grpc 1.54.3 → 1.59.2

data/src/core/lib/security/credentials/external/external_account_credentials.cc

@@ -1,4 +1,3 @@
-//
 // Copyright 2020 gRPC authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
@@ -30,6 +29,7 @@
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "absl/strings/match.h"
+#include "absl/strings/numbers.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_join.h"
@@ -41,12 +41,15 @@
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/alloc.h>
+#include <grpc/support/json.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
 
 #include "src/core/lib/gprpp/status_helper.h"
 #include "src/core/lib/http/httpcli_ssl_credentials.h"
 #include "src/core/lib/http/parser.h"
+#include "src/core/lib/json/json_reader.h"
+#include "src/core/lib/json/json_writer.h"
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/security/credentials/external/aws_external_account_credentials.h"
 #include "src/core/lib/security/credentials/external/file_external_account_credentials.h"
@@ -61,6 +64,9 @@
   "urn:ietf:params:oauth:token-type:access_token"
 #define GOOGLE_CLOUD_PLATFORM_DEFAULT_SCOPE \
   "https://www.googleapis.com/auth/cloud-platform"
+#define IMPERSONATED_CRED_DEFAULT_LIFETIME_IN_SECONDS 3600  // 1 hour
+#define IMPERSONATED_CRED_MIN_LIFETIME_IN_SECONDS 600       // 10 mins
+#define IMPERSONATED_CRED_MAX_LIFETIME_IN_SECONDS 43200     // 12 hours
 
 namespace grpc_core {
 
@@ -109,85 +115,85 @@ RefCountedPtr<ExternalAccountCredentials> ExternalAccountCredentials::Create(
   GPR_ASSERT(error->ok());
   Options options;
   options.type = GRPC_AUTH_JSON_TYPE_INVALID;
-  if (json.type() != Json::Type::OBJECT) {
+  if (json.type() != Json::Type::kObject) {
     *error =
         GRPC_ERROR_CREATE("Invalid json to construct credentials options.");
     return nullptr;
   }
-  auto it = json.object_value().find("type");
-  if (it == json.object_value().end()) {
+  auto it = json.object().find("type");
+  if (it == json.object().end()) {
     *error = GRPC_ERROR_CREATE("type field not present.");
     return nullptr;
   }
-  if (it->second.type() != Json::Type::STRING) {
+  if (it->second.type() != Json::Type::kString) {
     *error = GRPC_ERROR_CREATE("type field must be a string.");
     return nullptr;
   }
-  if (it->second.string_value() != GRPC_AUTH_JSON_TYPE_EXTERNAL_ACCOUNT) {
+  if (it->second.string() != GRPC_AUTH_JSON_TYPE_EXTERNAL_ACCOUNT) {
     *error = GRPC_ERROR_CREATE("Invalid credentials json type.");
     return nullptr;
   }
   options.type = GRPC_AUTH_JSON_TYPE_EXTERNAL_ACCOUNT;
-  it = json.object_value().find("audience");
-  if (it == json.object_value().end()) {
+  it = json.object().find("audience");
+  if (it == json.object().end()) {
     *error = GRPC_ERROR_CREATE("audience field not present.");
     return nullptr;
   }
-  if (it->second.type() != Json::Type::STRING) {
+  if (it->second.type() != Json::Type::kString) {
     *error = GRPC_ERROR_CREATE("audience field must be a string.");
     return nullptr;
   }
-  options.audience = it->second.string_value();
-  it = json.object_value().find("subject_token_type");
-  if (it == json.object_value().end()) {
+  options.audience = it->second.string();
+  it = json.object().find("subject_token_type");
+  if (it == json.object().end()) {
     *error = GRPC_ERROR_CREATE("subject_token_type field not present.");
     return nullptr;
   }
-  if (it->second.type() != Json::Type::STRING) {
+  if (it->second.type() != Json::Type::kString) {
     *error = GRPC_ERROR_CREATE("subject_token_type field must be a string.");
     return nullptr;
   }
-  options.subject_token_type = it->second.string_value();
-  it = json.object_value().find("service_account_impersonation_url");
-  if (it != json.object_value().end()) {
-    options.service_account_impersonation_url = it->second.string_value();
+  options.subject_token_type = it->second.string();
+  it = json.object().find("service_account_impersonation_url");
+  if (it != json.object().end()) {
+    options.service_account_impersonation_url = it->second.string();
   }
-  it = json.object_value().find("token_url");
-  if (it == json.object_value().end()) {
+  it = json.object().find("token_url");
+  if (it == json.object().end()) {
     *error = GRPC_ERROR_CREATE("token_url field not present.");
     return nullptr;
   }
-  if (it->second.type() != Json::Type::STRING) {
+  if (it->second.type() != Json::Type::kString) {
     *error = GRPC_ERROR_CREATE("token_url field must be a string.");
     return nullptr;
   }
-  options.token_url = it->second.string_value();
-  it = json.object_value().find("token_info_url");
-  if (it != json.object_value().end()) {
-    options.token_info_url = it->second.string_value();
+  options.token_url = it->second.string();
+  it = json.object().find("token_info_url");
+  if (it != json.object().end()) {
+    options.token_info_url = it->second.string();
   }
-  it = json.object_value().find("credential_source");
-  if (it == json.object_value().end()) {
+  it = json.object().find("credential_source");
+  if (it == json.object().end()) {
     *error = GRPC_ERROR_CREATE("credential_source field not present.");
     return nullptr;
   }
   options.credential_source = it->second;
-  it = json.object_value().find("quota_project_id");
-  if (it != json.object_value().end()) {
-    options.quota_project_id = it->second.string_value();
+  it = json.object().find("quota_project_id");
+  if (it != json.object().end()) {
+    options.quota_project_id = it->second.string();
   }
-  it = json.object_value().find("client_id");
-  if (it != json.object_value().end()) {
-    options.client_id = it->second.string_value();
+  it = json.object().find("client_id");
+  if (it != json.object().end()) {
+    options.client_id = it->second.string();
   }
-  it = json.object_value().find("client_secret");
-  if (it != json.object_value().end()) {
-    options.client_secret = it->second.string_value();
+  it = json.object().find("client_secret");
+  if (it != json.object().end()) {
+    options.client_secret = it->second.string();
   }
-  it = json.object_value().find("workforce_pool_user_project");
-  if (it != json.object_value().end()) {
+  it = json.object().find("workforce_pool_user_project");
+  if (it != json.object().end()) {
     if (MatchWorkforcePoolAudience(options.audience)) {
-      options.workforce_pool_user_project = it->second.string_value();
+      options.workforce_pool_user_project = it->second.string();
     } else {
       *error = GRPC_ERROR_CREATE(
           "workforce_pool_user_project should not be set for non-workforce "
@@ -195,17 +201,47 @@ RefCountedPtr<ExternalAccountCredentials> ExternalAccountCredentials::Create(
       return nullptr;
     }
   }
+  it = json.object().find("service_account_impersonation");
+  options.service_account_impersonation.token_lifetime_seconds =
+      IMPERSONATED_CRED_DEFAULT_LIFETIME_IN_SECONDS;
+  if (it != json.object().end() && it->second.type() == Json::Type::kObject) {
+    auto service_acc_imp_json = it->second;
+    auto service_acc_imp_obj_it =
+        service_acc_imp_json.object().find("token_lifetime_seconds");
+    if (service_acc_imp_obj_it != service_acc_imp_json.object().end()) {
+      if (!absl::SimpleAtoi(
+              service_acc_imp_obj_it->second.string(),
+              &options.service_account_impersonation.token_lifetime_seconds)) {
+        *error = GRPC_ERROR_CREATE("token_lifetime_seconds must be a number");
+        return nullptr;
+      }
+      if (options.service_account_impersonation.token_lifetime_seconds >
+          IMPERSONATED_CRED_MAX_LIFETIME_IN_SECONDS) {
+        *error = GRPC_ERROR_CREATE(
+            absl::StrFormat("token_lifetime_seconds must be less than %ds",
+                            IMPERSONATED_CRED_MAX_LIFETIME_IN_SECONDS));
+        return nullptr;
+      }
+      if (options.service_account_impersonation.token_lifetime_seconds <
+          IMPERSONATED_CRED_MIN_LIFETIME_IN_SECONDS) {
+        *error = GRPC_ERROR_CREATE(
+            absl::StrFormat("token_lifetime_seconds must be more than %ds",
+                            IMPERSONATED_CRED_MIN_LIFETIME_IN_SECONDS));
+        return nullptr;
+      }
+    }
+  }
   RefCountedPtr<ExternalAccountCredentials> creds;
-  if (options.credential_source.object_value().find("environment_id") !=
-      options.credential_source.object_value().end()) {
+  if (options.credential_source.object().find("environment_id") !=
+      options.credential_source.object().end()) {
     creds = MakeRefCounted<AwsExternalAccountCredentials>(
         std::move(options), std::move(scopes), error);
-  } else if (options.credential_source.object_value().find("file") !=
-             options.credential_source.object_value().end()) {
+  } else if (options.credential_source.object().find("file") !=
+             options.credential_source.object().end()) {
     creds = MakeRefCounted<FileExternalAccountCredentials>(
         std::move(options), std::move(scopes), error);
-  } else if (options.credential_source.object_value().find("url") !=
-             options.credential_source.object_value().end()) {
+  } else if (options.credential_source.object().find("url") !=
+             options.credential_source.object().end()) {
     creds = MakeRefCounted<UrlExternalAccountCredentials>(
         std::move(options), std::move(scopes), error);
   } else {
@@ -327,11 +363,12 @@ void ExternalAccountCredentials::ExchangeToken(
   Json::Object addtional_options_json_object;
   if (options_.client_id.empty() && options_.client_secret.empty()) {
     addtional_options_json_object["userProject"] =
-        options_.workforce_pool_user_project;
+        Json::FromString(options_.workforce_pool_user_project);
   }
-  Json addtional_options_json(std::move(addtional_options_json_object));
+  Json addtional_options_json =
+      Json::FromObject(std::move(addtional_options_json_object));
   body_parts.push_back(absl::StrFormat(
-      "options=%s", UrlEncode(addtional_options_json.Dump()).c_str()));
+      "options=%s", UrlEncode(JsonDump(addtional_options_json)).c_str()));
   std::string body = absl::StrJoin(body_parts, "&");
   request.body = const_cast<char*>(body.c_str());
   request.body_length = body.size();
@@ -390,25 +427,24 @@ void ExternalAccountCredentials::OnExchangeTokenInternal(
 void ExternalAccountCredentials::ImpersenateServiceAccount() {
   absl::string_view response_body(ctx_->response.body,
                                   ctx_->response.body_length);
-  auto json = Json::Parse(response_body);
+  auto json = JsonParse(response_body);
   if (!json.ok()) {
     FinishTokenFetch(GRPC_ERROR_CREATE(absl::StrCat(
         "Invalid token exchange response: ", json.status().ToString())));
     return;
   }
-  if (json->type() != Json::Type::OBJECT) {
+  if (json->type() != Json::Type::kObject) {
     FinishTokenFetch(GRPC_ERROR_CREATE(
         "Invalid token exchange response: JSON type is not object"));
     return;
   }
-  auto it = json->object_value().find("access_token");
-  if (it == json->object_value().end() ||
-      it->second.type() != Json::Type::STRING) {
+  auto it = json->object().find("access_token");
+  if (it == json->object().end() || it->second.type() != Json::Type::kString) {
     FinishTokenFetch(GRPC_ERROR_CREATE(absl::StrFormat(
         "Missing or invalid access_token in %s.", response_body)));
     return;
   }
-  std::string access_token = it->second.string_value();
+  std::string access_token = it->second.string();
   absl::StatusOr<URI> uri =
       URI::Parse(options_.service_account_impersonation_url);
   if (!uri.ok()) {
@@ -428,8 +464,13 @@ void ExternalAccountCredentials::ImpersenateServiceAccount() {
   headers[1].key = gpr_strdup("Authorization");
   headers[1].value = gpr_strdup(str.c_str());
   request.hdrs = headers;
+  std::vector<std::string> body_members;
   std::string scope = absl::StrJoin(scopes_, " ");
-  std::string body = absl::StrFormat("scope=%s", scope);
+  body_members.push_back(absl::StrFormat("scope=%s", UrlEncode(scope).c_str()));
+  body_members.push_back(absl::StrFormat(
+      "lifetime=%ds",
+      options_.service_account_impersonation.token_lifetime_seconds));
+  std::string body = absl::StrJoin(body_members, "&");
   request.body = const_cast<char*>(body.c_str());
   request.body_length = body.size();
   grpc_http_response_destroy(&ctx_->response);
@@ -468,35 +509,33 @@ void ExternalAccountCredentials::OnImpersenateServiceAccountInternal(
   }
   absl::string_view response_body(ctx_->response.body,
                                   ctx_->response.body_length);
-  auto json = Json::Parse(response_body);
+  auto json = JsonParse(response_body);
   if (!json.ok()) {
     FinishTokenFetch(GRPC_ERROR_CREATE(
         absl::StrCat("Invalid service account impersonation response: ",
                      json.status().ToString())));
     return;
   }
-  if (json->type() != Json::Type::OBJECT) {
+  if (json->type() != Json::Type::kObject) {
     FinishTokenFetch(
         GRPC_ERROR_CREATE("Invalid service account impersonation response: "
                           "JSON type is not object"));
     return;
   }
-  auto it = json->object_value().find("accessToken");
-  if (it == json->object_value().end() ||
-      it->second.type() != Json::Type::STRING) {
+  auto it = json->object().find("accessToken");
+  if (it == json->object().end() || it->second.type() != Json::Type::kString) {
     FinishTokenFetch(GRPC_ERROR_CREATE(absl::StrFormat(
         "Missing or invalid accessToken in %s.", response_body)));
     return;
   }
-  std::string access_token = it->second.string_value();
-  it = json->object_value().find("expireTime");
-  if (it == json->object_value().end() ||
-      it->second.type() != Json::Type::STRING) {
+  std::string access_token = it->second.string();
+  it = json->object().find("expireTime");
+  if (it == json->object().end() || it->second.type() != Json::Type::kString) {
     FinishTokenFetch(GRPC_ERROR_CREATE(absl::StrFormat(
         "Missing or invalid expireTime in %s.", response_body)));
     return;
   }
-  std::string expire_time = it->second.string_value();
+  std::string expire_time = it->second.string();
   absl::Time t;
   if (!absl::ParseTime(absl::RFC3339_full, expire_time, &t, nullptr)) {
     FinishTokenFetch(GRPC_ERROR_CREATE(
@@ -540,7 +579,7 @@ void ExternalAccountCredentials::FinishTokenFetch(grpc_error_handle error) {
 
 grpc_call_credentials* grpc_external_account_credentials_create(
     const char* json_string, const char* scopes_string) {
-  auto json = grpc_core::Json::Parse(json_string);
+  auto json = grpc_core::JsonParse(json_string);
   if (!json.ok()) {
     gpr_log(GPR_ERROR,
             "External account credentials creation failed. Error: %s.",

data/src/core/lib/security/credentials/external/external_account_credentials.h

@@ -19,6 +19,8 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <stdint.h>
+
 #include <functional>
 #include <string>
 #include <vector>
@@ -45,12 +47,16 @@ namespace grpc_core {
 class ExternalAccountCredentials
     : public grpc_oauth2_token_fetcher_credentials {
  public:
+  struct ServiceAccountImpersonation {
+    int32_t token_lifetime_seconds;
+  };
   // External account credentials json interface.
   struct Options {
     std::string type;
     std::string audience;
     std::string subject_token_type;
     std::string service_account_impersonation_url;
+    ServiceAccountImpersonation service_account_impersonation;
     std::string token_url;
     std::string token_info_url;
     Json credential_source;

data/src/core/lib/security/credentials/external/file_external_account_credentials.cc

@@ -25,9 +25,11 @@
 #include "absl/strings/string_view.h"
 
 #include <grpc/slice.h>
+#include <grpc/support/json.h>
 
 #include "src/core/lib/iomgr/load_file.h"
 #include "src/core/lib/json/json.h"
+#include "src/core/lib/json/json_reader.h"
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/slice/slice_internal.h"
 
@@ -49,48 +51,48 @@ FileExternalAccountCredentials::Create(Options options,
 FileExternalAccountCredentials::FileExternalAccountCredentials(
     Options options, std::vector<std::string> scopes, grpc_error_handle* error)
     : ExternalAccountCredentials(options, std::move(scopes)) {
-  auto it = options.credential_source.object_value().find("file");
-  if (it == options.credential_source.object_value().end()) {
+  auto it = options.credential_source.object().find("file");
+  if (it == options.credential_source.object().end()) {
     *error = GRPC_ERROR_CREATE("file field not present.");
     return;
   }
-  if (it->second.type() != Json::Type::STRING) {
+  if (it->second.type() != Json::Type::kString) {
     *error = GRPC_ERROR_CREATE("file field must be a string.");
     return;
   }
-  file_ = it->second.string_value();
-  it = options.credential_source.object_value().find("format");
-  if (it != options.credential_source.object_value().end()) {
+  file_ = it->second.string();
+  it = options.credential_source.object().find("format");
+  if (it != options.credential_source.object().end()) {
     const Json& format_json = it->second;
-    if (format_json.type() != Json::Type::OBJECT) {
+    if (format_json.type() != Json::Type::kObject) {
       *error = GRPC_ERROR_CREATE(
           "The JSON value of credential source format is not an object.");
       return;
     }
-    auto format_it = format_json.object_value().find("type");
-    if (format_it == format_json.object_value().end()) {
+    auto format_it = format_json.object().find("type");
+    if (format_it == format_json.object().end()) {
       *error = GRPC_ERROR_CREATE("format.type field not present.");
       return;
     }
-    if (format_it->second.type() != Json::Type::STRING) {
+    if (format_it->second.type() != Json::Type::kString) {
       *error = GRPC_ERROR_CREATE("format.type field must be a string.");
       return;
     }
-    format_type_ = format_it->second.string_value();
+    format_type_ = format_it->second.string();
     if (format_type_ == "json") {
-      format_it = format_json.object_value().find("subject_token_field_name");
-      if (format_it == format_json.object_value().end()) {
+      format_it = format_json.object().find("subject_token_field_name");
+      if (format_it == format_json.object().end()) {
         *error = GRPC_ERROR_CREATE(
             "format.subject_token_field_name field must be present if the "
             "format is in Json.");
         return;
       }
-      if (format_it->second.type() != Json::Type::STRING) {
+      if (format_it->second.type() != Json::Type::kString) {
         *error = GRPC_ERROR_CREATE(
             "format.subject_token_field_name field must be a string.");
         return;
       }
-      format_subject_token_field_name_ = format_it->second.string_value();
+      format_subject_token_field_name_ = format_it->second.string();
     }
   }
 }
@@ -113,23 +115,23 @@ void FileExternalAccountCredentials::RetrieveSubjectToken(
   }
   absl::string_view content = StringViewFromSlice(content_slice.slice);
   if (format_type_ == "json") {
-    auto content_json = Json::Parse(content);
-    if (!content_json.ok() || content_json->type() != Json::Type::OBJECT) {
+    auto content_json = JsonParse(content);
+    if (!content_json.ok() || content_json->type() != Json::Type::kObject) {
       cb("", GRPC_ERROR_CREATE(
                  "The content of the file is not a valid json object."));
       return;
     }
     auto content_it =
-        content_json->object_value().find(format_subject_token_field_name_);
-    if (content_it == content_json->object_value().end()) {
+        content_json->object().find(format_subject_token_field_name_);
+    if (content_it == content_json->object().end()) {
       cb("", GRPC_ERROR_CREATE("Subject token field not present."));
       return;
     }
-    if (content_it->second.type() != Json::Type::STRING) {
+    if (content_it->second.type() != Json::Type::kString) {
       cb("", GRPC_ERROR_CREATE("Subject token field must be a string."));
       return;
     }
-    cb(content_it->second.string_value(), absl::OkStatus());
+    cb(content_it->second.string(), absl::OkStatus());
     return;
   }
   cb(std::string(content), absl::OkStatus());

data/src/core/lib/security/credentials/external/url_external_account_credentials.cc

@@ -33,6 +33,7 @@
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/alloc.h>
+#include <grpc/support/json.h>
 #include <grpc/support/log.h>
 #include <grpc/support/string_util.h>
 
@@ -40,6 +41,7 @@
 #include "src/core/lib/http/parser.h"
 #include "src/core/lib/iomgr/closure.h"
 #include "src/core/lib/json/json.h"
+#include "src/core/lib/json/json_reader.h"
 #include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/transport/error_utils.h"
 
@@ -61,16 +63,16 @@ UrlExternalAccountCredentials::Create(Options options,
 UrlExternalAccountCredentials::UrlExternalAccountCredentials(
     Options options, std::vector<std::string> scopes, grpc_error_handle* error)
     : ExternalAccountCredentials(options, std::move(scopes)) {
-  auto it = options.credential_source.object_value().find("url");
-  if (it == options.credential_source.object_value().end()) {
+  auto it = options.credential_source.object().find("url");
+  if (it == options.credential_source.object().end()) {
     *error = GRPC_ERROR_CREATE("url field not present.");
     return;
   }
-  if (it->second.type() != Json::Type::STRING) {
+  if (it->second.type() != Json::Type::kString) {
     *error = GRPC_ERROR_CREATE("url field must be a string.");
     return;
   }
-  absl::StatusOr<URI> tmp_url = URI::Parse(it->second.string_value());
+  absl::StatusOr<URI> tmp_url = URI::Parse(it->second.string());
   if (!tmp_url.ok()) {
     *error = GRPC_ERROR_CREATE(
         absl::StrFormat("Invalid credential source url. Error: %s",
@@ -80,51 +82,51 @@ UrlExternalAccountCredentials::UrlExternalAccountCredentials(
   url_ = *tmp_url;
   // The url must follow the format of <scheme>://<authority>/<path>
   std::vector<absl::string_view> v =
-      absl::StrSplit(it->second.string_value(), absl::MaxSplits('/', 3));
+      absl::StrSplit(it->second.string(), absl::MaxSplits('/', 3));
   url_full_path_ = absl::StrCat("/", v[3]);
-  it = options.credential_source.object_value().find("headers");
-  if (it != options.credential_source.object_value().end()) {
-    if (it->second.type() != Json::Type::OBJECT) {
+  it = options.credential_source.object().find("headers");
+  if (it != options.credential_source.object().end()) {
+    if (it->second.type() != Json::Type::kObject) {
       *error = GRPC_ERROR_CREATE(
           "The JSON value of credential source headers is not an object.");
       return;
     }
-    for (auto const& header : it->second.object_value()) {
-      headers_[header.first] = header.second.string_value();
+    for (auto const& header : it->second.object()) {
+      headers_[header.first] = header.second.string();
     }
   }
-  it = options.credential_source.object_value().find("format");
-  if (it != options.credential_source.object_value().end()) {
+  it = options.credential_source.object().find("format");
+  if (it != options.credential_source.object().end()) {
     const Json& format_json = it->second;
-    if (format_json.type() != Json::Type::OBJECT) {
+    if (format_json.type() != Json::Type::kObject) {
       *error = GRPC_ERROR_CREATE(
           "The JSON value of credential source format is not an object.");
       return;
     }
-    auto format_it = format_json.object_value().find("type");
-    if (format_it == format_json.object_value().end()) {
+    auto format_it = format_json.object().find("type");
+    if (format_it == format_json.object().end()) {
       *error = GRPC_ERROR_CREATE("format.type field not present.");
       return;
     }
-    if (format_it->second.type() != Json::Type::STRING) {
+    if (format_it->second.type() != Json::Type::kString) {
       *error = GRPC_ERROR_CREATE("format.type field must be a string.");
       return;
     }
-    format_type_ = format_it->second.string_value();
+    format_type_ = format_it->second.string();
     if (format_type_ == "json") {
-      format_it = format_json.object_value().find("subject_token_field_name");
-      if (format_it == format_json.object_value().end()) {
+      format_it = format_json.object().find("subject_token_field_name");
+      if (format_it == format_json.object().end()) {
         *error = GRPC_ERROR_CREATE(
             "format.subject_token_field_name field must be present if the "
             "format is in Json.");
         return;
       }
-      if (format_it->second.type() != Json::Type::STRING) {
+      if (format_it->second.type() != Json::Type::kString) {
         *error = GRPC_ERROR_CREATE(
             "format.subject_token_field_name field must be a string.");
         return;
       }
-      format_subject_token_field_name_ = format_it->second.string_value();
+      format_subject_token_field_name_ = format_it->second.string();
     }
   }
 }
@@ -200,26 +202,26 @@ void UrlExternalAccountCredentials::OnRetrieveSubjectTokenInternal(
   absl::string_view response_body(ctx_->response.body,
                                   ctx_->response.body_length);
   if (format_type_ == "json") {
-    auto response_json = Json::Parse(response_body);
-    if (!response_json.ok() || response_json->type() != Json::Type::OBJECT) {
+    auto response_json = JsonParse(response_body);
+    if (!response_json.ok() || response_json->type() != Json::Type::kObject) {
       FinishRetrieveSubjectToken(
           "", GRPC_ERROR_CREATE(
                   "The format of response is not a valid json object."));
       return;
     }
     auto response_it =
-        response_json->object_value().find(format_subject_token_field_name_);
-    if (response_it == response_json->object_value().end()) {
+        response_json->object().find(format_subject_token_field_name_);
+    if (response_it == response_json->object().end()) {
       FinishRetrieveSubjectToken(
           "", GRPC_ERROR_CREATE("Subject token field not present."));
       return;
     }
-    if (response_it->second.type() != Json::Type::STRING) {
+    if (response_it->second.type() != Json::Type::kString) {
       FinishRetrieveSubjectToken(
           "", GRPC_ERROR_CREATE("Subject token field must be a string."));
       return;
     }
-    FinishRetrieveSubjectToken(response_it->second.string_value(), error);
+    FinishRetrieveSubjectToken(response_it->second.string(), error);
     return;
   }
   FinishRetrieveSubjectToken(std::string(response_body), absl::OkStatus());