feat(auth): [aiohttp] Add mTLS reconfiguration logic when certificate mismatch for existing credentials & Agent Identity workloads by agrawalradhika-cell · Pull Request #18224 · googleapis/google-cloud-python

agrawalradhika-cell · 2026-08-26T04:00:38Z

feat: [aiohttp] Add mTLS reconfiguration logic when certificate mismatch for existing credentials & Agent Identity workloads

Changes included:

Adds mTLS reconfiguration logic when a certificate mismatch occurs.
Aligns async session behavior with the synchronous session by triggering a credential refresh and request retry on all 401 Unauthorized responses (not just mTLS).

Make sure to open an issue as a bug/issue before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea
Ensure the tests and linter pass
Code coverage does not decrease (if any source code was changed)
Appropriate docs were updated (if necessary)

Fixes #18227 #18227 🦕

feat: Add retry for cert rotation handling

gemini-code-assist

Code Review

This pull request introduces client certificate rotation handling for asynchronous authorized sessions when encountering an unauthorized response under mTLS. The review feedback highlights a violation of the repository style guide regarding exception contract compliance, suggesting that the certificate parameter check should be wrapped in a try-except block to gracefully fall back to the original response rather than crashing. Additionally, the feedback recommends updating the corresponding unit tests to assert this resilient fallback behavior.

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

Handle exceptions during mTLS reconfiguration with warnings instead of errors.

…logs Updated test logic to assert response instead of expecting an error.

…sync executor Refactor unauthorized response handling to use async executor for MTLS parameter checks.

chore: Reset mTLS init task upon client certificate change

Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>

…eck after 401 check chore: Refactor mTLS channel reconfiguration logic for adding mTLS check after 401 check

Implement mTLS rotation lock to prevent race conditions during certificate reconfiguration.

chore: Change warning to error log for mTLS channel reconfiguration failure.

chore: Refactor mTLS handling for unauthorized responses

Remove unnecessary continue statement after mTLS configuration.

Refactor tests for certificate rotation and error handling in AsyncAuthorizedSession. Update test names for clarity and ensure proper logging of errors.

Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>

Handle RefreshError during credential refresh to prevent unhandled exceptions.

Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>

chore: Reorder response closing logic for clarity

chore: Handle additional exception during credential refresh

chore: Refactor mTLS channel configuration callback

fix: Refactor type annotations and error handling

Change exception type in test for MTLS session

Refactor mTLS handling and improve timeout logic

Add a counter to track mTLS configuration checks and prevent redundant operations.

Add test for certificate rotation lock contention without cert change.

fix: Refactor mTLS configuration and error handling

fix: Fix indentation for asyncio test decorator

Added a delay in mock_check to ensure lock contention during asyncio.gather tasks. Adjusted assertions to verify behavior when non-mtls URL is used.

Remove assignment of stale_cert when is_mtls_endpoint is true.

Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>

agrawalradhika-cell · 2026-09-01T16:49:46Z

The Kokoro System Tests failure is unrelated to the code change - https://btx.cloud.google.com/invocations/61f25d3a-d504-4b68-a0b8-38871927bd46/targets/cloud-devrel%2Fclient-libraries%2Fpython%2Fgoogleapis%2Fgoogle-cloud-python%2Fpresubmit%2Fsystem;config=default/log

nolanleastin

LGTM

agrawalradhika-cell added 2 commits August 25, 2026 20:56

feat: Add retry for cert rotation handling

94a1d95

feat: Add retry for cert rotation handling

chore: Add tests for MTLS certificate rotation behavior

420447c

agrawalradhika-cell requested review from a team as code owners August 26, 2026 04:00

gemini-code-assist Bot reviewed Aug 26, 2026

View reviewed changes

Comment thread packages/google-auth/google/auth/aio/transport/sessions.py Outdated

Comment thread packages/google-auth/tests/transport/aio/test_sessions_mtls.py Outdated

agrawalradhika-cell changed the title ~~feat: [aiohttp] Add reconfiguration logic when certificate mismatch for existing credentials & Agent Identity workloads~~ feat: [aiohttp] Add mTLS reconfiguration logic when certificate mismatch for existing credentials & Agent Identity workloads Aug 26, 2026

agrawalradhika-cell and others added 2 commits August 26, 2026 10:34

Update packages/google-auth/tests/transport/aio/test_sessions_mtls.py

907cf00

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

Improve error handling for mTLS reconfiguration

cc850b1

Handle exceptions during mTLS reconfiguration with warnings instead of errors.

parthea assigned agrawalradhika-cell Aug 26, 2026

agrawalradhika-cell added 4 commits August 26, 2026 11:19

fix: Rename test_cert_rotation_failure to test_cert_rotation_failure_…

a44acb0

…logs Updated test logic to assert response instead of expecting an error.

chore: Refactor MTLS parameter check on unauthorized response o use a…

984e47c

…sync executor Refactor unauthorized response handling to use async executor for MTLS parameter checks.

chore: Reset mTLS init task upon client certificate change

30341bc

chore: Reset mTLS init task upon client certificate change

fix: fix the lint errors

1c068dc

Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>

nbayati reviewed Aug 27, 2026

View reviewed changes

agrawalradhika-cell added 11 commits August 27, 2026 13:00

chore: Refactor mTLS channel reconfiguration logic for adding mTLS ch…

6fb1e86

…eck after 401 check chore: Refactor mTLS channel reconfiguration logic for adding mTLS check after 401 check

chore: Add mTLS rotation lock for certificate management

2cdfe2d

Implement mTLS rotation lock to prevent race conditions during certificate reconfiguration.

chore: Log mTLS channel reconfiguration failure as error

d734731

chore: Change warning to error log for mTLS channel reconfiguration failure.

chore: Refactor mTLS handling for unauthorized responses

97e91d0

chore: Refactor mTLS handling for unauthorized responses

fix: Remove unnecessary continue statement after mTLS configuration.

d0da58b

Remove unnecessary continue statement after mTLS configuration.

fix: Fix cert rotation tests and improve error handling

825426d

Refactor tests for certificate rotation and error handling in AsyncAuthorizedSession. Update test names for clarity and ensure proper logging of errors.

fix: fix unit tests for the checks

63e587c

Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>

fix: Fix unit tests for the change

71b3bf5

Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>

test: remove fragile async caplog assertions

7d92d30

fix: Add error handling for credential refresh failures

8b2efcf

Handle RefreshError during credential refresh to prevent unhandled exceptions.

fix: Fix lint errors

a4d0405

Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>

lsirac requested changes Aug 29, 2026

View reviewed changes

lsirac reviewed Aug 29, 2026

View reviewed changes

agrawalradhika-cell added 3 commits August 29, 2026 20:51

chore: Refactor mTLS endpoint handling in sessions.py

2d52a21

chore: Reorder response closing logic for clarity

2806f4f

chore: Reorder response closing logic for clarity

chore: Handle additional exception during credential refresh

d5426f2

chore: Handle additional exception during credential refresh

agrawalradhika-cell added 3 commits August 31, 2026 12:23

chore: Refactor mTLS channel configuration callback

eb28f81

chore: Refactor mTLS channel configuration callback

fix: Import urllib.parse instead of urllib

221810e

fix: Format mTLS channel configuration for readability

445c576

agrawalradhika-cell requested a review from nolanleastin August 31, 2026 20:35

nolanleastin reviewed Aug 31, 2026

View reviewed changes

fix: Fix test name for mTLS certificate matching

6b0edd3

daniel-sanche changed the title ~~feat: [aiohttp] Add mTLS reconfiguration logic when certificate mismatch for existing credentials & Agent Identity workloads~~ feat(auth): Add mTLS reconfiguration logic when certificate mismatch for existing credentials & Agent Identity workloads Aug 31, 2026

fix: Refactor type annotations and error handling

b6e30b0

fix: Refactor type annotations and error handling

agrawalradhika-cell requested a review from nolanleastin August 31, 2026 22:18

agrawalradhika-cell added 3 commits August 31, 2026 15:42

chore: Change exception type in test for MTLS session

7c32ec9

Change exception type in test for MTLS session

Fix duplicate isinstance check for data type

f98c347

fix: Format error message for MutualTLSChannelError

c97bfdf

lsirac requested changes Sep 1, 2026

View reviewed changes

agrawalradhika-cell added 9 commits August 31, 2026 19:01

chore: Refactor mTLS handling and improve timeout logic

2790119

Refactor mTLS handling and improve timeout logic

chore: Implement mTLS check counter for configuration management

498bcd6

Add a counter to track mTLS configuration checks and prevent redundant operations.

fix: Implement test for cert rotation lock contention

242359a

Add test for certificate rotation lock contention without cert change.

fix: Refactor mTLS configuration and error handling

8c867af

fix: Refactor mTLS configuration and error handling

fix: Fix indentation for asyncio test decorator

8942a12

fix: Fix indentation for asyncio test decorator

fix: Enhance tests for MTLS session certificate rotation

eb95f3c

Added a delay in mock_check to ensure lock contention during asyncio.gather tasks. Adjusted assertions to verify behavior when non-mtls URL is used.

fix: Remove stale_cert assignment in sessions.py

50ba485

Remove assignment of stale_cert when is_mtls_endpoint is true.

fix: Update sessions.py for lint

0e8950f

fix: fix lint errors in sessions.py

bc8bebb

Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>

agrawalradhika-cell requested a review from lsirac September 1, 2026 16:31

agrawalradhika-cell added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Sep 1, 2026

yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Sep 1, 2026

nolanleastin reviewed Sep 1, 2026

View reviewed changes

Comment thread packages/google-auth/google/auth/aio/transport/sessions.py Outdated

Comment thread packages/google-auth/google/auth/aio/transport/sessions.py Outdated

Rename MTLS_URL_PREFIXES to _MTLS_URL_PREFIXES and typecasting fix

2b57c11

agrawalradhika-cell requested a review from nolanleastin September 1, 2026 21:07

Uh oh!

Conversation

agrawalradhika-cell commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

agrawalradhika-cell commented Sep 1, 2026

Uh oh!

nolanleastin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

agrawalradhika-cell commented Aug 26, 2026 •

edited

Loading