Browse the repository at this point in the history

Browse the repository at this point in the history

… the MWID/X.509 cert sources detected (#1848)

The Python SDK will use a hybrid approach for mTLS enablement:

- If the GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable is set
(either true or false), the SDK will respect that setting. This is
necessary for test scenarios and users who need to explicitly control
mTLS behavior.
- If the GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable is not
set, the SDK will automatically enable mTLS only if it detects Managed
Workload Identity (MWID) or X.509 Workforce Identity Federation (WIF)
certificate sources. In other cases where the variable is not set, mTLS
will remain disabled.

** This change also adds the helper method `check_use_client_cert` and
it's unit test, which will be used for checking the criteria for setting
the mTLS to true
** This change is only for Auth-Library, other changes will be created
for Client-Library use-cases.

---------

Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>
Co-authored-by: Daniel Sanche <d.sanche14@gmail.com>

Browse the repository at this point in the history

Browse the repository at this point in the history

… enables mTLS if GOOGLE_API_USE_CLIENT_CERTIFICATE is not set, when the MWID/X.509 cert sources detected (#1859)

Add public wrapper for check_use_client_cert which enables mTLS if
GOOGLE_API_USE_CLIENT_CERTIFICATE is not set, when the MWID/X.509 cert
sources detected. Also, fix check_use_client_cert to return boolean
value.

Change #1848 added the check_use_client_cert method that helps know if
client cert should be used for mTLS connection. However, that was in a
private class, thus, created a public wrapper of the same function so
that it can be used by python Client Libraries. Also, updated
check_use_client_cert to return a boolean value instead of existing
string value for better readability and future scope.

---------

Signed-off-by: Radhika Agrawal <agrawalradhika@google.com>
Co-authored-by: Daniel Sanche <d.sanche14@gmail.com>

Browse the repository at this point in the history

Browse the repository at this point in the history

Librarian Version: v0.5.0
Language Image:
us-central1-docker.pkg.dev/cloud-sdk-librarian-prod/images-prod/python-librarian-generator:latest
<details><summary>google-auth: 2.43.0</summary>

##
[2.43.0](v2.42.1...v2.43.0)
(2025-11-05)

### Features

* Add public wrapper for _mtls_helper.check_use_client_cert which
enables mTLS if GOOGLE_API_USE_CLIENT_CERTIFICATE is not set, when the
MWID/X.509 cert sources detected (#1859)
([1535ecc](1535eccb))

* Enable mTLS if GOOGLE_API_USE_CLIENT_CERTIFICATE is not set, if the
MWID/X.509 cert sources detected (#1848)
([395e405](395e405b))

* onboard `google-auth` to librarian (#1838)
([c503eaa](c503eaa5))

</details>

Browse the repository at this point in the history