata_cb,
-                      this, grpc_schedule_on_exec_ctx);
-  }
-
-  grpc_composite_call_credentials* composite_creds;
-  size_t creds_index = 0;
-  grpc_polling_entity* pollent;
-  grpc_auth_metadata_context auth_md_context;
-  grpc_core::CredentialsMetadataArray* md_array;
-  grpc_closure* on_request_metadata;
-  grpc_closure internal_on_request_metadata;
-};
-}  // namespace
-
-static void composite_call_metadata_cb(void* arg, grpc_error_handle error) {
-  grpc_composite_call_credentials_metadata_context* ctx =
-      static_cast<grpc_composite_call_credentials_metadata_context*>(arg);
-  if (error == GRPC_ERROR_NONE) {
-    const grpc_composite_call_credentials::CallCredentialsList& inner =
-        ctx->composite_creds->inner();
-    /* See if we need to get some more metadata. */
-    if (ctx->creds_index < inner.size()) {
-      if (inner[ctx->creds_index++]->get_request_metadata(
-              ctx->pollent, ctx->auth_md_context, ctx->md_array,
-              &ctx->internal_on_request_metadata, &error)) {
-        // Synchronous response, so call ourselves recursively.
-        composite_call_metadata_cb(arg, error);
-        GRPC_ERROR_UNREF(error);
-      }
-      return;
-    }
-    // We're done!
-  }
-  grpc_core::ExecCtx::Run(DEBUG_LOCATION, ctx->on_request_metadata,
-                          GRPC_ERROR_REF(error));
-  delete ctx;
-}
+namespace grpc_core {
+const char kCredentialsTypeComposite[] = "composite";
+}  // namespace grpc_core
 
-bool grpc_composite_call_credentials::get_request_metadata(
-    grpc_polling_entity* pollent, grpc_auth_metadata_context auth_md_context,
-    grpc_core::CredentialsMetadataArray* md_array,
-    grpc_closure* on_request_metadata, grpc_error_handle* error) {
-  grpc_composite_call_credentials_metadata_context* ctx;
-  ctx = new grpc_composite_call_credentials_metadata_context(
-      this, pollent, auth_md_context, md_array, on_request_metadata);
-  bool synchronous = true;
-  const CallCredentialsList& inner = ctx->composite_creds->inner();
-  while (ctx->creds_index < inner.size()) {
-    if (inner[ctx->creds_index++]->get_request_metadata(
-            ctx->pollent, ctx->auth_md_context, ctx->md_array,
-            &ctx->internal_on_request_metadata, error)) {
-      if (*error != GRPC_ERROR_NONE) break;
-    } else {
-      synchronous = false;  // Async return.
-      break;
-    }
-  }
-  if (synchronous) delete ctx;
-  return synchronous;
-}
+/* -- Composite call credentials. -- */
 
-void grpc_composite_call_credentials::cancel_get_request_metadata(
-    grpc_core::CredentialsMetadataArray* md_array, grpc_error_handle error) {
-  for (size_t i = 0; i < inner_.size(); ++i) {
-    inner_[i]->cancel_get_request_metadata(md_array, GRPC_ERROR_REF(error));
-  }
-  GRPC_ERROR_UNREF(error);
+grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientInitialMetadata>>
+grpc_composite_call_credentials::GetRequestMetadata(
+    grpc_core::ClientInitialMetadata initial_metadata,
+    const grpc_call_credentials::GetRequestMetadataArgs* args) {
+  auto self = Ref();
+  return TrySeqIter(
+      inner_.begin(), inner_.end(), std::move(initial_metadata),
+      [self, args](const grpc_core::RefCountedPtr<grpc_call_credentials>& creds,
+                   grpc_core::ClientInitialMetadata initial_metadata) {
+        return creds->GetRequestMetadata(std::move(initial_metadata), args);
+      });
 }
 
 std::string grpc_composite_call_credentials::debug_string() {

data/src/core/lib/security/credentials/composite/composite_credentials.h

@@ -30,12 +30,16 @@
 
 /* -- Composite channel credentials. -- */
 
+namespace grpc_core {
+extern const char kCredentialsTypeComposite[];
+}
+
 class grpc_composite_channel_credentials : public grpc_channel_credentials {
  public:
   grpc_composite_channel_credentials(
       grpc_core::RefCountedPtr<grpc_channel_credentials> channel_creds,
       grpc_core::RefCountedPtr<grpc_call_credentials> call_creds)
-      : grpc_channel_credentials(channel_creds->type()),
+      : grpc_channel_credentials(grpc_core::kCredentialsTypeComposite),
         inner_creds_(std::move(channel_creds)),
         call_creds_(std::move(call_creds)) {}
 
@@ -63,6 +67,13 @@ class grpc_composite_channel_credentials : public grpc_channel_credentials {
   grpc_call_credentials* mutable_call_creds() { return call_creds_.get(); }
 
  private:
+  int cmp_impl(const grpc_channel_credentials* other) const override {
+    auto* o = static_cast<const grpc_composite_channel_credentials*>(other);
+    int r = inner_creds_->cmp(o->inner_creds_.get());
+    if (r != 0) return r;
+    return call_creds_->cmp(o->call_creds_.get());
+  }
+
   grpc_core::RefCountedPtr<grpc_channel_credentials> inner_creds_;
   grpc_core::RefCountedPtr<grpc_call_credentials> call_creds_;
 };
@@ -79,15 +90,9 @@ class grpc_composite_call_credentials : public grpc_call_credentials {
       grpc_core::RefCountedPtr<grpc_call_credentials> creds2);
   ~grpc_composite_call_credentials() override = default;
 
-  bool get_request_metadata(grpc_polling_entity* pollent,
-                            grpc_auth_metadata_context context,
-                            grpc_core::CredentialsMetadataArray* md_array,
-                            grpc_closure* on_request_metadata,
-                            grpc_error_handle* error) override;
-
-  void cancel_get_request_metadata(
-      grpc_core::CredentialsMetadataArray* md_array,
-      grpc_error_handle error) override;
+  grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientInitialMetadata>>
+  GetRequestMetadata(grpc_core::ClientInitialMetadata initial_metadata,
+                     const GetRequestMetadataArgs* args) override;
 
   grpc_security_level min_security_level() const override {
     return min_security_level_;
@@ -97,6 +102,12 @@ class grpc_composite_call_credentials : public grpc_call_credentials {
   std::string debug_string() override;
 
  private:
+  int cmp_impl(const grpc_call_credentials* other) const override {
+    // TODO(yashykt): Check if we can do something better here
+    return grpc_core::QsortCompare(
+        static_cast<const grpc_call_credentials*>(this), other);
+  }
+
   void push_to_inner(grpc_core::RefCountedPtr<grpc_call_credentials> creds,
                      bool is_composite);
   grpc_security_level min_security_level_;

data/src/core/lib/security/credentials/credentials.cc

@@ -31,8 +31,6 @@
 
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gpr/string.h"
-#include "src/core/lib/http/httpcli.h"
-#include "src/core/lib/http/parser.h"
 #include "src/core/lib/iomgr/executor.h"
 #include "src/core/lib/json/json.h"
 #include "src/core/lib/surface/api_trace.h"
@@ -60,7 +58,8 @@ static void* credentials_pointer_arg_copy(void* p) {
 }
 
 static int credentials_pointer_cmp(void* a, void* b) {
-  return grpc_core::QsortCompare(a, b);
+  return static_cast<const grpc_channel_credentials*>(a)->cmp(
+      static_cast<const grpc_channel_credentials*>(b));
 }
 
 static const grpc_arg_pointer_vtable credentials_pointer_vtable = {

data/src/core/lib/security/credentials/credentials.h

@@ -30,11 +30,12 @@
 #include <grpc/support/sync.h>
 
 #include "src/core/lib/gprpp/ref_counted.h"
-#include "src/core/lib/http/httpcli.h"
-#include "src/core/lib/http/parser.h"
 #include "src/core/lib/iomgr/polling_entity.h"
+#include "src/core/lib/promise/arena_promise.h"
+#include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/security/security_connector/security_connector.h"
 #include "src/core/lib/transport/metadata_batch.h"
+#include "src/core/lib/transport/transport.h"
 
 struct grpc_http_response;
 
@@ -51,6 +52,7 @@ typedef enum {
 #define GRPC_CHANNEL_CREDENTIALS_TYPE_FAKE_TRANSPORT_SECURITY \
   "FakeTransportSecurity"
 #define GRPC_CHANNEL_CREDENTIALS_TYPE_GOOGLE_DEFAULT "GoogleDefault"
+#define GRPC_CREDENTIALS_TYPE_INSECURE "insecure"
 
 #define GRPC_CALL_CREDENTIALS_TYPE_OAUTH2 "Oauth2"
 #define GRPC_CALL_CREDENTIALS_TYPE_JWT "Jwt"
@@ -101,6 +103,10 @@ void grpc_override_well_known_credentials_path_getter(
 struct grpc_channel_credentials
     : grpc_core::RefCounted<grpc_channel_credentials> {
  public:
+  // The pointer value \a type is used to uniquely identify a creds
+  // implementation for down-casting purposes. Every creds implementation should
+  // use a unique string instance, which should be returned by all instances of
+  // that creds implementation.
   explicit grpc_channel_credentials(const char* type) : type_(type) {}
   ~grpc_channel_credentials() override = default;
 
@@ -131,9 +137,30 @@ struct grpc_channel_credentials
     return args;
   }
 
+  // Compares this grpc_channel_credentials object with \a other.
+  // If this method returns 0, it means that gRPC can treat the two channel
+  // credentials as effectively the same. This method is used to compare
+  // `grpc_channel_credentials` objects when they are present in channel_args.
+  // One important usage of this is when channel args are used in SubchannelKey,
+  // which leads to a useful property that allows subchannels to be reused when
+  // two different `grpc_channel_credentials` objects are used but they compare
+  // as equal (assuming other channel args match).
+  int cmp(const grpc_channel_credentials* other) const {
+    GPR_ASSERT(other != nullptr);
+    // Intentionally uses grpc_core::QsortCompare instead of strcmp as a safety
+    // against different grpc_channel_credentials types using the same name.
+    int r = grpc_core::QsortCompare(type(), other->type());
+    if (r != 0) return r;
+    return cmp_impl(other);
+  }
+
   const char* type() const { return type_; }
 
  private:
+  // Implementation for `cmp` method intended to be overridden by subclasses.
+  // Only invoked if `type()` and `other->type()` compare equal as strings.
+  virtual int cmp_impl(const grpc_channel_credentials* other) const = 0;
+
   const char* type_;
 };
 
@@ -167,6 +194,20 @@ using CredentialsMetadataArray = std::vector<std::pair<Slice, Slice>>;
 struct grpc_call_credentials
     : public grpc_core::RefCounted<grpc_call_credentials> {
  public:
+  // TODO(roth): Consider whether security connector actually needs to
+  // be part of this interface.  Currently, it is here only for the
+  // url_scheme() method, which we might be able to instead add as an
+  // auth context property.
+  struct GetRequestMetadataArgs {
+    grpc_core::RefCountedPtr<grpc_channel_security_connector>
+        security_connector;
+    grpc_core::RefCountedPtr<grpc_auth_context> auth_context;
+  };
+
+  // The pointer value \a type is used to uniquely identify a creds
+  // implementation for down-casting purposes. Every creds implementation should
+  // use a unique string instance, which should be returned by all instances of
+  // that creds implementation.
   explicit grpc_call_credentials(
       const char* type,
       grpc_security_level min_security_level = GRPC_PRIVACY_AND_INTEGRITY)
@@ -174,26 +215,27 @@ struct grpc_call_credentials
 
   ~grpc_call_credentials() override = default;
 
-  // Returns true if completed synchronously, in which case \a error will
-  // be set to indicate the result.  Otherwise, \a on_request_metadata will
-  // be invoked asynchronously when complete.  \a md_array will be populated
-  // with the resulting metadata once complete.
-  virtual bool get_request_metadata(
-      grpc_polling_entity* pollent, grpc_auth_metadata_context context,
-      grpc_core::CredentialsMetadataArray* md_array,
-      grpc_closure* on_request_metadata, grpc_error_handle* error) = 0;
-
-  // Cancels a pending asynchronous operation started by
-  // grpc_call_credentials_get_request_metadata() with the corresponding
-  // value of \a md_array.
-  virtual void cancel_get_request_metadata(
-      grpc_core::CredentialsMetadataArray* md_array,
-      grpc_error_handle error) = 0;
+  virtual grpc_core::ArenaPromise<
+      absl::StatusOr<grpc_core::ClientInitialMetadata>>
+  GetRequestMetadata(grpc_core::ClientInitialMetadata initial_metadata,
+                     const GetRequestMetadataArgs* args) = 0;
 
   virtual grpc_security_level min_security_level() const {
     return min_security_level_;
   }
 
+  // Compares this grpc_call_credentials object with \a other.
+  // If this method returns 0, it means that gRPC can treat the two call
+  // credentials as effectively the same..
+  int cmp(const grpc_call_credentials* other) const {
+    GPR_ASSERT(other != nullptr);
+    // Intentionally uses grpc_core::QsortCompare instead of strcmp as a safety
+    // against different grpc_call_credentials types using the same name.
+    int r = grpc_core::QsortCompare(type(), other->type());
+    if (r != 0) return r;
+    return cmp_impl(other);
+  }
+
   virtual std::string debug_string() {
     return "grpc_call_credentials did not provide debug string";
   }
@@ -201,6 +243,10 @@ struct grpc_call_credentials
   const char* type() const { return type_; }
 
  private:
+  // Implementation for `cmp` method intended to be overridden by subclasses.
+  // Only invoked if `type()` and `other->type()` compare equal as strings.
+  virtual int cmp_impl(const grpc_call_credentials* other) const = 0;
+
   const char* type_;
   const grpc_security_level min_security_level_;
 };
@@ -208,7 +254,7 @@ struct grpc_call_credentials
 /* Metadata-only credentials with the specified key and value where
    asynchronicity can be simulated for testing. */
 grpc_call_credentials* grpc_md_only_test_credentials_create(
-    const char* md_key, const char* md_value, bool is_async);
+    const char* md_key, const char* md_value);
 
 /* --- grpc_server_credentials. --- */
 
@@ -253,29 +299,4 @@ grpc_server_credentials* grpc_server_credentials_from_arg(const grpc_arg* arg);
 grpc_server_credentials* grpc_find_server_credentials_in_args(
     const grpc_channel_args* args);
 
-/* -- Credentials Metadata Request. -- */
-
-struct grpc_credentials_metadata_request {
-  explicit grpc_credentials_metadata_request(
-      grpc_core::RefCountedPtr<grpc_call_credentials> creds)
-      : creds(std::move(creds)) {}
-  ~grpc_credentials_metadata_request() {
-    grpc_http_response_destroy(&response);
-  }
-
-  grpc_core::RefCountedPtr<grpc_call_credentials> creds;
-  grpc_http_response response;
-};
-
-inline grpc_credentials_metadata_request*
-grpc_credentials_metadata_request_create(
-    grpc_core::RefCountedPtr<grpc_call_credentials> creds) {
-  return new grpc_credentials_metadata_request(std::move(creds));
-}
-
-inline void grpc_credentials_metadata_request_destroy(
-    grpc_credentials_metadata_request* r) {
-  delete r;
-}
-
 #endif /* GRPC_CORE_LIB_SECURITY_CREDENTIALS_CREDENTIALS_H */

data/src/core/lib/security/credentials/external/aws_external_account_credentials.cc

@@ -22,6 +22,7 @@
 #include "absl/strings/str_replace.h"
 
 #include "src/core/lib/gpr/env.h"
+#include "src/core/lib/http/httpcli_ssl_credentials.h"
 
 namespace grpc_core {
 
@@ -160,18 +161,24 @@ void AwsExternalAccountCredentials::RetrieveRegion() {
                 "Invalid region url. %s", uri.status().ToString())));
     return;
   }
-  grpc_httpcli_request request;
-  memset(&request, 0, sizeof(grpc_httpcli_request));
-  request.host = const_cast<char*>(uri->authority().c_str());
-  request.http.path = gpr_strdup(uri->path().c_str());
-  request.handshaker =
-      uri->scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
+  grpc_http_request request;
+  memset(&request, 0, sizeof(grpc_http_request));
   grpc_http_response_destroy(&ctx_->response);
   ctx_->response = {};
   GRPC_CLOSURE_INIT(&ctx_->closure, OnRetrieveRegion, this, nullptr);
-  grpc_httpcli_get(ctx_->pollent, ResourceQuota::Default(), &request,
-                   ctx_->deadline, &ctx_->closure, &ctx_->response);
-  grpc_http_request_destroy(&request.http);
+  RefCountedPtr<grpc_channel_credentials> http_request_creds;
+  if (uri->scheme() == "http") {
+    http_request_creds = RefCountedPtr<grpc_channel_credentials>(
+        grpc_insecure_credentials_create());
+  } else {
+    http_request_creds = CreateHttpRequestSSLCredentials();
+  }
+  http_request_ =
+      HttpRequest::Get(std::move(*uri), nullptr /* channel args */,
+                       ctx_->pollent, &request, ctx_->deadline, &ctx_->closure,
+                       &ctx_->response, std::move(http_request_creds));
+  http_request_->Start();
+  grpc_http_request_destroy(&request);
 }
 
 void AwsExternalAccountCredentials::OnRetrieveRegion(void* arg,
@@ -206,19 +213,25 @@ void AwsExternalAccountCredentials::RetrieveRoleName() {
                 absl::StrFormat("Invalid url: %s.", uri.status().ToString())));
     return;
   }
-  grpc_httpcli_request request;
-  memset(&request, 0, sizeof(grpc_httpcli_request));
-  request.host = const_cast<char*>(uri->authority().c_str());
-  request.http.path = gpr_strdup(uri->path().c_str());
-  request.handshaker =
-      uri->scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
+  grpc_http_request request;
+  memset(&request, 0, sizeof(grpc_http_request));
   grpc_http_response_destroy(&ctx_->response);
   ctx_->response = {};
   GRPC_CLOSURE_INIT(&ctx_->closure, OnRetrieveRoleName, this, nullptr);
   // TODO(ctiller): use the caller's resource quota.
-  grpc_httpcli_get(ctx_->pollent, ResourceQuota::Default(), &request,
-                   ctx_->deadline, &ctx_->closure, &ctx_->response);
-  grpc_http_request_destroy(&request.http);
+  RefCountedPtr<grpc_channel_credentials> http_request_creds;
+  if (uri->scheme() == "http") {
+    http_request_creds = RefCountedPtr<grpc_channel_credentials>(
+        grpc_insecure_credentials_create());
+  } else {
+    http_request_creds = CreateHttpRequestSSLCredentials();
+  }
+  http_request_ =
+      HttpRequest::Get(std::move(*uri), nullptr /* channel args */,
+                       ctx_->pollent, &request, ctx_->deadline, &ctx_->closure,
+                       &ctx_->response, std::move(http_request_creds));
+  http_request_->Start();
+  grpc_http_request_destroy(&request);
 }
 
 void AwsExternalAccountCredentials::OnRetrieveRoleName(
@@ -265,19 +278,25 @@ void AwsExternalAccountCredentials::RetrieveSigningKeys() {
                 "Invalid url with role name: %s.", uri.status().ToString())));
     return;
   }
-  grpc_httpcli_request request;
-  memset(&request, 0, sizeof(grpc_httpcli_request));
-  request.host = const_cast<char*>(uri->authority().c_str());
-  request.http.path = gpr_strdup(uri->path().c_str());
-  request.handshaker =
-      uri->scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
+  grpc_http_request request;
+  memset(&request, 0, sizeof(grpc_http_request));
   grpc_http_response_destroy(&ctx_->response);
   ctx_->response = {};
   GRPC_CLOSURE_INIT(&ctx_->closure, OnRetrieveSigningKeys, this, nullptr);
   // TODO(ctiller): use the caller's resource quota.
-  grpc_httpcli_get(ctx_->pollent, ResourceQuota::Default(), &request,
-                   ctx_->deadline, &ctx_->closure, &ctx_->response);
-  grpc_http_request_destroy(&request.http);
+  RefCountedPtr<grpc_channel_credentials> http_request_creds;
+  if (uri->scheme() == "http") {
+    http_request_creds = RefCountedPtr<grpc_channel_credentials>(
+        grpc_insecure_credentials_create());
+  } else {
+    http_request_creds = CreateHttpRequestSSLCredentials();
+  }
+  http_request_ =
+      HttpRequest::Get(std::move(*uri), nullptr /* channel args */,
+                       ctx_->pollent, &request, ctx_->deadline, &ctx_->closure,
+                       &ctx_->response, std::move(http_request_creds));
+  http_request_->Start();
+  grpc_http_request_destroy(&request);
 }
 
 void AwsExternalAccountCredentials::OnRetrieveSigningKeys(

data/src/core/lib/security/credentials/external/aws_external_account_credentials.h

@@ -56,6 +56,7 @@ class AwsExternalAccountCredentials final : public ExternalAccountCredentials {
                                   grpc_error_handle error);
 
   std::string audience_;
+  OrphanablePtr<HttpRequest> http_request_;
 
   // Fields of credential source
   std::string region_url_;

data/src/core/lib/security/credentials/external/external_account_credentials.cc

@@ -25,6 +25,7 @@
 #include "absl/time/clock.h"
 #include "absl/time/time.h"
 
+#include "src/core/lib/http/httpcli_ssl_credentials.h"
 #include "src/core/lib/http/parser.h"
 #include "src/core/lib/security/credentials/external/aws_external_account_credentials.h"
 #include "src/core/lib/security/credentials/external/file_external_account_credentials.h"
@@ -238,7 +239,7 @@ std::string ExternalAccountCredentials::debug_string() {
 void ExternalAccountCredentials::fetch_oauth2(
     grpc_credentials_metadata_request* metadata_req,
     grpc_polling_entity* pollent, grpc_iomgr_cb_func response_cb,
-    grpc_millis deadline) {
+    Timestamp deadline) {
   GPR_ASSERT(ctx_ == nullptr);
   ctx_ = new HTTPRequestContext(pollent, deadline);
   metadata_req_ = metadata_req;
@@ -267,15 +268,13 @@ void ExternalAccountCredentials::ExchangeToken(
                         uri.status().ToString())));
     return;
   }
-  grpc_httpcli_request request;
-  memset(&request, 0, sizeof(grpc_httpcli_request));
-  request.host = const_cast<char*>(uri->authority().c_str());
-  request.http.path = gpr_strdup(uri->path().c_str());
+  grpc_http_request request;
+  memset(&request, 0, sizeof(grpc_http_request));
   grpc_http_header* headers = nullptr;
   if (!options_.client_id.empty() && !options_.client_secret.empty()) {
-    request.http.hdr_count = 2;
+    request.hdr_count = 2;
     headers = static_cast<grpc_http_header*>(
-        gpr_malloc(sizeof(grpc_http_header) * request.http.hdr_count));
+        gpr_malloc(sizeof(grpc_http_header) * request.hdr_count));
     headers[0].key = gpr_strdup("Content-Type");
     headers[0].value = gpr_strdup("application/x-www-form-urlencoded");
     std::string raw_cred =
@@ -287,15 +286,13 @@ void ExternalAccountCredentials::ExchangeToken(
     headers[1].value = gpr_strdup(str.c_str());
     gpr_free(encoded_cred);
   } else {
-    request.http.hdr_count = 1;
+    request.hdr_count = 1;
     headers = static_cast<grpc_http_header*>(
-        gpr_malloc(sizeof(grpc_http_header) * request.http.hdr_count));
+        gpr_malloc(sizeof(grpc_http_header) * request.hdr_count));
     headers[0].key = gpr_strdup("Content-Type");
     headers[0].value = gpr_strdup("application/x-www-form-urlencoded");
   }
-  request.http.hdrs = headers;
-  request.handshaker =
-      uri->scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
+  request.hdrs = headers;
   std::vector<std::string> body_parts;
   body_parts.push_back(
       absl::StrFormat("audience=%s", UrlEncode(options_.audience).c_str()));
@@ -323,13 +320,26 @@ void ExternalAccountCredentials::ExchangeToken(
   body_parts.push_back(absl::StrFormat(
       "options=%s", UrlEncode(addtional_options_json.Dump()).c_str()));
   std::string body = absl::StrJoin(body_parts, "&");
+  request.body = const_cast<char*>(body.c_str());
+  request.body_length = body.size();
   grpc_http_response_destroy(&ctx_->response);
   ctx_->response = {};
   GRPC_CLOSURE_INIT(&ctx_->closure, OnExchangeToken, this, nullptr);
-  grpc_httpcli_post(ctx_->pollent, ResourceQuota::Default(), &request,
-                    body.c_str(), body.size(), ctx_->deadline, &ctx_->closure,
-                    &ctx_->response);
-  grpc_http_request_destroy(&request.http);
+  GPR_ASSERT(http_request_ == nullptr);
+  RefCountedPtr<grpc_channel_credentials> http_request_creds;
+  if (uri->scheme() == "http") {
+    http_request_creds = RefCountedPtr<grpc_channel_credentials>(
+        grpc_insecure_credentials_create());
+  } else {
+    http_request_creds = CreateHttpRequestSSLCredentials();
+  }
+  http_request_ =
+      HttpRequest::Post(std::move(*uri), nullptr /* channel args */,
+                        ctx_->pollent, &request, ctx_->deadline, &ctx_->closure,
+                        &ctx_->response, std::move(http_request_creds));
+  http_request_->Start();
+  request.body = nullptr;
+  grpc_http_request_destroy(&request);
 }
 
 void ExternalAccountCredentials::OnExchangeToken(void* arg,
@@ -341,6 +351,7 @@ void ExternalAccountCredentials::OnExchangeToken(void* arg,
 
 void ExternalAccountCredentials::OnExchangeTokenInternal(
     grpc_error_handle error) {
+  http_request_.reset();
   if (error != GRPC_ERROR_NONE) {
     FinishTokenFetch(error);
   } else {
@@ -390,31 +401,39 @@ void ExternalAccountCredentials::ImpersenateServiceAccount() {
         options_.service_account_impersonation_url, uri.status().ToString())));
     return;
   }
-  grpc_httpcli_request request;
-  memset(&request, 0, sizeof(grpc_httpcli_request));
-  request.host = const_cast<char*>(uri->authority().c_str());
-  request.http.path = gpr_strdup(uri->path().c_str());
-  request.http.hdr_count = 2;
+  grpc_http_request request;
+  memset(&request, 0, sizeof(grpc_http_request));
+  request.hdr_count = 2;
   grpc_http_header* headers = static_cast<grpc_http_header*>(
-      gpr_malloc(sizeof(grpc_http_header) * request.http.hdr_count));
+      gpr_malloc(sizeof(grpc_http_header) * request.hdr_count));
   headers[0].key = gpr_strdup("Content-Type");
   headers[0].value = gpr_strdup("application/x-www-form-urlencoded");
   std::string str = absl::StrFormat("Bearer %s", access_token);
   headers[1].key = gpr_strdup("Authorization");
   headers[1].value = gpr_strdup(str.c_str());
-  request.http.hdrs = headers;
-  request.handshaker =
-      uri->scheme() == "https" ? &grpc_httpcli_ssl : &grpc_httpcli_plaintext;
+  request.hdrs = headers;
   std::string scope = absl::StrJoin(scopes_, " ");
   std::string body = absl::StrFormat("scope=%s", scope);
+  request.body = const_cast<char*>(body.c_str());
+  request.body_length = body.size();
   grpc_http_response_destroy(&ctx_->response);
   ctx_->response = {};
   GRPC_CLOSURE_INIT(&ctx_->closure, OnImpersenateServiceAccount, this, nullptr);
   // TODO(ctiller): Use the callers resource quota.
-  grpc_httpcli_post(ctx_->pollent, ResourceQuota::Default(), &request,
-                    body.c_str(), body.size(), ctx_->deadline, &ctx_->closure,
-                    &ctx_->response);
-  grpc_http_request_destroy(&request.http);
+  GPR_ASSERT(http_request_ == nullptr);
+  RefCountedPtr<grpc_channel_credentials> http_request_creds;
+  if (uri->scheme() == "http") {
+    http_request_creds = RefCountedPtr<grpc_channel_credentials>(
+        grpc_insecure_credentials_create());
+  } else {
+    http_request_creds = CreateHttpRequestSSLCredentials();
+  }
+  http_request_ = HttpRequest::Post(
+      std::move(*uri), nullptr, ctx_->pollent, &request, ctx_->deadline,
+      &ctx_->closure, &ctx_->response, std::move(http_request_creds));
+  http_request_->Start();
+  request.body = nullptr;
+  grpc_http_request_destroy(&request);
 }
 
 void ExternalAccountCredentials::OnImpersenateServiceAccount(
@@ -426,6 +445,7 @@ void ExternalAccountCredentials::OnImpersenateServiceAccount(
 
 void ExternalAccountCredentials::OnImpersenateServiceAccountInternal(
     grpc_error_handle error) {
+  http_request_.reset();
   if (error != GRPC_ERROR_NONE) {
     FinishTokenFetch(error);
     return;