fix: disable RAB lookup for Domain-Wide Delegation#17763
Conversation
Updates credentials classes to skip building the Regional Access Boundary lookup URL when Domain-Wide Delegation (DWD) is active, as RAB does not apply to Workspace User Accounts via DWD.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request aims to bypass Regional Access Boundary (RAB) lookup when a subject is populated for Domain-wide Delegation across several credential classes. However, the reviewer pointed out that ImpersonatedCredentials does not support Domain-Wide Delegation or possess a _subject attribute, which will result in a runtime AttributeError. Consequently, the check in impersonated_credentials.py and its corresponding unit test should be removed.
| if self._subject: | ||
| # RAB does not apply to Workspace User Accounts via Domain-wide Delegation. | ||
| return None | ||
|
|
There was a problem hiding this comment.
Accessing self._subject on ImpersonatedCredentials will raise an AttributeError at runtime because _subject is not an attribute of this class. Furthermore, Domain-Wide Delegation (DWD) is not supported or applicable for impersonated credentials, so this check is unnecessary and should be removed.
| def test_build_regional_access_boundary_lookup_url_with_subject(self): | ||
| credentials = self.make_credentials(subject="user@example.com") | ||
| assert credentials._build_regional_access_boundary_lookup_url() is None | ||
|
|
There was a problem hiding this comment.
Since ImpersonatedCredentials does not support Domain-Wide Delegation or have a _subject attribute, this test is testing an invalid scenario and should be removed.
1 participant
Updates credentials classes to skip building the Regional Access Boundary lookup URL when Domain-Wide Delegation (DWD) is active, as RAB does not apply to Workspace User Accounts via DWD.
Fixes #17703