fix(auth): Agentic Identites mTLS gaps fix _is_mtls and SslCredentials. by vverman · Pull Request #17387 · googleapis/google-cloud-python

vverman · 2026-06-06T03:56:30Z

Resolve some mTLS transport state and gRPC workload certificate issues

Fix inconsistent _is_mtls flag in urllib3 on fallback to default HTTP.
Reset _is_mtls to False in async sessions if a custom request handler cannot be reconfigured.
Update gRPC SslCredentials to recognize workload certificates by checking has_default_client_cert_source instead of only SecureConnect.

gemini-code-assist

Code Review

This pull request updates the mTLS configuration logic across the aio, grpc, and urllib3 transports to ensure that _is_mtls is explicitly set to False when falling back to standard connections or when custom requests cannot support mTLS. Additionally, grpc.py now utilizes mtls.has_default_client_cert_source() to determine the mTLS state. Corresponding unit tests have been added to verify these changes. I have no feedback to provide as there are no review comments to evaluate.

parthea · 2026-06-08T16:02:43Z

+ ssl_credentials = google.auth.transport.grpc.SslCredentials()
+
+ # If a workload certificate config exists on the device (and use_client_cert is true),
+ # is_mtls must be True and get_client_ssl_credentials should be invoked.
+ assert ssl_credentials.ssl_credentials is not None
+ assert ssl_credentials.is_mtls


Suggested change
ssl_credentials=google.auth.transport.grpc.SslCredentials()
# If a workload certificate config exists on the device (and use_client_cert is true),
# is_mtls must be True and get_client_ssl_credentials should be invoked.
assertssl_credentials.ssl_credentialsisnotNone
assertssl_credentials.is_mtls
ssl_credentials=google.auth.transport.grpc.SslCredentials()
# If a workload certificate config exists on the device (and use_client_cert is true),
# is_mtls must be True and get_client_ssl_credentials should be invoked.
assertssl_credentials.ssl_credentialsisnotNone
assertssl_credentials.is_mtls

nbayati

nit: Since this PR resolves existing bugs rather than introducing new features, the PR title prefix should be fix(auth) instead of feat(auth).

nbayati

Thank you for the PR! I have completed a review of the changes. Here are some comments regarding potential state leakage, resource leaks, and mismatches when configuration exceptions occur.

… issues.

nbayati

Great work Pranav! Before we merge, there are just a few minor cleanups and test coverage gaps we need to address to ensure these fixes remain robust long-term.

nbayati · 2026-06-29T18:42:44Z

- _mtls_helper.CONTEXT_AWARE_METADATA_PATH
- )
- self._is_mtls = metadata_path is not None
+ self._is_mtls = mtls.has_default_client_cert_source()


This helper ignores CLOUDSDK_CONTEXT_AWARE_CERTIFICATE_CONFIG_FILE_PATH (the context-aware fallback configuration path), so we will have a mismatch state where use_client_cert will return true but has_default_client_cert_source misses that path.
It's an existing issue with has_default_client_cert_source() though, so probably out of scope for this PR.
I'll document this so we can fix it in a future PR.

Done, I'll leave this open!

…age.

…se() raises an exception.

…s. (#17387) Resolve some mTLS transport state and gRPC workload certificate issues - Fix inconsistent `_is_mtls` flag in `urllib3` on fallback to default HTTP. - Reset `_is_mtls` to `False` in async `sessions` if a custom request handler cannot be reconfigured. - Update gRPC `SslCredentials` to recognize workload certificates by checking `has_default_client_cert_source` instead of only SecureConnect.

🤖 I have created a release *beep* *boop* --- <details><summary>db-dtypes: 1.7.1</summary> ## [1.7.1](db-dtypes-v1.7.0...db-dtypes-v1.7.1) (2026-07-07) ### Bug Fixes * avoid deprecated unitless operations for NumPy 2.5 compatibility ([#17589](#17589)) ([d0b2abc](d0b2abc)) </details> <details><summary>gapic-generator: 1.37.0</summary> ## [1.37.0](gapic-generator-v1.36.0...gapic-generator-v1.37.0) (2026-07-07) ### Features * implement native PEP 0810 lazy loading ([#17591](#17591)) ([8a1270c](8a1270c)) ### Bug Fixes * **deps:** bump google-api-core to 2.25.0 ([#17599](#17599)) ([8b359e2](8b359e2)) * **tests:** add --cov-append to gapic-generator and proto-plus to preserve monorepo coverage ([#17603](#17603)) ([2ddcf4d](2ddcf4d)) </details> <details><summary>google-auth: 2.55.2</summary> ## [2.55.2](google-auth-v2.55.1...google-auth-v2.55.2) (2026-07-07) ### Bug Fixes * **auth:** Agentic Identites mTLS gaps fix _is_mtls and SslCredentials. ([#17387](#17387)) ([7bfa41a](7bfa41a)) * **auth:** align mTLS discovery and enforce fail-fast transport configuration. ([#17470](#17470)) ([f492d3d](f492d3d)) * **auth:** handle PermissionError on workload certificates to avoid startup hang and crash ([#17568](#17568)) ([f538ad8](f538ad8)) </details> <details><summary>google-cloud-agentregistry: 0.1.0</summary> ## 0.1.0 (2026-07-07) ### Features * **google/cloud/agentregistry/v1:** add google-cloud-agentregistry ([#17565](#17565)) ([f479800](f479800)) </details> <details><summary>google-cloud-biglake-hive: 0.3.1</summary> ## [0.3.1](google-cloud-biglake-hive-v0.3.0...google-cloud-biglake-hive-v0.3.1) (2026-07-07) ### Features * update googleapis and regenerate ([#17635](#17635)) ([9638879](9638879)) </details> <details><summary>google-cloud-bigquery: 3.42.2</summary> ## [3.42.2](google-cloud-bigquery-v3.42.1...google-cloud-bigquery-v3.42.2) (2026-07-07) ### Bug Fixes * **bigquery:** avoid SSLError retry loop ([#17489](#17489)) ([8248d8e](8248d8e)) * include amended user agent in read client ([#17592](#17592)) ([c43caee](c43caee)) </details> <details><summary>google-cloud-binary-authorization: 1.18.0</summary> ## [1.18.0](google-cloud-binary-authorization-v1.17.0...google-cloud-binary-authorization-v1.18.0) (2026-07-07) ### Features * update googleapis and regenerate ([#17635](#17635)) ([9638879](9638879)) </details> <details><summary>google-cloud-chronicle: 0.6.2</summary> ## [0.6.2](google-cloud-chronicle-v0.6.1...google-cloud-chronicle-v0.6.2) (2026-07-07) ### Features * update googleapis and regenerate ([#17635](#17635)) ([9638879](9638879)) </details> <details><summary>google-cloud-dataform: 0.11.2</summary> ## [0.11.2](google-cloud-dataform-v0.11.1...google-cloud-dataform-v0.11.2) (2026-07-07) ### Features * update googleapis and regenerate ([#17635](#17635)) ([9638879](9638879)) </details> <details><summary>google-cloud-dataproc: 5.30.0</summary> ## [5.30.0](google-cloud-dataproc-v5.29.0...google-cloud-dataproc-v5.30.0) (2026-07-07) ### Features * update googleapis and regenerate ([#17635](#17635)) ([9638879](9638879)) </details> <details><summary>google-cloud-datastore: 2.26.0</summary> ## [2.26.0](google-cloud-datastore-v2.25.0...google-cloud-datastore-v2.26.0) (2026-07-07) ### Features * update googleapis and regenerate ([#17635](#17635)) ([9638879](9638879)) </details> <details><summary>google-cloud-dialogflow: 2.50.0</summary> ## [2.50.0](google-cloud-dialogflow-v2.49.0...google-cloud-dialogflow-v2.50.0) (2026-07-07) ### Features * update googleapis and regenerate ([#17635](#17635)) ([9638879](9638879)) </details> <details><summary>google-cloud-kms: 3.15.0</summary> ## [3.15.0](google-cloud-kms-v3.14.0...google-cloud-kms-v3.15.0) (2026-07-07) ### Features * update googleapis and regenerate ([#17635](#17635)) ([9638879](9638879)) </details> <details><summary>google-cloud-logging: 3.16.1</summary> ## [3.16.1](google-cloud-logging-v3.16.0...google-cloud-logging-v3.16.1) (2026-07-07) ### Documentation * **logging:** fix StructuredLogHandler docstring parameter name ([#17625](#17625)) ([32862f0](32862f0)), closes [#17604](#17604) </details> <details><summary>google-cloud-modelarmor: 0.7.1</summary> ## [0.7.1](google-cloud-modelarmor-v0.7.0...google-cloud-modelarmor-v0.7.1) (2026-07-07) ### Features * update googleapis and regenerate ([#17635](#17635)) ([9638879](9638879)) </details> <details><summary>google-cloud-network-security: 0.13.3</summary> ## [0.13.3](google-cloud-network-security-v0.13.2...google-cloud-network-security-v0.13.3) (2026-07-07) ### Features * update googleapis and regenerate ([#17635](#17635)) ([9638879](9638879)) </details> <details><summary>google-cloud-saasplatform-saasservicemgmt: 0.7.1</summary> ## [0.7.1](google-cloud-saasplatform-saasservicemgmt-v0.7.0...google-cloud-saasplatform-saasservicemgmt-v0.7.1) (2026-07-07) ### Features * update googleapis and regenerate ([#17635](#17635)) ([9638879](9638879)) </details> <details><summary>google-cloud-securesourcemanager: 0.6.1</summary> ## [0.6.1](google-cloud-securesourcemanager-v0.6.0...google-cloud-securesourcemanager-v0.6.1) (2026-07-07) ### Features * update googleapis and regenerate ([#17635](#17635)) ([9638879](9638879)) </details> <details><summary>google-cloud-storage: 3.12.1</summary> ## [3.12.1](google-cloud-storage-v3.12.0...google-cloud-storage-v3.12.1) (2026-07-07) ### Bug Fixes * **storage:** log occasional (1 in 5 million) additional bytes received from GCS in read path ([#17423](#17423)) ([335c12f](335c12f)) </details> <details><summary>google-cloud-support: 0.5.1</summary> ## [0.5.1](google-cloud-support-v0.5.0...google-cloud-support-v0.5.1) (2026-07-07) ### Features * update googleapis and regenerate ([#17635](#17635)) ([9638879](9638879)) </details> <details><summary>proto-plus: 1.28.1</summary> ## [1.28.1](proto-plus-v1.28.0...proto-plus-v1.28.1) (2026-07-07) ### Bug Fixes * **tests:** add --cov-append to gapic-generator and proto-plus to preserve monorepo coverage ([#17603](#17603)) ([2ddcf4d](2ddcf4d)) </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>

vverman requested review from a team as code owners June 6, 2026 03:56

vverman requested a review from nbayati June 6, 2026 03:56

gemini-code-assistBot reviewed Jun 6, 2026
View reviewed changes

parthea reviewed Jun 8, 2026
View reviewed changes

parthea assigned vverman Jun 8, 2026

parthea approved these changes Jun 8, 2026
View reviewed changes

nbayati reviewed Jun 16, 2026
View reviewed changes

vverman changed the title ~~feat(auth): Agentic Identites mTLS gaps fix _is_mtls and SslCredentials.~~fix(auth): Agentic Identites mTLS gaps fix _is_mtls and SslCredentials.Jun 22, 2026

vverman requested a review from nbayati June 23, 2026 01:04

vverman mentioned this pull request Jun 24, 2026
fix(auth): align mTLS discovery and enforce fail-fast transport configuration. #17470
Merged

nbayati reviewed Jun 25, 2026
View reviewed changes

vverman requested a review from nbayati June 26, 2026 04:15

nbayati requested changes Jun 26, 2026
View reviewed changes

vverman added 5 commits June 26, 2026 17:25

fix(auth): resolve mTLS transport state and gRPC workload certificate…
14deb84
… issues.

lint fixes.
c83ed69

Addressed comments.
6ad5a02

Addressed comments.
d74ff32

lint changes.
1f92e9c

vverman force-pushed the agentic-identity-fix-mtls-gaps-1 branch from 87a3463 to e8bb0b7Compare June 27, 2026 00:29

Addressed comments.
19b8120

vverman force-pushed the agentic-identity-fix-mtls-gaps-1 branch from e8bb0b7 to 19b8120Compare June 27, 2026 00:32

vverman requested a review from nbayati June 27, 2026 00:34

nbayati requested changes Jun 29, 2026
View reviewed changes

Make async mTLS configuration atomic and improve mTLS unit test cover…
be5a7aa
…age.

vverman requested a review from nbayati June 30, 2026 00:57

nbayati approved these changes Jun 30, 2026
View reviewed changes

Comment threadpackages/google-auth/google/auth/aio/transport/sessions.py Outdated

vverman added 2 commits June 30, 2026 15:26

in sessions.py, is_mtls remains true in case the old_auth_request.clo…
dab9e5b
…se() raises an exception.

lint fixes.
a9b434c

vverman force-pushed the agentic-identity-fix-mtls-gaps-1 branch from 49899cd to a9b434cCompare June 30, 2026 22:57

vverman merged commit 7bfa41a into googleapis:mainJul 1, 2026
30 checks passed

release-pleaseBot mentioned this pull request Jul 1, 2026
chore: release main #17600
Merged

-ssl_credentials=google.auth.transport.grpc.SslCredentials()
-# If a workload certificate config exists on the device (and use_client_cert is true),
-# is_mtls must be True and get_client_ssl_credentials should be invoked.
-assertssl_credentials.ssl_credentialsisnotNone
-assertssl_credentials.is_mtls
+ssl_credentials=google.auth.transport.grpc.SslCredentials()
+# If a workload certificate config exists on the device (and use_client_cert is true),
+# is_mtls must be True and get_client_ssl_credentials should be invoked.
+assertssl_credentials.ssl_credentialsisnotNone
+assertssl_credentials.is_mtls

Uh oh!

Conversation

vverman commented Jun 6, 2026

Uh oh!

gemini-code-assistBot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

partheaJun 8, 2026

Choose a reason for hiding this comment

Uh oh!

nbayati left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nbayati left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nbayati left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

nbayatiJun 29, 2026

Choose a reason for hiding this comment

Uh oh!

vvermanJun 30, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants