fix(oauth2_http): Avoid retrying on 4xx errors during GCE metadata ping

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ComputeEngineCredentials.java

@@ -648,6 +648,10 @@ void setProjectId(String projectId) {
   private static boolean pingComputeEngineMetadata(
       HttpTransportFactory transportFactory, DefaultCredentialsProvider provider) {
     GenericUrl tokenUrl = new GenericUrl(getMetadataServerUrl(provider));
+    // pingComputeEngineMetadata is executed heavily during startup (within isOnGce()) on non-GCE
+    // environments. We use a strict 500ms timeout and manual 3-try loop (instead of
+    // ExponentialBackOff and HttpRequest.setUnsuccessfulResponseHandler) to fail fast and avoid
+    // significantly delaying application startup for workflows running on local setups.
     for (int i = 1; i <= MAX_COMPUTE_PING_TRIES; ++i) {
       try {
         HttpRequest request =
@@ -673,6 +677,12 @@ private static boolean pingComputeEngineMetadata(
       } catch (SocketTimeoutException expected) {
         // Ignore logging timeouts which is the expected failure mode in non GCE environments.
       } catch (IOException e) {
+        if (e instanceof HttpResponseException) {
+          int statusCode = ((HttpResponseException) e).getStatusCode();
+          if (statusCode >= 400 && statusCode < 500) {
+            return false;
+          }
+        }
         LOGGER.log(
             Level.FINE,
             "Encountered an unexpected exception when checking"

google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/ComputeEngineCredentialsTest.java

@@ -58,8 +58,13 @@
 import com.google.auth.TestUtils;
 import com.google.auth.http.HttpTransportFactory;
 import com.google.auth.oauth2.DefaultCredentialsProviderTest.MockRequestCountingTransportFactory;
+import java.io.ByteArrayInputStream;
+import java.io.File;
+import java.io.FileNotFoundException;
 import java.io.IOException;
+import java.io.InputStream;
 import java.net.URI;
+import java.nio.charset.StandardCharsets;
 import java.util.ArrayDeque;
 import java.util.Arrays;
 import java.util.Collection;
@@ -1177,6 +1182,60 @@ void getProjectId_explicitSet_noMDsCall() {
     assertEquals(0, transportFactory.transport.getRequestCount());
   }
 
+  @Test
+  void isOnGce_clientError_doesNotRetry_returnsFalseOnUnknownOs() {
+    MockMetadataServerTransportFactory transportFactory = new MockMetadataServerTransportFactory();
+    transportFactory.transport.setStatusCode(HttpStatusCodes.STATUS_CODE_NOT_FOUND);
+    DefaultCredentialsProvider provider =
+        new DefaultCredentialsProvider() {
+          @Override
+          String getEnv(String name) {
+            if (DefaultCredentialsProvider.NO_GCE_CHECK_ENV_VAR.equals(name)) {
+              return "false";
+            }
+            return super.getEnv(name);
+          }
+
+          @Override
+          String getOsName() {
+            return "Unknown";
+          }
+        };
+    boolean isOnGce = ComputeEngineCredentials.isOnGce(transportFactory, provider);
+    assertFalse(isOnGce);
+    assertEquals(1, transportFactory.transport.getRequestCount());
+  }
+
+  @Test
+  void isOnGce_clientError_doesNotRetry_returnsTrueOnLinuxGce() {
+    MockMetadataServerTransportFactory transportFactory = new MockMetadataServerTransportFactory();
+    transportFactory.transport.setStatusCode(HttpStatusCodes.STATUS_CODE_FORBIDDEN);
+    DefaultCredentialsProvider provider =
+        new DefaultCredentialsProvider() {
+          @Override
+          String getEnv(String name) {
+            if (DefaultCredentialsProvider.NO_GCE_CHECK_ENV_VAR.equals(name)) {
+              return "false";
+            }
+            return super.getEnv(name);
+          }
+
+          @Override
+          String getOsName() {
+            return "linux";
+          }
+
+          @Override
+          InputStream readStream(File file) throws FileNotFoundException {
+            return new ByteArrayInputStream(
+                "Google Compute Engine".getBytes(StandardCharsets.UTF_8));
+          }
+        };
+    boolean isOnGce = ComputeEngineCredentials.isOnGce(transportFactory, provider);
+    assertTrue(isOnGce);
+    assertEquals(1, transportFactory.transport.getRequestCount());
+  }
+
   static class MockMetadataServerTransportFactory implements HttpTransportFactory {
 
     MockMetadataServerTransport transport =

google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/MockMetadataServerTransport.java

@@ -71,6 +71,11 @@ public class MockMetadataServerTransport extends MockHttpTransport {
 
   private boolean emptyContent;
   private MockLowLevelHttpRequest request;
+  private int requestCount = 0;
+
+  public int getRequestCount() {
+    return requestCount;
+  }
 
   public MockMetadataServerTransport() {}
 
@@ -125,6 +130,7 @@ public MockLowLevelHttpRequest getRequest() {
 
   @Override
   public LowLevelHttpRequest buildRequest(String method, String url) throws IOException {
+    requestCount++;
     if (url.startsWith(ComputeEngineCredentials.getTokenServerEncodedUrl())) {
       this.request = getMockRequestForTokenEndpoint(url);
       return this.request;

java-backstory/proto-google-cloud-backstory/src/main/java/com/google/backstory/AnalyticsMetadata.java

@@ -56,13 +56,13 @@ private AnalyticsMetadata() {
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.backstory.Udm.internal_static_google_backstory_AnalyticsMetadata_descriptor;
+    return com.google.backstory.UdmProto.internal_static_google_backstory_AnalyticsMetadata_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessage.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.backstory.Udm
+    return com.google.backstory.UdmProto
         .internal_static_google_backstory_AnalyticsMetadata_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.backstory.AnalyticsMetadata.class,
@@ -295,13 +295,13 @@ public static final class Builder extends com.google.protobuf.GeneratedMessage.B
       // @@protoc_insertion_point(builder_implements:google.backstory.AnalyticsMetadata)
       com.google.backstory.AnalyticsMetadataOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.backstory.Udm.internal_static_google_backstory_AnalyticsMetadata_descriptor;
+      return com.google.backstory.UdmProto.internal_static_google_backstory_AnalyticsMetadata_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessage.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.backstory.Udm
+      return com.google.backstory.UdmProto
           .internal_static_google_backstory_AnalyticsMetadata_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.backstory.AnalyticsMetadata.class,
@@ -325,7 +325,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.backstory.Udm.internal_static_google_backstory_AnalyticsMetadata_descriptor;
+      return com.google.backstory.UdmProto.internal_static_google_backstory_AnalyticsMetadata_descriptor;
     }
 
     @java.lang.Override

java-backstory/proto-google-cloud-backstory/src/main/java/com/google/backstory/AppCompatMetadata.java

@@ -56,13 +56,13 @@ private AppCompatMetadata() {
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.backstory.Udm.internal_static_google_backstory_AppCompatMetadata_descriptor;
+    return com.google.backstory.UdmProto.internal_static_google_backstory_AppCompatMetadata_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessage.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.backstory.Udm
+    return com.google.backstory.UdmProto
         .internal_static_google_backstory_AppCompatMetadata_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.backstory.AppCompatMetadata.class,
@@ -354,13 +354,13 @@ public static final class Builder extends com.google.protobuf.GeneratedMessage.B
       // @@protoc_insertion_point(builder_implements:google.backstory.AppCompatMetadata)
       com.google.backstory.AppCompatMetadataOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.backstory.Udm.internal_static_google_backstory_AppCompatMetadata_descriptor;
+      return com.google.backstory.UdmProto.internal_static_google_backstory_AppCompatMetadata_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessage.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.backstory.Udm
+      return com.google.backstory.UdmProto
           .internal_static_google_backstory_AppCompatMetadata_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.backstory.AppCompatMetadata.class,
@@ -386,7 +386,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.backstory.Udm.internal_static_google_backstory_AppCompatMetadata_descriptor;
+      return com.google.backstory.UdmProto.internal_static_google_backstory_AppCompatMetadata_descriptor;
     }
 
     @java.lang.Override

java-backstory/proto-google-cloud-backstory/src/main/java/com/google/backstory/Artifact.java

@@ -63,13 +63,13 @@ private Artifact() {
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.backstory.Udm.internal_static_google_backstory_Artifact_descriptor;
+    return com.google.backstory.UdmProto.internal_static_google_backstory_Artifact_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessage.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.backstory.Udm.internal_static_google_backstory_Artifact_fieldAccessorTable
+    return com.google.backstory.UdmProto.internal_static_google_backstory_Artifact_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.backstory.Artifact.class, com.google.backstory.Artifact.Builder.class);
   }
@@ -1454,13 +1454,13 @@ public static final class Builder extends com.google.protobuf.GeneratedMessage.B
       // @@protoc_insertion_point(builder_implements:google.backstory.Artifact)
       com.google.backstory.ArtifactOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.backstory.Udm.internal_static_google_backstory_Artifact_descriptor;
+      return com.google.backstory.UdmProto.internal_static_google_backstory_Artifact_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessage.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.backstory.Udm.internal_static_google_backstory_Artifact_fieldAccessorTable
+      return com.google.backstory.UdmProto.internal_static_google_backstory_Artifact_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.backstory.Artifact.class, com.google.backstory.Artifact.Builder.class);
     }
@@ -1560,7 +1560,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.backstory.Udm.internal_static_google_backstory_Artifact_descriptor;
+      return com.google.backstory.UdmProto.internal_static_google_backstory_Artifact_descriptor;
     }
 
     @java.lang.Override

java-backstory/proto-google-cloud-backstory/src/main/java/com/google/backstory/ArtifactClient.java

@@ -57,13 +57,13 @@ private ArtifactClient() {
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.backstory.Udm.internal_static_google_backstory_ArtifactClient_descriptor;
+    return com.google.backstory.UdmProto.internal_static_google_backstory_ArtifactClient_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessage.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.backstory.Udm
+    return com.google.backstory.UdmProto
         .internal_static_google_backstory_ArtifactClient_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.backstory.ArtifactClient.class,
@@ -401,13 +401,13 @@ public static final class Builder extends com.google.protobuf.GeneratedMessage.B
       // @@protoc_insertion_point(builder_implements:google.backstory.ArtifactClient)
       com.google.backstory.ArtifactClientOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.backstory.Udm.internal_static_google_backstory_ArtifactClient_descriptor;
+      return com.google.backstory.UdmProto.internal_static_google_backstory_ArtifactClient_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessage.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.backstory.Udm
+      return com.google.backstory.UdmProto
           .internal_static_google_backstory_ArtifactClient_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.backstory.ArtifactClient.class,
@@ -432,7 +432,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.backstory.Udm.internal_static_google_backstory_ArtifactClient_descriptor;
+      return com.google.backstory.UdmProto.internal_static_google_backstory_ArtifactClient_descriptor;
     }
 
     @java.lang.Override

java-backstory/proto-google-cloud-backstory/src/main/java/com/google/backstory/Asset.java

@@ -70,13 +70,13 @@ private Asset() {
   }
 
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-    return com.google.backstory.Udm.internal_static_google_backstory_Asset_descriptor;
+    return com.google.backstory.UdmProto.internal_static_google_backstory_Asset_descriptor;
   }
 
   @java.lang.Override
   protected com.google.protobuf.GeneratedMessage.FieldAccessorTable
       internalGetFieldAccessorTable() {
-    return com.google.backstory.Udm.internal_static_google_backstory_Asset_fieldAccessorTable
+    return com.google.backstory.UdmProto.internal_static_google_backstory_Asset_fieldAccessorTable
         .ensureFieldAccessorsInitialized(
             com.google.backstory.Asset.class, com.google.backstory.Asset.Builder.class);
   }
@@ -2493,13 +2493,13 @@ public static final class Builder extends com.google.protobuf.GeneratedMessage.B
       // @@protoc_insertion_point(builder_implements:google.backstory.Asset)
       com.google.backstory.AssetOrBuilder {
     public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
-      return com.google.backstory.Udm.internal_static_google_backstory_Asset_descriptor;
+      return com.google.backstory.UdmProto.internal_static_google_backstory_Asset_descriptor;
     }
 
     @java.lang.Override
     protected com.google.protobuf.GeneratedMessage.FieldAccessorTable
         internalGetFieldAccessorTable() {
-      return com.google.backstory.Udm.internal_static_google_backstory_Asset_fieldAccessorTable
+      return com.google.backstory.UdmProto.internal_static_google_backstory_Asset_fieldAccessorTable
           .ensureFieldAccessorsInitialized(
               com.google.backstory.Asset.class, com.google.backstory.Asset.Builder.class);
     }
@@ -2630,7 +2630,7 @@ public Builder clear() {
 
     @java.lang.Override
     public com.google.protobuf.Descriptors.Descriptor getDescriptorForType() {
-      return com.google.backstory.Udm.internal_static_google_backstory_Asset_descriptor;
+      return com.google.backstory.UdmProto.internal_static_google_backstory_Asset_descriptor;
     }
 
     @java.lang.Override