Package com.salesforce.multicloudj.sts.gcp

Class GcpStsVerifier

java.lang.Object
com.salesforce.multicloudj.sts.driver.AbstractStsVerifier
com.salesforce.multicloudj.sts.gcp.GcpStsVerifier
All Implemented Interfaces:
Provider, SdkService
@AutoService(AbstractStsVerifier.class) public class GcpStsVerifier extends AbstractStsVerifier
GCP implementation of the STS verifier. It validates a signed identity that is a JWT produced by a service account (via the IAM SignJwt API) by verifying the JWT's RSA signature against the service account's Google-managed public keys.

The public keys are published at https://www.googleapis.com/service_accounts/v1/metadata/jwk/{serviceAccountEmail} as a JWKS document. The verifier selects the key by the JWT kid header, verifies the signature, enforces the exp/iat time bounds with a small clock-skew tolerance, and returns the identity carried in the token's iss/sub claims.

  • Constructor Details

    • GcpStsVerifier

      public GcpStsVerifier()

    • GcpStsVerifier

      public GcpStsVerifier(GcpStsVerifier.Builder builder)

    • GcpStsVerifier

      public GcpStsVerifier(GcpStsVerifier.Builder builder, com.google.auth.http.HttpTransportFactory httpTransportFactory)
      Constructor that accepts a preconfigured transport factory, used by tests.

  • Method Details

    • builder

      public GcpStsVerifier.Builder builder()
      Description copied from interface: Provider
      Creates and returns a new Builder instance for this provider.
      Returns:
      A Builder instance for constructing this provider.

    • validateSignedAuthRequest

      protected CallerIdentity validateSignedAuthRequest(String signedIdentity, ValidateOptions options)
      Description copied from class: AbstractStsVerifier
      Substrate-specific implementation that validates the signed identity and returns the caller identity.
      Specified by:
      validateSignedAuthRequest in class AbstractStsVerifier
      Parameters:
      signedIdentity - the portable token string produced by a signer.
      options - validation options; may be null.
      Returns:
      the verified CallerIdentity.

    • mapException

      public SubstrateSdkException mapException(Throwable t)
      Description copied from interface: SdkService
      Maps a provider-specific Throwable to a fully-built SubstrateSdkException the caller can throw directly. The returned exception carries both the typed mapping (e.g. ResourceNotFoundException for HTTP 404) and an authoritative retryable flag derived from the native cloud SDK signal (e.g. AWS throttling, GCP ApiException.isRetryable(), status codes), or the type's default retryability when the SDK exposes no native signal.

      Callers throw the result; they do not inspect or transform it further: 

      
 try {
   ...
 } catch (Throwable t) {
   throw provider.mapException(t);
 }

      Implementation contract: implementations should compute a typed exception class (typically via their per-service ErrorCodeMapping) and a retryable hint, then return ExceptionHandler.build(exceptionClass, t, retryableHint). Implementations do not need to short-circuit when t is already a SubstrateSdkException: ExceptionHandler.build preserves an already-mapped exception's concrete subtype and retryable flag.

      Parameters:
      t - the original throwable from the provider SDK
      Returns:
      a built SubstrateSdkException ready to throw