credentials: allow audience to be configured (#8421)

[chrisstaite-menlo]

Fixes: #8421
There are competing specifications around whether a method should be included in a JWT audience or not. For example #4713 specifically excluded the method referencing https://google.aip.dev/auth/4111 whereas GCE IAP requires the full URI https://cloud.google.com/iap/docs/authentication-howto.

In order to facilitate both methods, we introduce a new environment variable, namely GRPC_AUDIENCE_IS_FULL_PATH, to allow the method stripping to be disabled. This defaults to the existing behaviour of stripping the method, but can be set to avoid this.

RELEASE NOTES:

• credentials: Add support to disable gRPC method name stripping for JWT audience calculation when the environment variable GRPC_AUDIENCE_IS_FULL_PATH is set to true.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: chrisstaite-menlo / name: Chris Staite (97573c5)

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 82.31%. Comparing base (af2600d) to head (97573c5).
Report is 1 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #8442      +/-   ##
==========================================
+ Coverage   82.27%   82.31%   +0.04%     
==========================================
  Files         414      414              
  Lines       40422    40425       +3     
==========================================
+ Hits        33257    33277      +20     
+ Misses       5799     5780      -19     
- Partials     1366     1368       +2     

Files with missing lines	Coverage Δ
internal/envconfig/envconfig.go	100.00% <ø> (ø)
internal/transport/http2_client.go	92.14% <100.00%> (+0.01%)	⬆️

... and 18 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[eshitachandwani]

This can be changed to use the testutil function to set and unset the environment config.
testutils.SetEnvConfig(t, &envconfig.AudienceIsFullPath, true)
This will set to true and reset to original value in the end.

[chrisstaite-menlo]

Nice :)

[eshitachandwani]

Please add release notes.

[chrisstaite-menlo]

@eshitachandwani I'm sorry, I'm not sure what you mean by release notes, I don't see any in the repository. I have updated the documentation around the environment variable however.

Oh, I think I see... it should be set in the PR description.

I'm confused, I edited the PR description and the validation is still failing. Are you able to help me figure out where I've gone wrong please?

Final edit: figured it out, I had a space before the *, reading the RegExp helped.

[eshitachandwani]

LGTM , adding @gtcooke94 to review.

[gtcooke94]

Thanks for the PR! Just a few small things

[gtcooke94]

LGTM - by the way, the commits will automatically be squashed into 1 when the PR is merged, so you don't need to worry about squashing and force-pushing a single commit each update

Thanks for the PR!

[chrisstaite-menlo]

Thanks, a lot of those were to force a re-build because the arm64 tests seem super flaky.

[eshitachandwani]

Reverting this PR to allow for broader cross-language discussion prior to making a decision on incorporating this feature.

[chrisstaite-menlo]

That's rather frustrating... this has a severe effect on our ability to use Google Cloud due to its implementation of IAP.