grpc 1.46.2-x86_64-linux → 1.48.0.pre1-x86_64-linux

data/src/core/lib/security/context/security_context.h

@@ -21,11 +21,23 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <stddef.h>
+
+#include <utility>
+
+#include "absl/strings/string_view.h"
+
+#include <grpc/grpc_security.h>
+#include <grpc/impl/codegen/grpc_types.h>
+#include <grpc/support/alloc.h>
+
+#include "src/core/lib/debug/trace.h"
+#include "src/core/lib/gpr/useful.h"
+#include "src/core/lib/gprpp/debug_location.h"
 #include "src/core/lib/gprpp/ref_counted.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
-#include "src/core/lib/iomgr/pollset.h"
 #include "src/core/lib/resource_quota/arena.h"
-#include "src/core/lib/security/credentials/credentials.h"
+#include "src/core/lib/security/credentials/credentials.h"  // IWYU pragma: keep
 
 extern grpc_core::DebugOnlyTraceFlag grpc_trace_auth_context_refcount;
 

data/src/core/lib/security/credentials/alts/alts_credentials.cc

@@ -20,14 +20,16 @@
 
 #include "src/core/lib/security/credentials/alts/alts_credentials.h"
 
-#include <cstring>
+#include <utility>
+
+#include "absl/strings/string_view.h"
 
 #include <grpc/grpc.h>
 #include <grpc/support/alloc.h>
-#include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
 
 #include "src/core/lib/security/credentials/alts/check_gcp_environment.h"
+#include "src/core/lib/security/credentials/alts/grpc_alts_credentials_options.h"
 #include "src/core/lib/security/security_connector/alts/alts_security_connector.h"
 
 #define GRPC_ALTS_HANDSHAKER_SERVICE_URL "metadata.google.internal.:8080"
@@ -56,7 +58,10 @@ grpc_alts_credentials::create_security_connector(
       this->Ref(), std::move(call_creds), target_name);
 }
 
-const char* grpc_alts_credentials::type() const { return "Alts"; }
+grpc_core::UniqueTypeName grpc_alts_credentials::type() const {
+  static grpc_core::UniqueTypeName::Factory kFactory("Alts");
+  return kFactory.Create();
+}
 
 grpc_alts_server_credentials::grpc_alts_server_credentials(
     const grpc_alts_credentials_options* options,
@@ -79,7 +84,10 @@ grpc_alts_server_credentials::~grpc_alts_server_credentials() {
   gpr_free(handshaker_service_url_);
 }
 
-const char* grpc_alts_server_credentials::type() const { return "Alts"; }
+grpc_core::UniqueTypeName grpc_alts_server_credentials::type() const {
+  static grpc_core::UniqueTypeName::Factory kFactory("Alts");
+  return kFactory.Create();
+}
 
 grpc_channel_credentials* grpc_alts_credentials_create_customized(
     const grpc_alts_credentials_options* options,

data/src/core/lib/security/credentials/alts/alts_credentials.h

@@ -21,10 +21,15 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
+#include <grpc/impl/codegen/grpc_types.h>
 
-#include "src/core/lib/security/credentials/alts/grpc_alts_credentials_options.h"
+#include "src/core/lib/gpr/useful.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/gprpp/unique_type_name.h"
 #include "src/core/lib/security/credentials/credentials.h"
+#include "src/core/lib/security/security_connector/security_connector.h"
 
 /* Main struct for grpc ALTS channel credential. */
 class grpc_alts_credentials final : public grpc_channel_credentials {
@@ -39,7 +44,7 @@ class grpc_alts_credentials final : public grpc_channel_credentials {
       const char* target_name, const grpc_channel_args* args,
       grpc_channel_args** new_args) override;
 
-  const char* type() const override;
+  grpc_core::UniqueTypeName type() const override;
 
   const grpc_alts_credentials_options* options() const { return options_; }
   grpc_alts_credentials_options* mutable_options() { return options_; }
@@ -66,7 +71,7 @@ class grpc_alts_server_credentials final : public grpc_server_credentials {
   grpc_core::RefCountedPtr<grpc_server_security_connector>
   create_security_connector(const grpc_channel_args* /* args */) override;
 
-  const char* type() const override;
+  grpc_core::UniqueTypeName type() const override;
 
   const grpc_alts_credentials_options* options() const { return options_; }
   grpc_alts_credentials_options* mutable_options() { return options_; }

data/src/core/lib/security/credentials/alts/grpc_alts_credentials_client_options.cc

@@ -18,9 +18,7 @@
 
 #include <grpc/support/port_platform.h>
 
-#include <stdlib.h>
-#include <string.h>
-
+#include <grpc/grpc_security.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>

data/src/core/lib/security/credentials/alts/grpc_alts_credentials_server_options.cc

@@ -18,11 +18,8 @@
 
 #include <grpc/support/port_platform.h>
 
-#include <stdlib.h>
-#include <string.h>
-
+#include <grpc/grpc_security.h>
 #include <grpc/support/alloc.h>
-#include <grpc/support/log.h>
 
 #include "src/core/lib/security/credentials/alts/grpc_alts_credentials_options.h"
 #include "src/core/tsi/alts/handshaker/transport_security_common_api.h"

data/src/core/lib/security/credentials/call_creds_util.cc

@@ -18,9 +18,19 @@
 
 #include "src/core/lib/security/credentials/call_creds_util.h"
 
+#include <string.h>
+
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
 
+#include <grpc/support/log.h>
+#include <grpc/support/string_util.h>
+
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/security/context/security_context.h"
+#include "src/core/lib/security/security_connector/security_connector.h"
+#include "src/core/lib/transport/metadata_batch.h"
+
 namespace grpc_core {
 
 namespace {

data/src/core/lib/security/credentials/call_creds_util.h

@@ -24,6 +24,7 @@
 #include <grpc/grpc_security.h>
 
 #include "src/core/lib/security/credentials/credentials.h"
+#include "src/core/lib/transport/transport.h"
 
 namespace grpc_core {
 

data/src/core/lib/security/credentials/channel_creds_registry.h

@@ -19,8 +19,14 @@
 
 #include <grpc/support/port_platform.h>
 
-#include <grpc/impl/codegen/grpc_types.h>
+#include <map>
+#include <memory>
+#include <string>
+#include <type_traits>
 
+#include "absl/strings/string_view.h"
+
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/json/json.h"
 
 struct grpc_channel_credentials;

data/src/core/lib/security/credentials/channel_creds_registry_init.cc

@@ -18,8 +18,18 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <memory>
+
+#include "absl/memory/memory.h"
+#include "absl/strings/string_view.h"
+
+#include <grpc/grpc.h>
+#include <grpc/grpc_security.h>
+
 #include "src/core/lib/config/core_configuration.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/json/json.h"
+#include "src/core/lib/security/credentials/channel_creds_registry.h"
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/credentials/fake/fake_credentials.h"
 

data/src/core/lib/security/credentials/composite/composite_credentials.cc

@@ -21,18 +21,18 @@
 #include "src/core/lib/security/credentials/composite/composite_credentials.h"
 
 #include <cstring>
-#include <new>
 #include <vector>
 
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_join.h"
+#include "absl/strings/string_view.h"
 
-#include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
-#include <grpc/support/string_util.h>
 
+#include "src/core/lib/debug/trace.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
-#include "src/core/lib/iomgr/polling_entity.h"
+#include "src/core/lib/promise/detail/basic_seq.h"
+#include "src/core/lib/promise/poll.h"
 #include "src/core/lib/promise/try_seq.h"
 #include "src/core/lib/surface/api_trace.h"
 #include "src/core/lib/transport/transport.h"
@@ -41,8 +41,9 @@
 // grpc_composite_channel_credentials
 //
 
-const char* grpc_composite_channel_credentials::type() const {
-  return "Composite";
+grpc_core::UniqueTypeName grpc_composite_channel_credentials::type() const {
+  static grpc_core::UniqueTypeName::Factory kFactory("Composite");
+  return kFactory.Create();
 }
 
 /* -- Composite call credentials. -- */
@@ -60,7 +61,10 @@ grpc_composite_call_credentials::GetRequestMetadata(
       });
 }
 
-const char* grpc_composite_call_credentials::Type() { return "Composite"; }
+grpc_core::UniqueTypeName grpc_composite_call_credentials::Type() {
+  static grpc_core::UniqueTypeName::Factory kFactory("Composite");
+  return kFactory.Create();
+}
 
 std::string grpc_composite_call_credentials::debug_string() {
   std::vector<std::string> outputs;

data/src/core/lib/security/credentials/composite/composite_credentials.h

@@ -21,12 +21,26 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <algorithm>
 #include <string>
+#include <utility>
+#include <vector>
 
-#include "absl/container/inlined_vector.h"
+#include "absl/status/statusor.h"
 
+#include <grpc/grpc.h>
+#include <grpc/grpc_security.h>
+#include <grpc/grpc_security_constants.h>
+#include <grpc/impl/codegen/grpc_types.h>
+
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/gpr/useful.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/gprpp/unique_type_name.h"
+#include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/security/credentials/credentials.h"
+#include "src/core/lib/security/security_connector/security_connector.h"
+#include "src/core/lib/transport/transport.h"
 
 /* -- Composite channel credentials. -- */
 
@@ -51,11 +65,12 @@ class grpc_composite_channel_credentials : public grpc_channel_credentials {
       const char* target, const grpc_channel_args* args,
       grpc_channel_args** new_args) override;
 
-  grpc_channel_args* update_arguments(grpc_channel_args* args) override {
+  grpc_core::ChannelArgs update_arguments(
+      grpc_core::ChannelArgs args) override {
     return inner_creds_->update_arguments(args);
   }
 
-  const char* type() const override;
+  grpc_core::UniqueTypeName type() const override;
 
   const grpc_channel_credentials* inner_creds() const {
     return inner_creds_.get();
@@ -80,7 +95,7 @@ class grpc_composite_channel_credentials : public grpc_channel_credentials {
 class grpc_composite_call_credentials : public grpc_call_credentials {
  public:
   using CallCredentialsList =
-      absl::InlinedVector<grpc_core::RefCountedPtr<grpc_call_credentials>, 2>;
+      std::vector<grpc_core::RefCountedPtr<grpc_call_credentials>>;
 
   grpc_composite_call_credentials(
       grpc_core::RefCountedPtr<grpc_call_credentials> creds1,
@@ -98,9 +113,9 @@ class grpc_composite_call_credentials : public grpc_call_credentials {
   const CallCredentialsList& inner() const { return inner_; }
   std::string debug_string() override;
 
-  static const char* Type();
+  static grpc_core::UniqueTypeName Type();
 
-  const char* type() const override { return Type(); }
+  grpc_core::UniqueTypeName type() const override { return Type(); }
 
  private:
   int cmp_impl(const grpc_call_credentials* other) const override {

data/src/core/lib/security/credentials/credentials.cc

@@ -20,19 +20,15 @@
 
 #include "src/core/lib/security/credentials/credentials.h"
 
-#include <stdio.h>
+#include <stdint.h>
 #include <string.h>
 
-#include <grpc/support/alloc.h>
 #include <grpc/support/log.h>
-#include <grpc/support/string_util.h>
-#include <grpc/support/sync.h>
-#include <grpc/support/time.h>
 
 #include "src/core/lib/channel/channel_args.h"
-#include "src/core/lib/gpr/string.h"
-#include "src/core/lib/iomgr/executor.h"
-#include "src/core/lib/json/json.h"
+#include "src/core/lib/debug/trace.h"
+#include "src/core/lib/gpr/useful.h"
+#include "src/core/lib/iomgr/exec_ctx.h"
 #include "src/core/lib/surface/api_trace.h"
 
 /* -- Common. -- */

data/src/core/lib/security/credentials/credentials.h

@@ -21,24 +21,28 @@
 
 #include <grpc/support/port_platform.h>
 
-#include <string.h>
-
 #include <string>
+#include <utility>
+#include <vector>
+
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
 
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
-#include <grpc/support/sync.h>
+#include <grpc/grpc_security_constants.h>
+#include <grpc/impl/codegen/grpc_types.h>
+#include <grpc/support/log.h>
 
+#include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/gprpp/ref_counted.h"
-#include "src/core/lib/iomgr/polling_entity.h"
+#include "src/core/lib/gprpp/ref_counted_ptr.h"
+#include "src/core/lib/gprpp/unique_type_name.h"
 #include "src/core/lib/promise/arena_promise.h"
-#include "src/core/lib/security/context/security_context.h"
 #include "src/core/lib/security/security_connector/security_connector.h"
-#include "src/core/lib/transport/metadata_batch.h"
+#include "src/core/lib/slice/slice.h"
 #include "src/core/lib/transport/transport.h"
 
-struct grpc_http_response;
-
 /* --- Constants. --- */
 
 typedef enum {
@@ -92,6 +96,15 @@ void grpc_override_well_known_credentials_path_getter(
 struct grpc_channel_credentials
     : grpc_core::RefCounted<grpc_channel_credentials> {
  public:
+  static absl::string_view ChannelArgName() {
+    return GRPC_ARG_CHANNEL_CREDENTIALS;
+  }
+
+  static int ChannelArgsCompare(const grpc_channel_credentials* args1,
+                                const grpc_channel_credentials* args2) {
+    return args1->cmp(args2);
+  }
+
   // Creates a security connector for the channel. May also create new channel
   // args for the channel to be used in place of the passed in const args if
   // returned non NULL. In that case the caller is responsible for destroying
@@ -115,7 +128,7 @@ struct grpc_channel_credentials
   // By default, leave channel args as is. The callee takes ownership
   // of the passed-in channel args, and the caller takes ownership
   // of the returned channel args.
-  virtual grpc_channel_args* update_arguments(grpc_channel_args* args) {
+  virtual grpc_core::ChannelArgs update_arguments(grpc_core::ChannelArgs args) {
     return args;
   }
 
@@ -129,9 +142,7 @@ struct grpc_channel_credentials
   // as equal (assuming other channel args match).
   int cmp(const grpc_channel_credentials* other) const {
     GPR_ASSERT(other != nullptr);
-    // Intentionally uses grpc_core::QsortCompare instead of strcmp as a safety
-    // against different grpc_channel_credentials types using the same name.
-    int r = grpc_core::QsortCompare(type(), other->type());
+    int r = type().Compare(other->type());
     if (r != 0) return r;
     return cmp_impl(other);
   }
@@ -140,7 +151,7 @@ struct grpc_channel_credentials
   // implementation for down-casting purposes. Every creds implementation should
   // use a unique string instance, which should be returned by all instances of
   // that creds implementation.
-  virtual const char* type() const = 0;
+  virtual grpc_core::UniqueTypeName type() const = 0;
 
  private:
   // Implementation for `cmp` method intended to be overridden by subclasses.
@@ -212,9 +223,7 @@ struct grpc_call_credentials
   // credentials as effectively the same..
   int cmp(const grpc_call_credentials* other) const {
     GPR_ASSERT(other != nullptr);
-    // Intentionally uses grpc_core::QsortCompare instead of strcmp as a safety
-    // against different grpc_call_credentials types using the same name.
-    int r = grpc_core::QsortCompare(type(), other->type());
+    int r = type().Compare(other->type());
     if (r != 0) return r;
     return cmp_impl(other);
   }
@@ -227,7 +236,7 @@ struct grpc_call_credentials
   // implementation for down-casting purposes. Every creds implementation should
   // use a unique string instance, which should be returned by all instances of
   // that creds implementation.
-  virtual const char* type() const = 0;
+  virtual grpc_core::UniqueTypeName type() const = 0;
 
  private:
   // Implementation for `cmp` method intended to be overridden by subclasses.
@@ -256,7 +265,7 @@ struct grpc_server_credentials
   virtual grpc_core::RefCountedPtr<grpc_server_security_connector>
   create_security_connector(const grpc_channel_args* args) = 0;
 
-  virtual const char* type() const = 0;
+  virtual grpc_core::UniqueTypeName type() const = 0;
 
   const grpc_auth_metadata_processor& auth_metadata_processor() const {
     return processor_;

data/src/core/lib/security/credentials/external/aws_external_account_credentials.cc

@@ -17,12 +17,32 @@
 
 #include "src/core/lib/security/credentials/external/aws_external_account_credentials.h"
 
+#include <string.h>
+
+#include <map>
+#include <utility>
+
+#include "absl/memory/memory.h"
+#include "absl/status/status.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/str_cat.h"
 #include "absl/strings/str_format.h"
-#include "absl/strings/str_join.h"
 #include "absl/strings/str_replace.h"
+#include "absl/strings/string_view.h"
+
+#include <grpc/grpc.h>
+#include <grpc/grpc_security.h>
+#include <grpc/support/alloc.h>
+#include <grpc/support/log.h>
+#include <grpc/support/string_util.h>
 
 #include "src/core/lib/gpr/env.h"
+#include "src/core/lib/gprpp/memory.h"
 #include "src/core/lib/http/httpcli_ssl_credentials.h"
+#include "src/core/lib/iomgr/closure.h"
+#include "src/core/lib/json/json.h"
+#include "src/core/lib/security/credentials/credentials.h"
+#include "src/core/lib/uri/uri_parser.h"
 
 namespace grpc_core {
 
@@ -62,7 +82,7 @@ AwsExternalAccountCredentials::Create(Options options,
                                       grpc_error_handle* error) {
   auto creds = MakeRefCounted<AwsExternalAccountCredentials>(
       std::move(options), std::move(scopes), error);
-  if (*error == GRPC_ERROR_NONE) {
+  if (GRPC_ERROR_IS_NONE(*error)) {
     return creds;
   } else {
     return nullptr;
@@ -119,6 +139,12 @@ AwsExternalAccountCredentials::AwsExternalAccountCredentials(
     return;
   }
   regional_cred_verification_url_ = it->second.string_value();
+  it =
+      options.credential_source.object_value().find("imdsv2_session_token_url");
+  if (it != options.credential_source.object_value().end() &&
+      it->second.type() == Json::Type::STRING) {
+    imdsv2_session_token_url_ = it->second.string_value();
+  }
 }
 
 void AwsExternalAccountCredentials::RetrieveSubjectToken(
@@ -133,6 +159,62 @@ void AwsExternalAccountCredentials::RetrieveSubjectToken(
   }
   ctx_ = ctx;
   cb_ = cb;
+  if (!imdsv2_session_token_url_.empty()) {
+    RetrieveImdsV2SessionToken();
+  } else if (signer_ != nullptr) {
+    BuildSubjectToken();
+  } else {
+    RetrieveRegion();
+  }
+}
+
+void AwsExternalAccountCredentials::RetrieveImdsV2SessionToken() {
+  absl::StatusOr<URI> uri = URI::Parse(imdsv2_session_token_url_);
+  if (!uri.ok()) {
+    return;
+  }
+  grpc_http_header* headers =
+      static_cast<grpc_http_header*>(gpr_malloc(sizeof(grpc_http_header)));
+  headers[0].key = gpr_strdup("x-aws-ec2-metadata-token-ttl-seconds");
+  headers[0].value = gpr_strdup("300");
+  grpc_http_request request;
+  memset(&request, 0, sizeof(grpc_http_request));
+  request.hdr_count = 1;
+  request.hdrs = headers;
+  grpc_http_response_destroy(&ctx_->response);
+  ctx_->response = {};
+  GRPC_CLOSURE_INIT(&ctx_->closure, OnRetrieveImdsV2SessionToken, this,
+                    nullptr);
+  RefCountedPtr<grpc_channel_credentials> http_request_creds;
+  if (uri->scheme() == "http") {
+    http_request_creds = RefCountedPtr<grpc_channel_credentials>(
+        grpc_insecure_credentials_create());
+  } else {
+    http_request_creds = CreateHttpRequestSSLCredentials();
+  }
+  http_request_ =
+      HttpRequest::Put(std::move(*uri), nullptr /* channel args */,
+                       ctx_->pollent, &request, ctx_->deadline, &ctx_->closure,
+                       &ctx_->response, std::move(http_request_creds));
+  http_request_->Start();
+  grpc_http_request_destroy(&request);
+}
+
+void AwsExternalAccountCredentials::OnRetrieveImdsV2SessionToken(
+    void* arg, grpc_error_handle error) {
+  AwsExternalAccountCredentials* self =
+      static_cast<AwsExternalAccountCredentials*>(arg);
+  self->OnRetrieveImdsV2SessionTokenInternal(GRPC_ERROR_REF(error));
+}
+
+void AwsExternalAccountCredentials::OnRetrieveImdsV2SessionTokenInternal(
+    grpc_error_handle error) {
+  if (!GRPC_ERROR_IS_NONE(error)) {
+    FinishRetrieveSubjectToken("", error);
+    return;
+  }
+  imdsv2_session_token_ =
+      std::string(ctx_->response.body, ctx_->response.body_length);
   if (signer_ != nullptr) {
     BuildSubjectToken();
   } else {
@@ -140,6 +222,20 @@ void AwsExternalAccountCredentials::RetrieveSubjectToken(
   }
 }
 
+void AwsExternalAccountCredentials::AddMetadataRequestHeaders(
+    grpc_http_request* request) {
+  if (!imdsv2_session_token_.empty()) {
+    GPR_ASSERT(request->hdr_count == 0);
+    GPR_ASSERT(request->hdrs == nullptr);
+    grpc_http_header* headers =
+        static_cast<grpc_http_header*>(gpr_malloc(sizeof(grpc_http_header)));
+    headers[0].key = gpr_strdup("x-aws-ec2-metadata-token");
+    headers[0].value = gpr_strdup(imdsv2_session_token_.c_str());
+    request->hdr_count = 1;
+    request->hdrs = headers;
+  }
+}
+
 void AwsExternalAccountCredentials::RetrieveRegion() {
   UniquePtr<char> region_from_env(gpr_getenv(kRegionEnvVar));
   if (region_from_env == nullptr) {
@@ -165,6 +261,7 @@ void AwsExternalAccountCredentials::RetrieveRegion() {
   memset(&request, 0, sizeof(grpc_http_request));
   grpc_http_response_destroy(&ctx_->response);
   ctx_->response = {};
+  AddMetadataRequestHeaders(&request);
   GRPC_CLOSURE_INIT(&ctx_->closure, OnRetrieveRegion, this, nullptr);
   RefCountedPtr<grpc_channel_credentials> http_request_creds;
   if (uri->scheme() == "http") {
@@ -190,7 +287,7 @@ void AwsExternalAccountCredentials::OnRetrieveRegion(void* arg,
 
 void AwsExternalAccountCredentials::OnRetrieveRegionInternal(
     grpc_error_handle error) {
-  if (error != GRPC_ERROR_NONE) {
+  if (!GRPC_ERROR_IS_NONE(error)) {
     FinishRetrieveSubjectToken("", error);
     return;
   }
@@ -217,6 +314,7 @@ void AwsExternalAccountCredentials::RetrieveRoleName() {
   memset(&request, 0, sizeof(grpc_http_request));
   grpc_http_response_destroy(&ctx_->response);
   ctx_->response = {};
+  AddMetadataRequestHeaders(&request);
   GRPC_CLOSURE_INIT(&ctx_->closure, OnRetrieveRoleName, this, nullptr);
   // TODO(ctiller): use the caller's resource quota.
   RefCountedPtr<grpc_channel_credentials> http_request_creds;
@@ -243,7 +341,7 @@ void AwsExternalAccountCredentials::OnRetrieveRoleName(
 
 void AwsExternalAccountCredentials::OnRetrieveRoleNameInternal(
     grpc_error_handle error) {
-  if (error != GRPC_ERROR_NONE) {
+  if (!GRPC_ERROR_IS_NONE(error)) {
     FinishRetrieveSubjectToken("", error);
     return;
   }
@@ -282,6 +380,7 @@ void AwsExternalAccountCredentials::RetrieveSigningKeys() {
   memset(&request, 0, sizeof(grpc_http_request));
   grpc_http_response_destroy(&ctx_->response);
   ctx_->response = {};
+  AddMetadataRequestHeaders(&request);
   GRPC_CLOSURE_INIT(&ctx_->closure, OnRetrieveSigningKeys, this, nullptr);
   // TODO(ctiller): use the caller's resource quota.
   RefCountedPtr<grpc_channel_credentials> http_request_creds;
@@ -308,14 +407,14 @@ void AwsExternalAccountCredentials::OnRetrieveSigningKeys(
 
 void AwsExternalAccountCredentials::OnRetrieveSigningKeysInternal(
     grpc_error_handle error) {
-  if (error != GRPC_ERROR_NONE) {
+  if (!GRPC_ERROR_IS_NONE(error)) {
     FinishRetrieveSubjectToken("", error);
     return;
   }
   absl::string_view response_body(ctx_->response.body,
                                   ctx_->response.body_length);
   Json json = Json::Parse(response_body, &error);
-  if (error != GRPC_ERROR_NONE || json.type() != Json::Type::OBJECT) {
+  if (!GRPC_ERROR_IS_NONE(error) || json.type() != Json::Type::OBJECT) {
     FinishRetrieveSubjectToken(
         "", GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
                 "Invalid retrieve signing keys response.", &error, 1));
@@ -364,7 +463,7 @@ void AwsExternalAccountCredentials::BuildSubjectToken() {
         access_key_id_, secret_access_key_, token_, "POST",
         cred_verification_url_, region_, "",
         std::map<std::string, std::string>(), &error);
-    if (error != GRPC_ERROR_NONE) {
+    if (!GRPC_ERROR_IS_NONE(error)) {
       FinishRetrieveSubjectToken(
           "", GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
                   "Creating aws request signer failed.", &error, 1));
@@ -373,7 +472,7 @@ void AwsExternalAccountCredentials::BuildSubjectToken() {
     }
   }
   auto signed_headers = signer_->GetSignedRequestHeaders();
-  if (error != GRPC_ERROR_NONE) {
+  if (!GRPC_ERROR_IS_NONE(error)) {
     FinishRetrieveSubjectToken("",
                                GRPC_ERROR_CREATE_REFERENCING_FROM_STATIC_STRING(
                                    "Invalid getting signed request"
@@ -409,7 +508,7 @@ void AwsExternalAccountCredentials::FinishRetrieveSubjectToken(
   auto cb = cb_;
   cb_ = nullptr;
   // Invoke the callback.
-  if (error != GRPC_ERROR_NONE) {
+  if (!GRPC_ERROR_IS_NONE(error)) {
     cb("", error);
   } else {
     cb(subject_token, GRPC_ERROR_NONE);