grpc 1.66.0 → 1.67.0.pre1

data/src/core/lib/security/credentials/external/external_account_credentials.h

@@ -20,11 +20,13 @@
 #include <stdint.h>
 
 #include <functional>
+#include <memory>
 #include <string>
 #include <vector>
 
 #include "absl/strings/string_view.h"
 
+#include <grpc/event_engine/event_engine.h>
 #include <grpc/support/port_platform.h>
 
 #include "src/core/lib/gprpp/orphanable.h"
@@ -34,6 +36,7 @@
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/iomgr/polling_entity.h"
 #include "src/core/lib/security/credentials/oauth2/oauth2_credentials.h"
+#include "src/core/lib/security/credentials/token_fetcher/token_fetcher_credentials.h"
 #include "src/core/util/http_client/httpcli.h"
 #include "src/core/util/http_client/parser.h"
 #include "src/core/util/json/json.h"
@@ -44,8 +47,7 @@ namespace grpc_core {
 // exchanging external account credentials for GCP access token to authorize
 // requests to GCP APIs. The specific logic of retrieving subject token is
 // implemented in subclasses.
-class ExternalAccountCredentials
-    : public grpc_oauth2_token_fetcher_credentials {
+class ExternalAccountCredentials : public TokenFetcherCredentials {
  public:
   struct ServiceAccountImpersonation {
     int32_t token_lifetime_seconds;
@@ -66,72 +68,140 @@ class ExternalAccountCredentials
     std::string workforce_pool_user_project;
   };
 
-  static RefCountedPtr<ExternalAccountCredentials> Create(
+  static absl::StatusOr<RefCountedPtr<ExternalAccountCredentials>> Create(
       const Json& json, std::vector<std::string> scopes,
-      grpc_error_handle* error);
+      std::shared_ptr<grpc_event_engine::experimental::EventEngine>
+          event_engine = nullptr);
 
-  ExternalAccountCredentials(Options options, std::vector<std::string> scopes);
+  ExternalAccountCredentials(
+      Options options, std::vector<std::string> scopes,
+      std::shared_ptr<grpc_event_engine::experimental::EventEngine>
+          event_engine = nullptr);
   ~ExternalAccountCredentials() override;
-  std::string debug_string() override;
 
  protected:
-  // This is a helper struct to pass information between multiple callback based
-  // asynchronous calls.
-  struct HTTPRequestContext {
-    HTTPRequestContext(grpc_polling_entity* pollent, Timestamp deadline)
-        : pollent(pollent), deadline(deadline) {}
-    ~HTTPRequestContext() { grpc_http_response_destroy(&response); }
-
-    // Contextual parameters passed from
-    // grpc_oauth2_token_fetcher_credentials::fetch_oauth2().
-    grpc_polling_entity* pollent;
-    Timestamp deadline;
-
-    // Reusable token fetch http response and closure.
-    grpc_closure closure;
-    grpc_http_response response;
+  // A base class for a cancellable fetch operation.
+  class FetchBody : public InternallyRefCounted<FetchBody> {
+   public:
+    explicit FetchBody(
+        absl::AnyInvocable<void(absl::StatusOr<std::string>)> on_done)
+        : on_done_(std::move(on_done)) {}
+
+    void Orphan() override {
+      Shutdown();
+      Unref();
+    }
+
+   protected:
+    // The subclass must call this when the fetch is complete, even if
+    // cancelled.
+    void Finish(absl::StatusOr<std::string> result) {
+      std::exchange(on_done_, nullptr)(std::move(result));
+    }
+
+   private:
+    virtual void Shutdown() = 0;
+
+    absl::AnyInvocable<void(absl::StatusOr<std::string>)> on_done_;
   };
 
-  // Subclasses of base external account credentials need to override this
-  // method to implement the specific subject token retrieval logic.
-  // Once the subject token is ready, subclasses need to invoke
-  // the callback function (cb) to pass the subject token (or error)
-  // back.
-  virtual void RetrieveSubjectToken(
-      HTTPRequestContext* ctx, const Options& options,
-      std::function<void(std::string, grpc_error_handle)> cb) = 0;
+  // A simple no-op implementation, used for async execution of the
+  // on_done callback.
+  class NoOpFetchBody final : public FetchBody {
+   public:
+    NoOpFetchBody(grpc_event_engine::experimental::EventEngine& event_engine,
+                  absl::AnyInvocable<void(absl::StatusOr<std::string>)> on_done,
+                  absl::StatusOr<std::string> result);
 
-  virtual absl::string_view CredentialSourceType();
+   private:
+    void Shutdown() override {}
+  };
 
-  std::string MetricsHeaderValue();
+  // An implementation for HTTP requests.
+  class HttpFetchBody final : public FetchBody {
+   public:
+    HttpFetchBody(
+        absl::FunctionRef<OrphanablePtr<HttpRequest>(grpc_http_response*,
+                                                     grpc_closure*)>
+            start_http_request,
+        absl::AnyInvocable<void(absl::StatusOr<std::string>)> on_done);
 
- private:
-  // This method implements the common token fetch logic and it will be called
-  // when grpc_oauth2_token_fetcher_credentials request a new access token.
-  void fetch_oauth2(grpc_credentials_metadata_request* req,
-                    grpc_polling_entity* pollent, grpc_iomgr_cb_func cb,
-                    Timestamp deadline) override;
+    ~HttpFetchBody() override { grpc_http_response_destroy(&response_); }
+
+   private:
+    void Shutdown() override { http_request_.reset(); }
+
+    static void OnHttpResponse(void* arg, grpc_error_handle error);
+
+    OrphanablePtr<HttpRequest> http_request_;
+    grpc_http_response response_;
+    grpc_closure on_http_response_;
+  };
 
-  void OnRetrieveSubjectTokenInternal(absl::string_view subject_token,
-                                      grpc_error_handle error);
+  // An implementation of TokenFetcherCredentials::FetchRequest that
+  // executes a series of FetchBody operations to ultimately get to a
+  // token result.
+  class ExternalFetchRequest : public FetchRequest {
+   public:
+    ExternalFetchRequest(
+        ExternalAccountCredentials* creds, Timestamp deadline,
+        absl::AnyInvocable<
+            void(absl::StatusOr<RefCountedPtr<TokenFetcherCredentials::Token>>)>
+            on_done);
+
+    void Orphan() override;
+
+   protected:
+    Timestamp deadline() const { return deadline_; }
+    grpc_polling_entity* pollent() const { return creds_->pollent(); }
+    const Options& options() const { return creds_->options_; }
+
+   private:
+    void ExchangeToken(absl::StatusOr<std::string> subject_token);
+    void MaybeImpersonateServiceAccount(
+        absl::StatusOr<std::string> response_body);
+    void OnImpersonateServiceAccount(absl::StatusOr<std::string> response_body);
+
+    void FinishTokenFetch(absl::StatusOr<std::string> response_body);
+
+    // If status is non-OK or we've been shut down, calls FinishTokenFetch()
+    // and returns true.
+    bool MaybeFailLocked(absl::Status status)
+        ABSL_EXCLUSIVE_LOCKS_REQUIRED(&mu_);
+
+    ExternalAccountCredentials* creds_;
+    Timestamp deadline_;
+    absl::AnyInvocable<void(
+        absl::StatusOr<RefCountedPtr<TokenFetcherCredentials::Token>>)>
+        on_done_;
+
+    Mutex mu_;
+    OrphanablePtr<FetchBody> fetch_body_ ABSL_GUARDED_BY(&mu_);
+  };
 
-  void ExchangeToken(absl::string_view subject_token);
-  static void OnExchangeToken(void* arg, grpc_error_handle error);
-  void OnExchangeTokenInternal(grpc_error_handle error);
+  virtual absl::string_view CredentialSourceType();
 
-  void ImpersenateServiceAccount();
-  static void OnImpersenateServiceAccount(void* arg, grpc_error_handle error);
-  void OnImpersenateServiceAccountInternal(grpc_error_handle error);
+  std::string MetricsHeaderValue();
 
-  void FinishTokenFetch(grpc_error_handle error);
+  absl::string_view audience() const { return options_.audience; }
+
+ private:
+  OrphanablePtr<FetchRequest> FetchToken(
+      Timestamp deadline,
+      absl::AnyInvocable<void(absl::StatusOr<RefCountedPtr<Token>>)> on_done)
+      final;
+
+  // Subclasses of ExternalAccountCredentials need to override this
+  // method to implement the specific-subject token retrieval logic.
+  // The caller will save the resulting FetchBody object, which will
+  // be orphaned upon cancellation.  The FetchBody object must
+  // eventually invoke on_done.
+  virtual OrphanablePtr<FetchBody> RetrieveSubjectToken(
+      Timestamp deadline,
+      absl::AnyInvocable<void(absl::StatusOr<std::string>)> on_done) = 0;
 
   Options options_;
   std::vector<std::string> scopes_;
-
-  OrphanablePtr<HttpRequest> http_request_;
-  HTTPRequestContext* ctx_ = nullptr;
-  grpc_credentials_metadata_request* metadata_req_ = nullptr;
-  grpc_iomgr_cb_func response_cb_ = nullptr;
 };
 
 }  // namespace grpc_core

data/src/core/lib/security/credentials/external/file_external_account_credentials.cc

@@ -34,22 +34,78 @@
 
 namespace grpc_core {
 
-RefCountedPtr<FileExternalAccountCredentials>
-FileExternalAccountCredentials::Create(Options options,
-                                       std::vector<std::string> scopes,
-                                       grpc_error_handle* error) {
-  auto creds = MakeRefCounted<FileExternalAccountCredentials>(
-      std::move(options), std::move(scopes), error);
-  if (error->ok()) {
-    return creds;
-  } else {
-    return nullptr;
+//
+// FileExternalAccountCredentials::FileFetchBody
+//
+
+FileExternalAccountCredentials::FileFetchBody::FileFetchBody(
+    absl::AnyInvocable<void(absl::StatusOr<std::string>)> on_done,
+    FileExternalAccountCredentials* creds)
+    : FetchBody(std::move(on_done)), creds_(creds) {
+  // Start work asynchronously, since we can't invoke the callback
+  // synchronously without causing a deadlock.
+  creds->event_engine().Run([self = RefAsSubclass<FileFetchBody>()]() mutable {
+    ApplicationCallbackExecCtx application_exec_ctx;
+    ExecCtx exec_ctx;
+    self->ReadFile();
+    self.reset();
+  });
+}
+
+void FileExternalAccountCredentials::FileFetchBody::ReadFile() {
+  // To retrieve the subject token, we read the file every time we make a
+  // request because it may have changed since the last request.
+  auto content_slice = LoadFile(creds_->file_, /*add_null_terminator=*/false);
+  if (!content_slice.ok()) {
+    Finish(content_slice.status());
+    return;
   }
+  absl::string_view content = content_slice->as_string_view();
+  if (creds_->format_type_ == "json") {
+    auto content_json = JsonParse(content);
+    if (!content_json.ok() || content_json->type() != Json::Type::kObject) {
+      Finish(GRPC_ERROR_CREATE(
+          "The content of the file is not a valid json object."));
+      return;
+    }
+    auto content_it =
+        content_json->object().find(creds_->format_subject_token_field_name_);
+    if (content_it == content_json->object().end()) {
+      Finish(GRPC_ERROR_CREATE("Subject token field not present."));
+      return;
+    }
+    if (content_it->second.type() != Json::Type::kString) {
+      Finish(GRPC_ERROR_CREATE("Subject token field must be a string."));
+      return;
+    }
+    Finish(content_it->second.string());
+    return;
+  }
+  Finish(std::string(content));
+}
+
+//
+// FileExternalAccountCredentials
+//
+
+absl::StatusOr<RefCountedPtr<FileExternalAccountCredentials>>
+FileExternalAccountCredentials::Create(
+    Options options, std::vector<std::string> scopes,
+    std::shared_ptr<grpc_event_engine::experimental::EventEngine>
+        event_engine) {
+  grpc_error_handle error;
+  auto creds = MakeRefCounted<FileExternalAccountCredentials>(
+      std::move(options), std::move(scopes), std::move(event_engine), &error);
+  if (!error.ok()) return error;
+  return creds;
 }
 
 FileExternalAccountCredentials::FileExternalAccountCredentials(
-    Options options, std::vector<std::string> scopes, grpc_error_handle* error)
-    : ExternalAccountCredentials(options, std::move(scopes)) {
+    Options options, std::vector<std::string> scopes,
+    std::shared_ptr<grpc_event_engine::experimental::EventEngine> event_engine,
+    grpc_error_handle* error)
+    : ExternalAccountCredentials(options, std::move(scopes),
+                                 std::move(event_engine)) {
   auto it = options.credential_source.object().find("file");
   if (it == options.credential_source.object().end()) {
     *error = GRPC_ERROR_CREATE("file field not present.");
@@ -96,38 +152,21 @@ FileExternalAccountCredentials::FileExternalAccountCredentials(
   }
 }
 
-void FileExternalAccountCredentials::RetrieveSubjectToken(
-    HTTPRequestContext* /*ctx*/, const Options& /*options*/,
-    std::function<void(std::string, grpc_error_handle)> cb) {
-  // To retrieve the subject token, we read the file every time we make a
-  // request because it may have changed since the last request.
-  auto content_slice = LoadFile(file_, /*add_null_terminator=*/false);
-  if (!content_slice.ok()) {
-    cb("", content_slice.status());
-    return;
-  }
-  absl::string_view content = content_slice->as_string_view();
-  if (format_type_ == "json") {
-    auto content_json = JsonParse(content);
-    if (!content_json.ok() || content_json->type() != Json::Type::kObject) {
-      cb("", GRPC_ERROR_CREATE(
-                 "The content of the file is not a valid json object."));
-      return;
-    }
-    auto content_it =
-        content_json->object().find(format_subject_token_field_name_);
-    if (content_it == content_json->object().end()) {
-      cb("", GRPC_ERROR_CREATE("Subject token field not present."));
-      return;
-    }
-    if (content_it->second.type() != Json::Type::kString) {
-      cb("", GRPC_ERROR_CREATE("Subject token field must be a string."));
-      return;
-    }
-    cb(content_it->second.string(), absl::OkStatus());
-    return;
-  }
-  cb(std::string(content), absl::OkStatus());
+std::string FileExternalAccountCredentials::debug_string() {
+  return absl::StrCat("FileExternalAccountCredentials{Audience:", audience(),
+                      ")");
+}
+
+UniqueTypeName FileExternalAccountCredentials::type() const {
+  static UniqueTypeName::Factory kFactory("FileExternalAccountCredentials");
+  return kFactory.Create();
+}
+
+OrphanablePtr<ExternalAccountCredentials::FetchBody>
+FileExternalAccountCredentials::RetrieveSubjectToken(
+    Timestamp /*deadline*/,
+    absl::AnyInvocable<void(absl::StatusOr<std::string>)> on_done) {
+  return MakeOrphanable<FileFetchBody>(std::move(on_done), this);
 }
 
 absl::string_view FileExternalAccountCredentials::CredentialSourceType() {

data/src/core/lib/security/credentials/external/file_external_account_credentials.h

@@ -33,18 +33,38 @@ namespace grpc_core {
 
 class FileExternalAccountCredentials final : public ExternalAccountCredentials {
  public:
-  static RefCountedPtr<FileExternalAccountCredentials> Create(
+  static absl::StatusOr<RefCountedPtr<FileExternalAccountCredentials>> Create(
       Options options, std::vector<std::string> scopes,
+      std::shared_ptr<grpc_event_engine::experimental::EventEngine>
+          event_engine = nullptr);
+
+  FileExternalAccountCredentials(
+      Options options, std::vector<std::string> scopes,
+      std::shared_ptr<grpc_event_engine::experimental::EventEngine>
+          event_engine,
       grpc_error_handle* error);
 
-  FileExternalAccountCredentials(Options options,
-                                 std::vector<std::string> scopes,
-                                 grpc_error_handle* error);
+  std::string debug_string() override;
+
+  UniqueTypeName type() const override;
 
  private:
-  void RetrieveSubjectToken(
-      HTTPRequestContext* ctx, const Options& options,
-      std::function<void(std::string, grpc_error_handle)> cb) override;
+  class FileFetchBody final : public FetchBody {
+   public:
+    FileFetchBody(absl::AnyInvocable<void(absl::StatusOr<std::string>)> on_done,
+                  FileExternalAccountCredentials* creds);
+
+   private:
+    void Shutdown() override {}
+
+    void ReadFile();
+
+    FileExternalAccountCredentials* creds_;
+  };
+
+  OrphanablePtr<FetchBody> RetrieveSubjectToken(
+      Timestamp deadline,
+      absl::AnyInvocable<void(absl::StatusOr<std::string>)> on_done) override;
 
   absl::string_view CredentialSourceType() override;
 

data/src/core/lib/security/credentials/external/url_external_account_credentials.cc

@@ -33,7 +33,6 @@
 #include <grpc/grpc_security.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/json.h>
-#include <grpc/support/log.h>
 #include <grpc/support/port_platform.h>
 #include <grpc/support/string_util.h>
 
@@ -47,22 +46,24 @@
 
 namespace grpc_core {
 
-RefCountedPtr<UrlExternalAccountCredentials>
-UrlExternalAccountCredentials::Create(Options options,
-                                      std::vector<std::string> scopes,
-                                      grpc_error_handle* error) {
+absl::StatusOr<RefCountedPtr<UrlExternalAccountCredentials>>
+UrlExternalAccountCredentials::Create(
+    Options options, std::vector<std::string> scopes,
+    std::shared_ptr<grpc_event_engine::experimental::EventEngine>
+        event_engine) {
+  grpc_error_handle error;
   auto creds = MakeRefCounted<UrlExternalAccountCredentials>(
-      std::move(options), std::move(scopes), error);
-  if (error->ok()) {
-    return creds;
-  } else {
-    return nullptr;
-  }
+      std::move(options), std::move(scopes), std::move(event_engine), &error);
+  if (!error.ok()) return error;
+  return creds;
 }
 
 UrlExternalAccountCredentials::UrlExternalAccountCredentials(
-    Options options, std::vector<std::string> scopes, grpc_error_handle* error)
-    : ExternalAccountCredentials(options, std::move(scopes)) {
+    Options options, std::vector<std::string> scopes,
+    std::shared_ptr<grpc_event_engine::experimental::EventEngine> event_engine,
+    grpc_error_handle* error)
+    : ExternalAccountCredentials(options, std::move(scopes),
+                                 std::move(event_engine)) {
   auto it = options.credential_source.object().find("url");
   if (it == options.credential_source.object().end()) {
     *error = GRPC_ERROR_CREATE("url field not present.");
@@ -131,114 +132,88 @@ UrlExternalAccountCredentials::UrlExternalAccountCredentials(
   }
 }
 
-void UrlExternalAccountCredentials::RetrieveSubjectToken(
-    HTTPRequestContext* ctx, const Options& /*options*/,
-    std::function<void(std::string, grpc_error_handle)> cb) {
-  if (ctx == nullptr) {
-    FinishRetrieveSubjectToken(
-        "",
-        GRPC_ERROR_CREATE(
-            "Missing HTTPRequestContext to start subject token retrieval."));
-    return;
-  }
-  auto url_for_request =
-      URI::Create(url_.scheme(), url_.authority(), url_full_path_,
-                  {} /* query params */, "" /* fragment */);
-  if (!url_for_request.ok()) {
-    FinishRetrieveSubjectToken(
-        "", absl_status_to_grpc_error(url_for_request.status()));
-    return;
-  }
-  ctx_ = ctx;
-  cb_ = cb;
-  grpc_http_request request;
-  memset(&request, 0, sizeof(grpc_http_request));
-  request.path = gpr_strdup(url_full_path_.c_str());
-  grpc_http_header* headers = nullptr;
-  request.hdr_count = headers_.size();
-  headers = static_cast<grpc_http_header*>(
-      gpr_malloc(sizeof(grpc_http_header) * request.hdr_count));
-  int i = 0;
-  for (auto const& header : headers_) {
-    headers[i].key = gpr_strdup(header.first.c_str());
-    headers[i].value = gpr_strdup(header.second.c_str());
-    ++i;
-  }
-  request.hdrs = headers;
-  grpc_http_response_destroy(&ctx_->response);
-  ctx_->response = {};
-  GRPC_CLOSURE_INIT(&ctx_->closure, OnRetrieveSubjectToken, this, nullptr);
-  CHECK(http_request_ == nullptr);
-  RefCountedPtr<grpc_channel_credentials> http_request_creds;
-  if (url_.scheme() == "http") {
-    http_request_creds = RefCountedPtr<grpc_channel_credentials>(
-        grpc_insecure_credentials_create());
-  } else {
-    http_request_creds = CreateHttpRequestSSLCredentials();
-  }
-  http_request_ =
-      HttpRequest::Get(std::move(*url_for_request), nullptr /* channel args */,
-                       ctx_->pollent, &request, ctx_->deadline, &ctx_->closure,
-                       &ctx_->response, std::move(http_request_creds));
-  http_request_->Start();
-  grpc_http_request_destroy(&request);
+std::string UrlExternalAccountCredentials::debug_string() {
+  return absl::StrCat("UrlExternalAccountCredentials{Audience:", audience(),
+                      ")");
 }
 
-void UrlExternalAccountCredentials::OnRetrieveSubjectToken(
-    void* arg, grpc_error_handle error) {
-  UrlExternalAccountCredentials* self =
-      static_cast<UrlExternalAccountCredentials*>(arg);
-  self->OnRetrieveSubjectTokenInternal(error);
+UniqueTypeName UrlExternalAccountCredentials::type() const {
+  static UniqueTypeName::Factory kFactory("UrlExternalAccountCredentials");
+  return kFactory.Create();
 }
 
-void UrlExternalAccountCredentials::OnRetrieveSubjectTokenInternal(
-    grpc_error_handle error) {
-  http_request_.reset();
-  if (!error.ok()) {
-    FinishRetrieveSubjectToken("", error);
-    return;
-  }
-  absl::string_view response_body(ctx_->response.body,
-                                  ctx_->response.body_length);
-  if (format_type_ == "json") {
-    auto response_json = JsonParse(response_body);
-    if (!response_json.ok() || response_json->type() != Json::Type::kObject) {
-      FinishRetrieveSubjectToken(
-          "", GRPC_ERROR_CREATE(
-                  "The format of response is not a valid json object."));
-      return;
-    }
-    auto response_it =
-        response_json->object().find(format_subject_token_field_name_);
-    if (response_it == response_json->object().end()) {
-      FinishRetrieveSubjectToken(
-          "", GRPC_ERROR_CREATE("Subject token field not present."));
-      return;
-    }
-    if (response_it->second.type() != Json::Type::kString) {
-      FinishRetrieveSubjectToken(
-          "", GRPC_ERROR_CREATE("Subject token field must be a string."));
-      return;
-    }
-    FinishRetrieveSubjectToken(response_it->second.string(), error);
-    return;
-  }
-  FinishRetrieveSubjectToken(std::string(response_body), absl::OkStatus());
-}
-
-void UrlExternalAccountCredentials::FinishRetrieveSubjectToken(
-    std::string subject_token, grpc_error_handle error) {
-  // Reset context
-  ctx_ = nullptr;
-  // Move object state into local variables.
-  auto cb = cb_;
-  cb_ = nullptr;
-  // Invoke the callback.
-  if (!error.ok()) {
-    cb("", error);
-  } else {
-    cb(subject_token, absl::OkStatus());
+OrphanablePtr<ExternalAccountCredentials::FetchBody>
+UrlExternalAccountCredentials::RetrieveSubjectToken(
+    Timestamp deadline,
+    absl::AnyInvocable<void(absl::StatusOr<std::string>)> on_done) {
+  auto url_for_request =
+      URI::Create(url_.scheme(), url_.authority(), url_full_path_,
+                  {} /* query params */, "" /* fragment */);
+  if (!url_for_request.ok()) {
+    return MakeOrphanable<NoOpFetchBody>(
+        event_engine(), std::move(on_done),
+        absl_status_to_grpc_error(url_for_request.status()));
   }
+  return MakeOrphanable<HttpFetchBody>(
+      [&](grpc_http_response* response, grpc_closure* on_http_response) {
+        grpc_http_request request;
+        memset(&request, 0, sizeof(grpc_http_request));
+        request.path = gpr_strdup(url_full_path_.c_str());
+        grpc_http_header* headers = nullptr;
+        request.hdr_count = headers_.size();
+        headers = static_cast<grpc_http_header*>(
+            gpr_malloc(sizeof(grpc_http_header) * request.hdr_count));
+        int i = 0;
+        for (auto const& header : headers_) {
+          headers[i].key = gpr_strdup(header.first.c_str());
+          headers[i].value = gpr_strdup(header.second.c_str());
+          ++i;
+        }
+        request.hdrs = headers;
+        RefCountedPtr<grpc_channel_credentials> http_request_creds;
+        if (url_.scheme() == "http") {
+          http_request_creds = RefCountedPtr<grpc_channel_credentials>(
+              grpc_insecure_credentials_create());
+        } else {
+          http_request_creds = CreateHttpRequestSSLCredentials();
+        }
+        auto http_request =
+            HttpRequest::Get(std::move(*url_for_request), /*args=*/nullptr,
+                             pollent(), &request, deadline, on_http_response,
+                             response, std::move(http_request_creds));
+        http_request->Start();
+        grpc_http_request_destroy(&request);
+        return http_request;
+      },
+      [this, on_done = std::move(on_done)](
+          absl::StatusOr<std::string> response_body) mutable {
+        if (!response_body.ok()) {
+          on_done(std::move(response_body));
+          return;
+        }
+        if (format_type_ == "json") {
+          auto response_json = JsonParse(*response_body);
+          if (!response_json.ok() ||
+              response_json->type() != Json::Type::kObject) {
+            on_done(GRPC_ERROR_CREATE(
+                "The format of response is not a valid json object."));
+            return;
+          }
+          auto response_it =
+              response_json->object().find(format_subject_token_field_name_);
+          if (response_it == response_json->object().end()) {
+            on_done(GRPC_ERROR_CREATE("Subject token field not present."));
+            return;
+          }
+          if (response_it->second.type() != Json::Type::kString) {
+            on_done(GRPC_ERROR_CREATE("Subject token field must be a string."));
+            return;
+          }
+          on_done(response_it->second.string());
+          return;
+        }
+        on_done(std::move(response_body));
+      });
 }
 
 absl::string_view UrlExternalAccountCredentials::CredentialSourceType() {