feat: Enable mTLS if GOOGLE_API_USE_CLIENT_CERTIFICATE is not set, if the MWID/X.509 cert sources detected #1848

agrawalradhika-cell · 2025-10-27T23:55:19Z

The Python SDK will use a hybrid approach for mTLS enablement:

If the GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable is set (either true or false), the SDK will respect that setting. This is necessary for test scenarios and users who need to explicitly control mTLS behavior.
If the GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable is not set, the SDK will automatically enable mTLS only if it detects Managed Workload Identity (MWID) or X.509 Workforce Identity Federation (WIF) certificate sources. In other cases where the variable is not set, mTLS will remain disabled.

** This change also adds the helper method check_use_client_cert and it's unit test, which will be used for checking the criteria for setting the mTLS to true
** This change is only for Auth-Library, other changes will be created for Client-Library use-cases.

google/auth/transport/_mtls_helper.py

google/auth/transport/grpc.py

google/auth/transport/_mtls_helper.py

tests/transport/test__mtls_helper.py

…f not set, if the MWID/X.509 cert sources detected Signed-off-by: Radhika Agrawal <[email protected]>

Signed-off-by: Radhika Agrawal <[email protected]>

…or updates to docsting and indentation Signed-off-by: Radhika Agrawal <[email protected]>

…he json and return the exact value set by user, and not handling the case when user is setting value to an unsupported value Signed-off-by: Radhika Agrawal <[email protected]>

Signed-off-by: Radhika Agrawal <[email protected]>

…thod to catch exceptions and update docstring Signed-off-by: Radhika Agrawal <[email protected]>

google/auth/transport/_mtls_helper.py

andyrzhao

LGTM overall. Please address other reviewer's comments. Thanks!

Signed-off-by: Radhika Agrawal <[email protected]>

andyrzhao

LGTM. Thanks!

daniel-sanche

Left a couple suggestions to consider, but LGTM

google/auth/transport/_mtls_helper.py

Signed-off-by: Radhika Agrawal <[email protected]>

agrawalradhika-cell · 2025-11-03T22:34:23Z

google/auth/transport/_mtls_helper.py

    return crypto.dump_privatekey(crypto.FILETYPE_PEM, pkey)
+
+
+def check_use_client_cert():


Please note: That here the function is emitting str instead of boolean because we want to also consider the value set by user for GOOGLE_API_USE_CLIENT_CERTIFICATE

… enables mTLS if GOOGLE_API_USE_CLIENT_CERTIFICATE is not set, when the MWID/X.509 cert sources detected (#1859) Add public wrapper for check_use_client_cert which enables mTLS if GOOGLE_API_USE_CLIENT_CERTIFICATE is not set, when the MWID/X.509 cert sources detected. Also, fix check_use_client_cert to return boolean value. Change #1848 added the check_use_client_cert method that helps know if client cert should be used for mTLS connection. However, that was in a private class, thus, created a public wrapper of the same function so that it can be used by python Client Libraries. Also, updated check_use_client_cert to return a boolean value instead of existing string value for better readability and future scope. --------- Signed-off-by: Radhika Agrawal <[email protected]> Co-authored-by: Daniel Sanche <[email protected]>

Librarian Version: v0.5.0 Language Image: us-central1-docker.pkg.dev/cloud-sdk-librarian-prod/images-prod/python-librarian-generator:latest <details><summary>google-auth: 2.43.0</summary> ## [2.43.0](v2.42.1...v2.43.0) (2025-11-05) ### Features * Add public wrapper for _mtls_helper.check_use_client_cert which enables mTLS if GOOGLE_API_USE_CLIENT_CERTIFICATE is not set, when the MWID/X.509 cert sources detected (#1859) ([1535ecc](1535eccb)) * Enable mTLS if GOOGLE_API_USE_CLIENT_CERTIFICATE is not set, if the MWID/X.509 cert sources detected (#1848) ([395e405](395e405b)) * onboard `google-auth` to librarian (#1838) ([c503eaa](c503eaa5)) </details>

agrawalradhika-cell force-pushed the mtls-flag-update-true branch from 84bf5ac to b13eb7a Compare October 27, 2025 23:56

agrawalradhika-cell marked this pull request as ready for review October 27, 2025 23:56

agrawalradhika-cell requested review from a team as code owners October 27, 2025 23:56

agrawalradhika-cell changed the title ~~feat: Autoupdate the GOOGLE_API_USE_CLIENT_CERTIFICATE flag to true if not set, if the MWID/X.509 cert sources detected~~ feat: Enable mTLS if GOOGLE_API_USE_CLIENT_CERTIFICATE is not set, if the MWID/X.509 cert sources detected Oct 28, 2025

sai-sunder-s previously approved these changes Oct 28, 2025

View reviewed changes

google/auth/transport/_mtls_helper.py Outdated Show resolved Hide resolved

daniel-sanche requested changes Oct 29, 2025

View reviewed changes

daniel-sanche reviewed Oct 29, 2025

View reviewed changes

google/auth/transport/_mtls_helper.py Outdated Show resolved Hide resolved

agrawalradhika-cell dismissed sai-sunder-s’s stale review via 855173c October 30, 2025 16:01

agrawalradhika-cell requested review from andyrzhao and daniel-sanche October 30, 2025 17:50

nbayati self-requested a review October 30, 2025 18:07

agrawalradhika-cell requested a review from sai-sunder-s October 31, 2025 17:18

sai-sunder-s previously approved these changes Oct 31, 2025

View reviewed changes

nbayati requested changes Oct 31, 2025

View reviewed changes

nbayati added the kokoro:run Add this label to force Kokoro to re-run the tests. label Nov 1, 2025

yoshi-kokoro removed the kokoro:run Add this label to force Kokoro to re-run the tests. label Nov 1, 2025

agrawalradhika-cell dismissed sai-sunder-s’s stale review via 902d039 November 3, 2025 16:32

agrawalradhika-cell requested a review from nbayati November 3, 2025 16:34

agrawalradhika-cell added 9 commits November 3, 2025 08:35

feat: Autoupdate the GOOGLE_API_USE_CLIENT_CERTIFICATE flag to true i…

3c09d57

…f not set, if the MWID/X.509 cert sources detected Signed-off-by: Radhika Agrawal <[email protected]>

feat: Update the helper for use_client_cert and add support for grpc.py

de40fef

Signed-off-by: Radhika Agrawal <[email protected]>

fix: Minor typo in grpc.py

798a0f5

Signed-off-by: Radhika Agrawal <[email protected]>

chore: Use json.load to read the config, instead of file.read and min…

6781100

…or updates to docsting and indentation Signed-off-by: Radhika Agrawal <[email protected]>

feat: Update the check_use_client_cert helper method to make use of t…

c33c192

…he json and return the exact value set by user, and not handling the case when user is setting value to an unsupported value Signed-off-by: Radhika Agrawal <[email protected]>

ore: Update the docstring to remove mention of ValueError exception

30d75d1

Signed-off-by: Radhika Agrawal <[email protected]>

fix: fix an indentation in helper method

18fc66c

Signed-off-by: Radhika Agrawal <[email protected]>

fix: As both conditions are checked, added falsy check

a06bcb1

Signed-off-by: Radhika Agrawal <[email protected]>

fix: Use monkeypatch in test to update env variable, update helper me…

09b6a1e

…thod to catch exceptions and update docstring Signed-off-by: Radhika Agrawal <[email protected]>

agrawalradhika-cell force-pushed the mtls-flag-update-true branch from 902d039 to 09b6a1e Compare November 3, 2025 16:35

nbayati added the kokoro:run Add this label to force Kokoro to re-run the tests. label Nov 3, 2025

daniel-sanche reviewed Nov 3, 2025

View reviewed changes

google/auth/transport/_mtls_helper.py Outdated Show resolved Hide resolved

google/auth/transport/_mtls_helper.py Show resolved Hide resolved

andyrzhao previously approved these changes Nov 3, 2025

View reviewed changes

fix: Update the dosctring and refine the try-catch blocks

2a0a71a

Signed-off-by: Radhika Agrawal <[email protected]>

agrawalradhika-cell dismissed andyrzhao’s stale review via 2a0a71a November 3, 2025 20:14

andyrzhao self-requested a review November 3, 2025 20:32

andyrzhao previously approved these changes Nov 3, 2025

View reviewed changes

andyrzhao added the kokoro:run Add this label to force Kokoro to re-run the tests. label Nov 3, 2025

yoshi-kokoro removed the kokoro:run Add this label to force Kokoro to re-run the tests. label Nov 3, 2025

agrawalradhika-cell requested review from daniel-sanche and sai-sunder-s November 3, 2025 20:35

daniel-sanche previously approved these changes Nov 3, 2025

View reviewed changes

google/auth/transport/_mtls_helper.py Outdated Show resolved Hide resolved

google/auth/transport/_mtls_helper.py Outdated Show resolved Hide resolved

google/auth/transport/_mtls_helper.py Outdated Show resolved Hide resolved

fix: docstring update and remove unsed imports

63e678f

Signed-off-by: Radhika Agrawal <[email protected]>

agrawalradhika-cell dismissed stale reviews from daniel-sanche and andyrzhao via 63e678f November 3, 2025 22:29

nbayati added the kokoro:run Add this label to force Kokoro to re-run the tests. label Nov 3, 2025

yoshi-kokoro removed the kokoro:run Add this label to force Kokoro to re-run the tests. label Nov 3, 2025

agrawalradhika-cell commented Nov 3, 2025

View reviewed changes

nbayati approved these changes Nov 3, 2025

View reviewed changes

daniel-sanche approved these changes Nov 3, 2025

View reviewed changes

sai-sunder-s approved these changes Nov 3, 2025

View reviewed changes

Merge branch 'main' into mtls-flag-update-true

e5e3afe

nbayati added the kokoro:run Add this label to force Kokoro to re-run the tests. label Nov 4, 2025

yoshi-kokoro removed the kokoro:run Add this label to force Kokoro to re-run the tests. label Nov 4, 2025

nbayati enabled auto-merge (squash) November 4, 2025 00:26

nbayati merged commit 395e405 into googleapis:main Nov 4, 2025
12 checks passed

agrawalradhika-cell mentioned this pull request Nov 4, 2025

feat: Add public wrapper for _mtls_helper.check_use_client_cert which enables mTLS if GOOGLE_API_USE_CLIENT_CERTIFICATE is not set, when the MWID/X.509 cert sources detected #1859

Merged

This was referenced Nov 5, 2025

chore: librarian release pull request: 20251105T223742Z #1861

Closed

chore: librarian release pull request: 20251105T230735Z #1863

Merged

		return crypto.dump_privatekey(crypto.FILETYPE_PEM, pkey)


		def check_use_client_cert():

feat: Enable mTLS if GOOGLE_API_USE_CLIENT_CERTIFICATE is not set, if the MWID/X.509 cert sources detected #1848

feat: Enable mTLS if GOOGLE_API_USE_CLIENT_CERTIFICATE is not set, if the MWID/X.509 cert sources detected #1848

Uh oh!

Conversation

agrawalradhika-cell commented Oct 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

andyrzhao left a comment

Choose a reason for hiding this comment

Uh oh!

andyrzhao left a comment

Choose a reason for hiding this comment

Uh oh!

daniel-sanche left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

agrawalradhika-cell Nov 3, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

agrawalradhika-cell commented Oct 27, 2025 •

edited

Loading