fix(auth): defer certificate-bound ID tokens; bind access tokens only (#13873)

For the initial launch, only access tokens are certificate-bound for agent
identities. ComputeEngineCredentials.idTokenWithAudience() goes back to a
plain GET of the identity endpoint: no certificate_chain POST body, no forced
format=full, and no bound-token-specific 404 message. This matches Google
Auth Library for Python, which binds access tokens but not ID tokens.

refreshAccessToken() is unchanged and still requests bound access tokens.

Tests: the ID-token cases in ComputeEngineCredentialsTest now assert that,
with an agent identity certificate present and binding enabled, ID tokens are
requested unbound, and that a 404 produces the standard ID-token error.

Author: macastelaz

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ComputeEngineCredentials.java

@@ -494,11 +494,9 @@ public AccessToken refreshAccessToken() throws IOException {
   @Override
   public IdToken idTokenWithAudience(String targetAudience, List<IdTokenProvider.Option> options)
       throws IOException {
-    String boundTokenPayload = AgentIdentityUtils.getBoundTokenPayload();
+    // Certificate-bound ID tokens are intentionally not requested yet; only access tokens are
+    // bound for agent identities (see refreshAccessToken). ID tokens are always fetched unbound.
     GenericUrl documentUrl = new GenericUrl(getIdentityDocumentUrl());
-    if (boundTokenPayload != null) {
-      documentUrl.set("format", "full");
-    }
     if (options != null) {
       if (options.contains(IdTokenProvider.Option.FORMAT_FULL)) {
         documentUrl.set("format", "full");
@@ -511,18 +509,10 @@ public IdToken idTokenWithAudience(String targetAudience, List<IdTokenProvider.O
     }
     documentUrl.set("audience", targetAudience);
     HttpResponse response =
-        getMetadataResponseForToken(
-            documentUrl.toString(), boundTokenPayload, RequestType.ID_TOKEN_REQUEST, true);
+        getMetadataResponse(
+            documentUrl.toString(), "GET", null, RequestType.ID_TOKEN_REQUEST, true);
     int statusCode = response.getStatusCode();
     if (statusCode == HttpStatusCodes.STATUS_CODE_NOT_FOUND) {
-      if (boundTokenPayload != null) {
-        throw new IOException(
-            String.format(
-                "Error code %s trying to get bound identity token from Compute Engine metadata."
-                    + " The Compute Engine metadata server endpoint does not support bound"
-                    + " tokens.",
-                statusCode));
-      }
       throw new IOException(
           String.format(
               "Error code %s trying to get identity token from"

google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/ComputeEngineCredentialsTest.java

@@ -1360,10 +1360,12 @@ void refreshAccessToken_withValidCertAndKey_requestsBoundToken() throws IOExcept
   }
 
   @Test
-  void idTokenWithAudience_withValidCertAndKey_requestsBoundToken() throws IOException {
+  void idTokenWithAudience_withValidCertAndKey_requestsUnboundToken() throws IOException {
+    // Bound ID tokens are deferred: even with an agent identity certificate present and token
+    // binding enabled, ID tokens are requested unbound (GET, no certificate chain, no forced
+    // format=full). Access tokens are still bound (see refreshAccessToken test above).
     setupCertAndKeyConfig();
-    envProvider.setEnv(
-        AgentIdentityUtils.GOOGLE_API_ENABLE_RUNTIME_BOUND_TOKEN, "true"); // Enable bound token
+    envProvider.setEnv(AgentIdentityUtils.GOOGLE_API_ENABLE_RUNTIME_BOUND_TOKEN, "true");
     MockMetadataServerTransportFactory transportFactory = new MockMetadataServerTransportFactory();
     transportFactory.transport.setServiceAccountEmail(SA_CLIENT_EMAIL);
     transportFactory.transport.setIdToken(STANDARD_ID_TOKEN);
@@ -1374,16 +1376,10 @@ void idTokenWithAudience_withValidCertAndKey_requestsBoundToken() throws IOExcep
 
     assertNotNull(token);
     MockLowLevelHttpRequest request = transportFactory.transport.getRequest();
-    assertEquals("POST", transportFactory.transport.getRequestMethod());
-    assertEquals("application/json", request.getContentType());
+    assertEquals("GET", transportFactory.transport.getRequestMethod());
     assertTrue(request.getUrl().contains("audience=https://foo.bar"));
-    assertTrue(request.getUrl().contains("format=full"));
-    String body = request.getContentAsString();
-    GenericJson bodyJson = OAuth2Utils.JSON_FACTORY.fromString(body, GenericJson.class);
-    String expectedCert =
-        new String(Files.readAllBytes(tempDir.resolve("certificates.pem")), StandardCharsets.UTF_8)
-            .trim();
-    assertEquals(expectedCert, ((String) bodyJson.get("certificate_chain")).trim());
+    assertFalse(request.getUrl().contains("format=full"));
+    assertNull(request.getStreamingContent());
   }
 
   @Test
@@ -1401,8 +1397,7 @@ void refreshAccessToken_boundToken404_throwsEndpointDoesNotSupportBoundTokensMes
   }
 
   @Test
-  void idTokenWithAudience_boundToken404_throwsEndpointDoesNotSupportBoundTokensMessage()
-      throws IOException {
+  void idTokenWithAudience_withValidCertAndKey404_throwsUnboundIdTokenMessage() throws IOException {
     setupCertAndKeyConfig();
     envProvider.setEnv(AgentIdentityUtils.GOOGLE_API_ENABLE_RUNTIME_BOUND_TOKEN, "true");
     MockMetadataServerTransportFactory transportFactory = new MockMetadataServerTransportFactory();
@@ -1413,7 +1408,8 @@ void idTokenWithAudience_boundToken404_throwsEndpointDoesNotSupportBoundTokensMe
     IOException e =
         assertThrows(
             IOException.class, () -> credentials.idTokenWithAudience("https://foo.bar", null));
-    assertTrue(e.getMessage().contains("does not support bound tokens"));
+    assertTrue(e.getMessage().contains("trying to get identity token"));
+    assertFalse(e.getMessage().contains("bound"));
   }
 
   static class MockMetadataServerTransportFactory implements HttpTransportFactory {