From 24e20c6be16f6c20175de55447bed3074006fb50 Mon Sep 17 00:00:00 2001 From: Matt Castelaz Date: Fri, 30 Oct 2026 13:33:34 +0000 Subject: [PATCH 1/2] fix(auth): strip -fips suffix from AWS service name in SigV4 signer --- .../google/auth/oauth2/AwsRequestSigner.java | 4 ++- .../auth/oauth2/AwsRequestSignerTest.java | 32 +++++++++++++++++++ 2 files changed, 35 insertions(+), 1 deletion(-) diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsRequestSigner.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsRequestSigner.java index cd20a06dba76..214cd22edfc4 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsRequestSigner.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsRequestSigner.java @@ -118,7 +118,9 @@ private AwsRequestSigner( */ AwsRequestSignature sign() { // Retrieve the service name. For example: iam.amazonaws.com host => iam service. - String serviceName = Splitter.on(".").split(uri.getHost()).iterator().next(); + // sts-fips.us-east-2.amazonaws.com host => sts service. + String serviceName = + Splitter.on(".").split(uri.getHost()).iterator().next().replaceAll("-fips$", ""); Map canonicalHeaders = getCanonicalHeaders(dates.getOriginalDate()); // Headers must be sorted. diff --git a/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/AwsRequestSignerTest.java b/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/AwsRequestSignerTest.java index 750390aeaec2..084994082b41 100644 --- a/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/AwsRequestSignerTest.java +++ b/google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/AwsRequestSignerTest.java @@ -491,6 +491,38 @@ void sign_postGetCallerIdentity() { assertEquals(URI.create(url).normalize().toString(), signature.getUrl()); } + @Test + void sign_postGetCallerIdentityFips() { + String url = + "https://sts-fips.us-east-2.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15"; + + Map additionalHeaders = new HashMap<>(); + additionalHeaders.put("x-amz-date", X_AMZ_DATE); + + AwsRequestSigner signer = + AwsRequestSigner.newBuilder(awsSecurityCredentials, "POST", url, "us-east-2") + .setAdditionalHeaders(additionalHeaders) + .build(); + + AwsRequestSignature signature = signer.sign(); + + String expectedSignature = "dc64d2d5b33786e97de10de5a82428f1e79cbc69d6ec3d450780f29b20eaa43f"; + String expectedAuthHeader = + "AWS4-HMAC-SHA256 Credential=" + + awsSecurityCredentials.getAccessKeyId() + + "/20200811/us-east-2/sts/" + + "aws4_request, SignedHeaders=host;x-amz-date;x-amz-security-token, Signature=" + + expectedSignature; + + assertEquals(expectedSignature, signature.getSignature()); + assertEquals(expectedAuthHeader, signature.getAuthorizationHeader()); + assertEquals(awsSecurityCredentials, signature.getSecurityCredentials()); + assertEquals(X_AMZ_DATE, signature.getDate()); + assertEquals("POST", signature.getHttpMethod()); + assertEquals("us-east-2", signature.getRegion()); + assertEquals(URI.create(url).normalize().toString(), signature.getUrl()); + } + @Test void sign_postGetCallerIdentityNoToken() { String url = "https://sts.us-east-2.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15"; From 5efb748da9df2b98a0b7ad21f52044443a28a924 Mon Sep 17 00:00:00 2001 From: Matt Castelaz Date: Fri, 30 Oct 2026 14:47:58 +0000 Subject: [PATCH 2/2] refactor(auth): use endsWith and substring instead of replaceAll regex --- .../java/com/google/auth/oauth2/AwsRequestSigner.java | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsRequestSigner.java b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsRequestSigner.java index 214cd22edfc4..2f58bc795f84 100644 --- a/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsRequestSigner.java +++ b/google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AwsRequestSigner.java @@ -119,8 +119,11 @@ private AwsRequestSigner( AwsRequestSignature sign() { // Retrieve the service name. For example: iam.amazonaws.com host => iam service. // sts-fips.us-east-2.amazonaws.com host => sts service. + String firstSegment = Splitter.on(".").split(uri.getHost()).iterator().next(); String serviceName = - Splitter.on(".").split(uri.getHost()).iterator().next().replaceAll("-fips$", ""); + firstSegment.endsWith("-fips") + ? firstSegment.substring(0, firstSegment.length() - 5) + : firstSegment; Map canonicalHeaders = getCanonicalHeaders(dates.getOriginalDate()); // Headers must be sorted.