feat(auth): [aiohttp] Add mTLS reconfiguration logic when certificate mismatch for existing credentials & Agent Identity workloads by agrawalradhika-cell · Pull Request #18224 · googleapis/google-cloud-python

agrawalradhika-cell · 2026-08-26T04:00:38Z

feat: [aiohttp] Add mTLS reconfiguration logic when certificate mismatch for existing credentials & Agent Identity workloads

Changes included:

Adds mTLS reconfiguration logic when a certificate mismatch occurs.
Aligns async session behavior with the synchronous session by triggering a credential refresh and request retry on all 401 Unauthorized responses (not just mTLS).

Make sure to open an issue as a bug/issue before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea
Ensure the tests and linter pass
Code coverage does not decrease (if any source code was changed)
Appropriate docs were updated (if necessary)

Fixes #18227 #18227 🦕

feat: Add retry for cert rotation handling

gemini-code-assist

Code Review

This pull request introduces client certificate rotation handling for asynchronous authorized sessions when encountering an unauthorized response under mTLS. The review feedback highlights a violation of the repository style guide regarding exception contract compliance, suggesting that the certificate parameter check should be wrapped in a try-except block to gracefully fall back to the original response rather than crashing. Additionally, the feedback recommends updating the corresponding unit tests to assert this resilient fallback behavior.

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

Handle exceptions during mTLS reconfiguration with warnings instead of errors.

…logs Updated test logic to assert response instead of expecting an error.

…sync executor Refactor unauthorized response handling to use async executor for MTLS parameter checks.

chore: Reset mTLS init task upon client certificate change

Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>

…eck after 401 check chore: Refactor mTLS channel reconfiguration logic for adding mTLS check after 401 check

Implement mTLS rotation lock to prevent race conditions during certificate reconfiguration.

chore: Change warning to error log for mTLS channel reconfiguration failure.

chore: Refactor mTLS handling for unauthorized responses

Remove unnecessary continue statement after mTLS configuration.

Refactor tests for certificate rotation and error handling in AsyncAuthorizedSession. Update test names for clarity and ensure proper logging of errors.

Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>

Handle RefreshError during credential refresh to prevent unhandled exceptions.

Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>

chore: Reorder response closing logic for clarity

chore: Handle additional exception during credential refresh

Added refresh lock and counter to manage concurrent credential refreshes.

Limit the number of old authentication requests to 2 and ensure proper closure of the oldest requests.

Added tests for handling 401 responses with timeout and cancellation scenarios.

Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>

…onse Reordered parameters in check_parameters_for_unauthorized_response function.

Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>

Updated the 'check_parameters_for_unauthorized_response' function to include an optional client_cert_callback parameter and added detailed docstring for better understanding.

Store refresh counter at error for better tracking.

Updated mock patches to ensure correct assertions and added bound mocks for certificate parsing and caching.

Update mock authentication response handling in tests.

Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>

agrawalradhika-cell added 2 commits August 25, 2026 20:56

feat: Add retry for cert rotation handling

94a1d95

feat: Add retry for cert rotation handling

chore: Add tests for MTLS certificate rotation behavior

420447c

agrawalradhika-cell requested review from a team as code owners August 26, 2026 04:00

gemini-code-assist Bot reviewed Aug 26, 2026

View reviewed changes

Comment thread packages/google-auth/google/auth/aio/transport/sessions.py Outdated

Comment thread packages/google-auth/tests/transport/aio/test_sessions_mtls.py Outdated

agrawalradhika-cell changed the title ~~feat: [aiohttp] Add reconfiguration logic when certificate mismatch for existing credentials & Agent Identity workloads~~ feat: [aiohttp] Add mTLS reconfiguration logic when certificate mismatch for existing credentials & Agent Identity workloads Aug 26, 2026

agrawalradhika-cell and others added 2 commits August 26, 2026 10:34

Update packages/google-auth/tests/transport/aio/test_sessions_mtls.py

907cf00

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

Improve error handling for mTLS reconfiguration

cc850b1

Handle exceptions during mTLS reconfiguration with warnings instead of errors.

parthea assigned agrawalradhika-cell Aug 26, 2026

agrawalradhika-cell added 4 commits August 26, 2026 11:19

fix: Rename test_cert_rotation_failure to test_cert_rotation_failure_…

a44acb0

…logs Updated test logic to assert response instead of expecting an error.

chore: Refactor MTLS parameter check on unauthorized response o use a…

984e47c

…sync executor Refactor unauthorized response handling to use async executor for MTLS parameter checks.

chore: Reset mTLS init task upon client certificate change

30341bc

chore: Reset mTLS init task upon client certificate change

fix: fix the lint errors

1c068dc

Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>

nbayati reviewed Aug 27, 2026

View reviewed changes

agrawalradhika-cell added 11 commits August 27, 2026 13:00

chore: Refactor mTLS channel reconfiguration logic for adding mTLS ch…

6fb1e86

…eck after 401 check chore: Refactor mTLS channel reconfiguration logic for adding mTLS check after 401 check

chore: Add mTLS rotation lock for certificate management

2cdfe2d

Implement mTLS rotation lock to prevent race conditions during certificate reconfiguration.

chore: Log mTLS channel reconfiguration failure as error

d734731

chore: Change warning to error log for mTLS channel reconfiguration failure.

chore: Refactor mTLS handling for unauthorized responses

97e91d0

chore: Refactor mTLS handling for unauthorized responses

fix: Remove unnecessary continue statement after mTLS configuration.

d0da58b

Remove unnecessary continue statement after mTLS configuration.

fix: Fix cert rotation tests and improve error handling

825426d

Refactor tests for certificate rotation and error handling in AsyncAuthorizedSession. Update test names for clarity and ensure proper logging of errors.

fix: fix unit tests for the checks

63e587c

Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>

fix: Fix unit tests for the change

71b3bf5

Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>

test: remove fragile async caplog assertions

7d92d30

fix: Add error handling for credential refresh failures

8b2efcf

Handle RefreshError during credential refresh to prevent unhandled exceptions.

fix: Fix lint errors

a4d0405

Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>

lsirac requested changes Aug 29, 2026

View reviewed changes

lsirac reviewed Aug 29, 2026

View reviewed changes

agrawalradhika-cell added 3 commits August 29, 2026 20:51

chore: Refactor mTLS endpoint handling in sessions.py

2d52a21

chore: Reorder response closing logic for clarity

2806f4f

chore: Reorder response closing logic for clarity

chore: Handle additional exception during credential refresh

d5426f2

chore: Handle additional exception during credential refresh

nbayati reviewed Sep 3, 2026

View reviewed changes

Comment thread packages/google-auth/google/auth/aio/transport/sessions.py Outdated

nbayati reviewed Sep 3, 2026

View reviewed changes

Comment thread packages/google-auth/google/auth/aio/transport/sessions.py Outdated

nbayati reviewed Sep 3, 2026

View reviewed changes

Comment thread packages/google-auth/google/auth/aio/transport/sessions.py Outdated

nbayati reviewed Sep 3, 2026

View reviewed changes

Comment thread packages/google-auth/tests/transport/aio/test_sessions_mtls.py Outdated

nbayati reviewed Sep 3, 2026

View reviewed changes

Comment thread packages/google-auth/google/auth/aio/transport/sessions.py Outdated

agrawalradhika-cell added 5 commits September 2, 2026 19:48

chore: Refactor authentication retry logic in sessions.py

48cf5d2

fix: Implement concurrent credential refresh management

8b5d35d

Added refresh lock and counter to manage concurrent credential refreshes.

fix: Limit old auth requests to 2 and close oldest requests

c7746a4

Limit the number of old authentication requests to 2 and ensure proper closure of the oldest requests.

fix: Enhance tests for 401 response handling

d5c6746

Added tests for handling 401 responses with timeout and cancellation scenarios.

Fix: Fix the lint and unit tests

83095ea

Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>

agrawalradhika-cell requested a review from nbayati September 3, 2026 15:02

lsirac requested changes Sep 3, 2026

View reviewed changes

agrawalradhika-cell added 9 commits September 3, 2026 09:52

fix: Add .p.googleapis.com to MTLS URL prefixes

da00b40

fix: Refactor close method calls to handle awaitables

a355bc7

fix: Change parameter order in check_parameters_for_unauthorized_resp…

0ae183f

…onse Reordered parameters in check_parameters_for_unauthorized_response function.

fix: Fix client cert callback assignment in sessions.py

c976c76

fix: Update the tests based on chnages in sessions.py

3390024

fix: Add unit tests for MTLS parameter checking

377f6be

fix: Refactor mock patches in test_mtls.py

86640b2

Fix: fix lint and unit tests

fbb9e47

Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>

Fix: Fix the lint errors

f1b18ad

Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>

agrawalradhika-cell requested a review from lsirac September 3, 2026 18:01

lsirac requested changes Sep 3, 2026

View reviewed changes

agrawalradhika-cell added 5 commits September 3, 2026 13:38

chore: Modify check_parameters_for_unauthorized_response function

4cb7e05

Updated the 'check_parameters_for_unauthorized_response' function to include an optional client_cert_callback parameter and added detailed docstring for better understanding.

chore: Store refresh counter during request handling

215857d

Store refresh counter at error for better tracking.

fix: Refactor test_mtls.py for improved mock handling

f598432

Updated mock patches to ensure correct assertions and added bound mocks for certificate parsing and caching.

fix: Change mock responses to include 200 status code

aa0ee37

Update mock authentication response handling in tests.

Fix: fix the unit tests in test_mtls

97e2b1a

Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>

agrawalradhika-cell requested review from lsirac and mmcken3 September 3, 2026 21:17

Uh oh!

Conversation

agrawalradhika-cell commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

agrawalradhika-cell commented Aug 26, 2026 •

edited

Loading