quota_project_id not propagated

[akonarska]

What version of gRPC-Java are you using?

24.0.0

What is your environment?

jdk17

What did you expect to see?

A call being made with header x-goog-user-project header when service account has quota_project_id set so that calls are properly counted against chosen quota.

What did you see instead?

No header set.

Steps to reproduce the bug

import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.nio.charset.StandardCharsets;

import com.google.api.gax.core.FixedCredentialsProvider;
import com.google.auth.oauth2.GoogleCredentials;
import com.google.cloud.monitoring.v3.MetricServiceClient;
import com.google.cloud.monitoring.v3.MetricServiceSettings;
import com.google.monitoring.v3.ListMetricDescriptorsRequest;

class GcpSample {
    public static void main(String[] args) throws IOException {
        // content of the service account key in json format with quota_project_id field set
        String serviceKey="[SERVICE_ACCOUNT_KEY_IN_JSON_FORMAT]"; 
        String projectId="[YOUR_PROJECT_NAME]";
        InputStream tokenStream = new ByteArrayInputStream(serviceKey.getBytes(StandardCharsets.UTF_8));
        GoogleCredentials creds = GoogleCredentials.fromStream(tokenStream);

        MetricServiceSettings.Builder builder = MetricServiceSettings.newBuilder();
        builder.setCredentialsProvider(FixedCredentialsProvider.create(creds));
        MetricServiceClient stackDriverClient = MetricServiceClient.create(builder.build());


        ListMetricDescriptorsRequest request = ListMetricDescriptorsRequest.newBuilder()
                .setName("projects/" + projectId)
                .setFilter("metric.type=\"compute.googleapis.com/instance/cpu/utilization\"")
                .build();

        stackDriverClient.listMetricDescriptors(request);
    }
}

After some debugging I found out that at some point ServiceAccountCredentials will be converted to ServiceAccountJwtAccessCredentials and it loses the quota_project_id during that conversion. Conversion is done in GoogleAuthLibraryCallCredentials#JwtHelper and the field is just not set.

[sanjaypujare]

24.0.0 does not seem right. Is it 1.24.0 by any chance? Can you try to use a newer one?

[akonarska]

@sanjaypujare We use google library-bom and I accidentally provided its version instead of grpc-java 🤦‍♀️ Sorry for the confusion! For grpc-java that would be 1.41.0

[akonarska]

I also tried it on the newest library-bom (25.4.0) that is grpc-java 1.46.0 and the problem is still there

[sanjaypujare]

Thanks. This does not seem to be a gRPC issue but an issue in one of the Google Cloud Monitoring libraries since their code receives the project-id. You probably should open the issue at https://github.com/googleapis/java-monitoring

[akonarska]

@sanjaypujare While I was trying to debug this I pinpointed it to the class I mentioned in the description and I am pretty sure that the quota_project_id never reached Cloud Monitoring code. But since you are sure that the issue is in Cloud Monitoring I will try opening an issue there.

[sanjaypujare]

...But since you are sure that the issue is in Cloud Monitoring I will try opening an issue there.

Let's see wha they find and whether they find an issue in the gRPC layer. Do you want to close this issue then?

[ejona86]

Seems like nothing more for us to do here. If not, comment, and it can be reopened.

[akonarska]

Sorry, I missed the comms. I reported this to cloud monitoring via our support contract. It can be closed.

[ejona86]

This was an issue in gRPC. Being fixed in #9438

[akonarska]

@ejona86 Could you let me know when this is released?

[ejona86]

This was released in 1.49.0.