grpc 1.71.0 → 1.73.0

data/src/core/credentials/call/call_credentials.h

@@ -0,0 +1,157 @@
+//
+// Copyright 2015 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_SRC_CORE_CREDENTIALS_CALL_CALL_CREDENTIALS_H
+#define GRPC_SRC_CORE_CREDENTIALS_CALL_CALL_CREDENTIALS_H
+
+#include <grpc/credentials.h>
+#include <grpc/grpc.h>
+#include <grpc/grpc_security.h>
+#include <grpc/grpc_security_constants.h>
+#include <grpc/impl/grpc_types.h>
+#include <grpc/support/port_platform.h>
+
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "absl/log/check.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/string_view.h"
+#include "src/core/credentials/transport/security_connector.h"
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/promise/arena_promise.h"
+#include "src/core/lib/slice/slice.h"
+#include "src/core/lib/transport/transport.h"
+#include "src/core/transport/auth_context.h"
+#include "src/core/util/crash.h"
+#include "src/core/util/ref_counted.h"
+#include "src/core/util/ref_counted_ptr.h"
+#include "src/core/util/unique_type_name.h"
+
+// --- Constants. ---
+
+typedef enum {
+  GRPC_CREDENTIALS_OK = 0,
+  GRPC_CREDENTIALS_ERROR
+} grpc_credentials_status;
+
+#define GRPC_AUTHORIZATION_METADATA_KEY "authorization"
+#define GRPC_IAM_AUTHORIZATION_TOKEN_METADATA_KEY \
+  "x-goog-iam-authorization-token"
+#define GRPC_IAM_AUTHORITY_SELECTOR_METADATA_KEY "x-goog-iam-authority-selector"
+
+#define GRPC_SECURE_TOKEN_REFRESH_THRESHOLD_SECS 60
+
+#define GRPC_COMPUTE_ENGINE_METADATA_HOST "metadata.google.internal."
+#define GRPC_COMPUTE_ENGINE_METADATA_TOKEN_PATH \
+  "/computeMetadata/v1/instance/service-accounts/default/token"
+
+#define GRPC_GOOGLE_OAUTH2_SERVICE_HOST "oauth2.googleapis.com"
+#define GRPC_GOOGLE_OAUTH2_SERVICE_TOKEN_PATH "/token"
+
+#define GRPC_SERVICE_ACCOUNT_POST_BODY_PREFIX                         \
+  "grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&" \
+  "assertion="
+
+#define GRPC_REFRESH_TOKEN_POST_BODY_FORMAT_STRING \
+  "client_id=%s&client_secret=%s&refresh_token=%s&grant_type=refresh_token"
+
+// --- Google utils ---
+
+// It is the caller's responsibility to gpr_free the result if not NULL.
+std::string grpc_get_well_known_google_credentials_file_path(void);
+
+// Implementation function for the different platforms.
+std::string grpc_get_well_known_google_credentials_file_path_impl(void);
+
+// Override for testing only. Not thread-safe
+typedef std::string (*grpc_well_known_credentials_path_getter)(void);
+void grpc_override_well_known_credentials_path_getter(
+    grpc_well_known_credentials_path_getter getter);
+
+// --- grpc_core::CredentialsMetadataArray. ---
+
+namespace grpc_core {
+using CredentialsMetadataArray = std::vector<std::pair<Slice, Slice>>;
+}
+
+// --- grpc_call_credentials. ---
+
+// This type is forward declared as a C struct and we cannot define it as a
+// class. Otherwise, compiler will complain about type mismatch due to
+// -Wmismatched-tags.
+struct grpc_call_credentials
+    : public grpc_core::DualRefCounted<grpc_call_credentials> {
+ public:
+  // TODO(roth): Consider whether security connector actually needs to
+  // be part of this interface.  Currently, it is here only for the
+  // url_scheme() method, which we might be able to instead add as an
+  // auth context property.
+  struct GetRequestMetadataArgs {
+    grpc_core::RefCountedPtr<grpc_channel_security_connector>
+        security_connector;
+    grpc_core::RefCountedPtr<grpc_auth_context> auth_context;
+  };
+
+  // The pointer value \a type is used to uniquely identify a creds
+  // implementation for down-casting purposes. Every creds implementation should
+  // use a unique string instance, which should be returned by all instances of
+  // that creds implementation.
+  explicit grpc_call_credentials(
+      grpc_security_level min_security_level = GRPC_PRIVACY_AND_INTEGRITY)
+      : min_security_level_(min_security_level) {}
+
+  ~grpc_call_credentials() override = default;
+
+  virtual grpc_core::ArenaPromise<
+      absl::StatusOr<grpc_core::ClientMetadataHandle>>
+  GetRequestMetadata(grpc_core::ClientMetadataHandle initial_metadata,
+                     const GetRequestMetadataArgs* args) = 0;
+
+  virtual grpc_security_level min_security_level() const {
+    return min_security_level_;
+  }
+
+  // Compares this grpc_call_credentials object with \a other.
+  // If this method returns 0, it means that gRPC can treat the two call
+  // credentials as effectively the same..
+  int cmp(const grpc_call_credentials* other) const {
+    CHECK_NE(other, nullptr);
+    int r = type().Compare(other->type());
+    if (r != 0) return r;
+    return cmp_impl(other);
+  }
+
+  virtual std::string debug_string() {
+    return "grpc_call_credentials did not provide debug string";
+  }
+
+  // The pointer value \a type is used to uniquely identify a creds
+  // implementation for down-casting purposes. Every creds implementation should
+  // use a unique string instance, which should be returned by all instances of
+  // that creds implementation.
+  virtual grpc_core::UniqueTypeName type() const = 0;
+
+ private:
+  // Implementation for `cmp` method intended to be overridden by subclasses.
+  // Only invoked if `type()` and `other->type()` point to the same string.
+  virtual int cmp_impl(const grpc_call_credentials* other) const = 0;
+
+  const grpc_security_level min_security_level_;
+};
+
+#endif  // GRPC_SRC_CORE_CREDENTIALS_CALL_CALL_CREDENTIALS_H

data/src/core/{lib/security/credentials → credentials/call}/call_creds_util.cc

@@ -14,7 +14,7 @@
 // limitations under the License.
 //
 
-#include "src/core/lib/security/credentials/call_creds_util.h"
+#include "src/core/credentials/call/call_creds_util.h"
 
 #include <grpc/support/port_platform.h>
 #include <grpc/support/string_util.h>
@@ -24,9 +24,9 @@
 #include "absl/log/log.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
-#include "src/core/lib/security/context/security_context.h"
-#include "src/core/lib/security/security_connector/security_connector.h"
-#include "src/core/lib/transport/metadata_batch.h"
+#include "src/core/call/metadata_batch.h"
+#include "src/core/credentials/transport/security_connector.h"
+#include "src/core/transport/auth_context.h"
 #include "src/core/util/ref_counted_ptr.h"
 
 namespace grpc_core {

data/src/core/{lib/security/credentials → credentials/call}/call_creds_util.h

@@ -14,8 +14,8 @@
 // limitations under the License.
 //
 
-#ifndef GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_CALL_CREDS_UTIL_H
-#define GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_CALL_CREDS_UTIL_H
+#ifndef GRPC_SRC_CORE_CREDENTIALS_CALL_CALL_CREDS_UTIL_H
+#define GRPC_SRC_CORE_CREDENTIALS_CALL_CALL_CREDS_UTIL_H
 
 #include <grpc/credentials.h>
 #include <grpc/grpc_security.h>
@@ -23,7 +23,7 @@
 
 #include <string>
 
-#include "src/core/lib/security/credentials/credentials.h"
+#include "src/core/credentials/call/call_credentials.h"
 #include "src/core/lib/transport/transport.h"
 
 namespace grpc_core {
@@ -40,4 +40,4 @@ grpc_auth_metadata_context MakePluginAuthMetadataContext(
 
 }  // namespace grpc_core
 
-#endif  // GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_CALL_CREDS_UTIL_H
+#endif  // GRPC_SRC_CORE_CREDENTIALS_CALL_CALL_CREDS_UTIL_H

data/src/core/{lib/security/credentials/composite/composite_credentials.cc → credentials/call/composite/composite_call_credentials.cc}

@@ -16,9 +16,7 @@
 //
 //
 
-#include "src/core/lib/security/credentials/composite/composite_credentials.h"
-
-#include <grpc/support/port_platform.h>
+#include "src/core/credentials/call/composite/composite_call_credentials.h"
 
 #include <cstring>
 #include <memory>
@@ -27,22 +25,11 @@
 #include "absl/log/check.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_join.h"
+#include "src/core/call/metadata_batch.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/promise/try_seq.h"
-#include "src/core/lib/transport/metadata_batch.h"
 #include "src/core/util/ref_counted_ptr.h"
 
-//
-// grpc_composite_channel_credentials
-//
-
-grpc_core::UniqueTypeName grpc_composite_channel_credentials::Type() {
-  static grpc_core::UniqueTypeName::Factory kFactory("Composite");
-  return kFactory.Create();
-}
-
-// -- Composite call credentials. --
-
 grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
 grpc_composite_call_credentials::GetRequestMetadata(
     grpc_core::ClientMetadataHandle initial_metadata,
@@ -113,14 +100,6 @@ grpc_composite_call_credentials::grpc_composite_call_credentials(
   }
 }
 
-static grpc_core::RefCountedPtr<grpc_call_credentials>
-composite_call_credentials_create(
-    grpc_core::RefCountedPtr<grpc_call_credentials> creds1,
-    grpc_core::RefCountedPtr<grpc_call_credentials> creds2) {
-  return grpc_core::MakeRefCounted<grpc_composite_call_credentials>(
-      std::move(creds1), std::move(creds2));
-}
-
 grpc_call_credentials* grpc_composite_call_credentials_create(
     grpc_call_credentials* creds1, grpc_call_credentials* creds2,
     void* reserved) {
@@ -130,39 +109,7 @@ grpc_call_credentials* grpc_composite_call_credentials_create(
   CHECK_EQ(reserved, nullptr);
   CHECK_NE(creds1, nullptr);
   CHECK_NE(creds2, nullptr);
-
-  return composite_call_credentials_create(creds1->Ref(), creds2->Ref())
+  return grpc_core::MakeRefCounted<grpc_composite_call_credentials>(
+             creds1->Ref(), creds2->Ref())
       .release();
 }
-
-// -- Composite channel credentials. --
-
-grpc_core::RefCountedPtr<grpc_channel_security_connector>
-grpc_composite_channel_credentials::create_security_connector(
-    grpc_core::RefCountedPtr<grpc_call_credentials> call_creds,
-    const char* target, grpc_core::ChannelArgs* args) {
-  CHECK(inner_creds_ != nullptr);
-  CHECK(call_creds_ != nullptr);
-  // If we are passed a call_creds, create a call composite to pass it
-  // downstream.
-  if (call_creds != nullptr) {
-    return inner_creds_->create_security_connector(
-        composite_call_credentials_create(call_creds_, std::move(call_creds)),
-        target, args);
-  } else {
-    return inner_creds_->create_security_connector(call_creds_, target, args);
-  }
-}
-
-grpc_channel_credentials* grpc_composite_channel_credentials_create(
-    grpc_channel_credentials* channel_creds, grpc_call_credentials* call_creds,
-    void* reserved) {
-  CHECK(channel_creds != nullptr && call_creds != nullptr &&
-        reserved == nullptr);
-  GRPC_TRACE_LOG(api, INFO)
-      << "grpc_composite_channel_credentials_create(channel_creds="
-      << channel_creds << ", call_creds=" << call_creds
-      << ", reserved=" << reserved << ")";
-  return new grpc_composite_channel_credentials(channel_creds->Ref(),
-                                                call_creds->Ref());
-}

data/src/core/credentials/call/composite/composite_call_credentials.h

@@ -0,0 +1,82 @@
+//
+//
+// Copyright 2015 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPC_SRC_CORE_CREDENTIALS_CALL_COMPOSITE_COMPOSITE_CALL_CREDENTIALS_H
+#define GRPC_SRC_CORE_CREDENTIALS_CALL_COMPOSITE_COMPOSITE_CALL_CREDENTIALS_H
+
+#include <grpc/credentials.h>
+#include <grpc/grpc.h>
+#include <grpc/grpc_security.h>
+#include <grpc/grpc_security_constants.h>
+
+#include <algorithm>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "absl/status/statusor.h"
+#include "src/core/credentials/call/call_credentials.h"
+#include "src/core/credentials/transport/security_connector.h"
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/promise/arena_promise.h"
+#include "src/core/lib/transport/transport.h"
+#include "src/core/util/ref_counted_ptr.h"
+#include "src/core/util/unique_type_name.h"
+#include "src/core/util/useful.h"
+
+class grpc_composite_call_credentials : public grpc_call_credentials {
+ public:
+  using CallCredentialsList =
+      std::vector<grpc_core::RefCountedPtr<grpc_call_credentials>>;
+
+  grpc_composite_call_credentials(
+      grpc_core::RefCountedPtr<grpc_call_credentials> creds1,
+      grpc_core::RefCountedPtr<grpc_call_credentials> creds2);
+  ~grpc_composite_call_credentials() override = default;
+
+  void Orphaned() override { inner_.clear(); }
+
+  grpc_core::ArenaPromise<absl::StatusOr<grpc_core::ClientMetadataHandle>>
+  GetRequestMetadata(grpc_core::ClientMetadataHandle initial_metadata,
+                     const GetRequestMetadataArgs* args) override;
+
+  grpc_security_level min_security_level() const override {
+    return min_security_level_;
+  }
+
+  const CallCredentialsList& inner() const { return inner_; }
+  std::string debug_string() override;
+
+  static grpc_core::UniqueTypeName Type();
+
+  grpc_core::UniqueTypeName type() const override { return Type(); }
+
+ private:
+  int cmp_impl(const grpc_call_credentials* other) const override {
+    // TODO(yashykt): Check if we can do something better here
+    return grpc_core::QsortCompare(
+        static_cast<const grpc_call_credentials*>(this), other);
+  }
+
+  void push_to_inner(grpc_core::RefCountedPtr<grpc_call_credentials> creds,
+                     bool is_composite);
+  grpc_security_level min_security_level_;
+  CallCredentialsList inner_;
+};
+
+#endif  // GRPC_SRC_CORE_CREDENTIALS_CALL_COMPOSITE_COMPOSITE_CALL_CREDENTIALS_H

data/src/core/{lib/security/credentials → credentials/call}/external/aws_external_account_credentials.cc

@@ -13,7 +13,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 //
-#include "src/core/lib/security/credentials/external/aws_external_account_credentials.h"
+#include "src/core/credentials/call/external/aws_external_account_credentials.h"
 
 #include <grpc/credentials.h>
 #include <grpc/grpc.h>
@@ -35,8 +35,8 @@
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_replace.h"
 #include "absl/strings/string_view.h"
+#include "src/core/credentials/transport/transport_credentials.h"
 #include "src/core/lib/iomgr/closure.h"
-#include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/util/env.h"
 #include "src/core/util/http_client/httpcli_ssl_credentials.h"
 #include "src/core/util/json/json.h"

data/src/core/{lib/security/credentials → credentials/call}/external/aws_external_account_credentials.h

@@ -14,8 +14,8 @@
 // limitations under the License.
 //
 
-#ifndef GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_AWS_EXTERNAL_ACCOUNT_CREDENTIALS_H
-#define GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_AWS_EXTERNAL_ACCOUNT_CREDENTIALS_H
+#ifndef GRPC_SRC_CORE_CREDENTIALS_CALL_EXTERNAL_AWS_EXTERNAL_ACCOUNT_CREDENTIALS_H
+#define GRPC_SRC_CORE_CREDENTIALS_CALL_EXTERNAL_AWS_EXTERNAL_ACCOUNT_CREDENTIALS_H
 
 #include <grpc/support/port_platform.h>
 
@@ -25,9 +25,9 @@
 #include <vector>
 
 #include "absl/strings/string_view.h"
+#include "src/core/credentials/call/external/aws_request_signer.h"
+#include "src/core/credentials/call/external/external_account_credentials.h"
 #include "src/core/lib/iomgr/error.h"
-#include "src/core/lib/security/credentials/external/aws_request_signer.h"
-#include "src/core/lib/security/credentials/external/external_account_credentials.h"
 #include "src/core/util/http_client/httpcli.h"
 #include "src/core/util/http_client/parser.h"
 #include "src/core/util/orphanable.h"
@@ -114,4 +114,4 @@ class AwsExternalAccountCredentials final : public ExternalAccountCredentials {
 
 }  // namespace grpc_core
 
-#endif  // GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_AWS_EXTERNAL_ACCOUNT_CREDENTIALS_H
+#endif  // GRPC_SRC_CORE_CREDENTIALS_CALL_EXTERNAL_AWS_EXTERNAL_ACCOUNT_CREDENTIALS_H

data/src/core/{lib/security/credentials → credentials/call}/external/aws_request_signer.cc

@@ -13,7 +13,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 //
-#include "src/core/lib/security/credentials/external/aws_request_signer.h"
+#include "src/core/credentials/call/external/aws_request_signer.h"
 
 #include <grpc/support/port_platform.h>
 #include <openssl/crypto.h>
@@ -151,8 +151,9 @@ std::map<std::string, std::string> AwsRequestSigner::GetSignedRequestHeaders() {
   canonical_request_vector.emplace_back(query);
   canonical_request_vector.emplace_back("\n");
   // 4. CanonicalHeaders
+  std::string authority = url_.authority();
   if (request_headers_.empty()) {
-    request_headers_.insert({"host", url_.authority()});
+    request_headers_.insert({"host", authority});
     if (!token_.empty()) {
       request_headers_.insert({"x-amz-security-token", token_});
     }
@@ -198,7 +199,7 @@ std::map<std::string, std::string> AwsRequestSigner::GetSignedRequestHeaders() {
   string_to_sign_vector.emplace_back("\n");
   // 3. CredentialScope
   std::pair<absl::string_view, absl::string_view> host_parts =
-      absl::StrSplit(url_.authority(), absl::MaxSplits('.', 1));
+      absl::StrSplit(authority, absl::MaxSplits('.', 1));
   std::string service_name(host_parts.first);
   std::string credential_scope = absl::StrFormat(
       "%s/%s/%s/aws4_request", request_date_short, region_, service_name);

data/src/core/{lib/security/credentials → credentials/call}/external/aws_request_signer.h

@@ -14,8 +14,8 @@
 // limitations under the License.
 //
 
-#ifndef GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_AWS_REQUEST_SIGNER_H
-#define GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_AWS_REQUEST_SIGNER_H
+#ifndef GRPC_SRC_CORE_CREDENTIALS_CALL_EXTERNAL_AWS_REQUEST_SIGNER_H
+#define GRPC_SRC_CORE_CREDENTIALS_CALL_EXTERNAL_AWS_REQUEST_SIGNER_H
 
 #include <grpc/support/port_platform.h>
 
@@ -69,4 +69,4 @@ class AwsRequestSigner {
 
 }  // namespace grpc_core
 
-#endif  // GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_AWS_REQUEST_SIGNER_H
+#endif  // GRPC_SRC_CORE_CREDENTIALS_CALL_EXTERNAL_AWS_REQUEST_SIGNER_H

data/src/core/{lib/security/credentials → credentials/call}/external/external_account_credentials.cc

@@ -13,7 +13,7 @@
 // limitations under the License.
 //
 
-#include "src/core/lib/security/credentials/external/external_account_credentials.h"
+#include "src/core/credentials/call/external/external_account_credentials.h"
 
 #include <grpc/credentials.h>
 #include <grpc/grpc.h>
@@ -43,11 +43,11 @@
 #include "absl/strings/strip.h"
 #include "absl/time/clock.h"
 #include "absl/time/time.h"
-#include "src/core/lib/security/credentials/credentials.h"
-#include "src/core/lib/security/credentials/external/aws_external_account_credentials.h"
-#include "src/core/lib/security/credentials/external/file_external_account_credentials.h"
-#include "src/core/lib/security/credentials/external/url_external_account_credentials.h"
-#include "src/core/lib/security/util/json_util.h"
+#include "src/core/credentials/call/external/aws_external_account_credentials.h"
+#include "src/core/credentials/call/external/file_external_account_credentials.h"
+#include "src/core/credentials/call/external/url_external_account_credentials.h"
+#include "src/core/credentials/call/json_util.h"
+#include "src/core/credentials/transport/transport_credentials.h"
 #include "src/core/util/http_client/httpcli_ssl_credentials.h"
 #include "src/core/util/http_client/parser.h"
 #include "src/core/util/json/json_reader.h"

data/src/core/{lib/security/credentials → credentials/call}/external/external_account_credentials.h

@@ -14,8 +14,8 @@
 // limitations under the License.
 //
 
-#ifndef GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_EXTERNAL_ACCOUNT_CREDENTIALS_H
-#define GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_EXTERNAL_ACCOUNT_CREDENTIALS_H
+#ifndef GRPC_SRC_CORE_CREDENTIALS_CALL_EXTERNAL_EXTERNAL_ACCOUNT_CREDENTIALS_H
+#define GRPC_SRC_CORE_CREDENTIALS_CALL_EXTERNAL_EXTERNAL_ACCOUNT_CREDENTIALS_H
 
 #include <grpc/event_engine/event_engine.h>
 #include <grpc/support/port_platform.h>
@@ -27,11 +27,11 @@
 #include <vector>
 
 #include "absl/strings/string_view.h"
+#include "src/core/credentials/call/oauth2/oauth2_credentials.h"
+#include "src/core/credentials/call/token_fetcher/token_fetcher_credentials.h"
 #include "src/core/lib/iomgr/closure.h"
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/iomgr/polling_entity.h"
-#include "src/core/lib/security/credentials/oauth2/oauth2_credentials.h"
-#include "src/core/lib/security/credentials/token_fetcher/token_fetcher_credentials.h"
 #include "src/core/util/http_client/httpcli.h"
 #include "src/core/util/http_client/parser.h"
 #include "src/core/util/json/json.h"
@@ -204,4 +204,4 @@ class ExternalAccountCredentials : public TokenFetcherCredentials {
 
 }  // namespace grpc_core
 
-#endif  // GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_EXTERNAL_ACCOUNT_CREDENTIALS_H
+#endif  // GRPC_SRC_CORE_CREDENTIALS_CALL_EXTERNAL_EXTERNAL_ACCOUNT_CREDENTIALS_H

data/src/core/{lib/security/credentials → credentials/call}/external/file_external_account_credentials.cc

@@ -13,7 +13,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 //
-#include "src/core/lib/security/credentials/external/file_external_account_credentials.h"
+#include "src/core/credentials/call/external/file_external_account_credentials.h"
 
 #include <grpc/slice.h>
 #include <grpc/support/json.h>

data/src/core/{lib/security/credentials → credentials/call}/external/file_external_account_credentials.h

@@ -14,8 +14,8 @@
 // limitations under the License.
 //
 
-#ifndef GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_FILE_EXTERNAL_ACCOUNT_CREDENTIALS_H
-#define GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_FILE_EXTERNAL_ACCOUNT_CREDENTIALS_H
+#ifndef GRPC_SRC_CORE_CREDENTIALS_CALL_EXTERNAL_FILE_EXTERNAL_ACCOUNT_CREDENTIALS_H
+#define GRPC_SRC_CORE_CREDENTIALS_CALL_EXTERNAL_FILE_EXTERNAL_ACCOUNT_CREDENTIALS_H
 
 #include <grpc/support/port_platform.h>
 
@@ -24,8 +24,8 @@
 #include <vector>
 
 #include "absl/strings/string_view.h"
+#include "src/core/credentials/call/external/external_account_credentials.h"
 #include "src/core/lib/iomgr/error.h"
-#include "src/core/lib/security/credentials/external/external_account_credentials.h"
 #include "src/core/util/ref_counted_ptr.h"
 
 namespace grpc_core {
@@ -77,4 +77,4 @@ class FileExternalAccountCredentials final : public ExternalAccountCredentials {
 
 }  // namespace grpc_core
 
-#endif  // GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_FILE_EXTERNAL_ACCOUNT_CREDENTIALS_H
+#endif  // GRPC_SRC_CORE_CREDENTIALS_CALL_EXTERNAL_FILE_EXTERNAL_ACCOUNT_CREDENTIALS_H

data/src/core/{lib/security/credentials → credentials/call}/external/url_external_account_credentials.cc

@@ -13,7 +13,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 //
-#include "src/core/lib/security/credentials/external/url_external_account_credentials.h"
+#include "src/core/credentials/call/external/url_external_account_credentials.h"
 
 #include <grpc/credentials.h>
 #include <grpc/grpc.h>
@@ -34,8 +34,9 @@
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_split.h"
 #include "absl/strings/string_view.h"
+#include "src/core/credentials/call/call_credentials.h"
+#include "src/core/credentials/transport/transport_credentials.h"
 #include "src/core/lib/iomgr/closure.h"
-#include "src/core/lib/security/credentials/credentials.h"
 #include "src/core/lib/transport/error_utils.h"
 #include "src/core/util/http_client/httpcli_ssl_credentials.h"
 #include "src/core/util/http_client/parser.h"
@@ -145,8 +146,8 @@ UrlExternalAccountCredentials::RetrieveSubjectToken(
     Timestamp deadline,
     absl::AnyInvocable<void(absl::StatusOr<std::string>)> on_done) {
   auto url_for_request =
-      URI::Create(url_.scheme(), url_.authority(), url_full_path_,
-                  {} /* query params */, "" /* fragment */);
+      URI::Create(url_.scheme(), url_.user_info(), url_.host_port(),
+                  url_full_path_, {} /* query params */, "" /* fragment */);
   if (!url_for_request.ok()) {
     return MakeOrphanable<NoOpFetchBody>(
         event_engine(), std::move(on_done),

data/src/core/{lib/security/credentials → credentials/call}/external/url_external_account_credentials.h

@@ -14,8 +14,8 @@
 // limitations under the License.
 //
 
-#ifndef GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_URL_EXTERNAL_ACCOUNT_CREDENTIALS_H
-#define GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_URL_EXTERNAL_ACCOUNT_CREDENTIALS_H
+#ifndef GRPC_SRC_CORE_CREDENTIALS_CALL_EXTERNAL_URL_EXTERNAL_ACCOUNT_CREDENTIALS_H
+#define GRPC_SRC_CORE_CREDENTIALS_CALL_EXTERNAL_URL_EXTERNAL_ACCOUNT_CREDENTIALS_H
 
 #include <grpc/support/port_platform.h>
 
@@ -25,8 +25,8 @@
 #include <vector>
 
 #include "absl/strings/string_view.h"
+#include "src/core/credentials/call/external/external_account_credentials.h"
 #include "src/core/lib/iomgr/error.h"
-#include "src/core/lib/security/credentials/external/external_account_credentials.h"
 #include "src/core/util/http_client/httpcli.h"
 #include "src/core/util/orphanable.h"
 #include "src/core/util/ref_counted_ptr.h"
@@ -70,4 +70,4 @@ class UrlExternalAccountCredentials final : public ExternalAccountCredentials {
 
 }  // namespace grpc_core
 
-#endif  // GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_EXTERNAL_URL_EXTERNAL_ACCOUNT_CREDENTIALS_H
+#endif  // GRPC_SRC_CORE_CREDENTIALS_CALL_EXTERNAL_URL_EXTERNAL_ACCOUNT_CREDENTIALS_H

data/src/core/{lib/security/credentials → credentials/call}/gcp_service_account_identity/gcp_service_account_identity_credentials.cc

@@ -14,7 +14,7 @@
 // limitations under the License.
 //
 
-#include "src/core/lib/security/credentials/gcp_service_account_identity/gcp_service_account_identity_credentials.h"
+#include "src/core/credentials/call/gcp_service_account_identity/gcp_service_account_identity_credentials.h"
 
 #include <grpc/support/time.h>
 
@@ -25,8 +25,9 @@
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_split.h"
 #include "absl/strings/string_view.h"
+#include "src/core/call/metadata.h"
+#include "src/core/credentials/transport/transport_credentials.h"
 #include "src/core/lib/iomgr/error.h"
-#include "src/core/lib/transport/metadata.h"
 #include "src/core/lib/transport/status_conversion.h"
 #include "src/core/util/json/json.h"
 #include "src/core/util/json/json_args.h"
@@ -179,7 +180,7 @@ GcpServiceAccountIdentityCallCredentials::StartHttpRequest(
   // channel. This would allow us to cancel an authentication query when under
   // extreme memory pressure.
   auto uri = URI::Create(
-      "http", "metadata.google.internal.",
+      "http", /*user_info=*/"", "metadata.google.internal.",
       "/computeMetadata/v1/instance/service-accounts/default/identity",
       {{"audience", audience_}}, /*fragment=*/"");
   CHECK_OK(uri);  // params are hardcoded