feat(spanner): implement OPAQUE login authentication for Spanner Omni (#20085)

### ⚠️ Note to Reviewers:

> Of the ~3k lines changed in this PR, approximately ~1.3k lines are
auto-generated protobuf classes. Specifically, the files
`spanner/omni/authentication.pb.go` and `spanner/omni/login.pb.go`
account for the vast majority of the diff.
> The actual hand-written logic is small and contained within the core
auth implementation and connection classes. This PR introduces native
authentication support for Spanner Omni endpoints using the OPAQUE
password-authenticated key exchange protocol.

**Key Changes:**
* **Omni Login Protocol:** Added generated protobufs
(`omni/authentication.pb.go`, `omni/login.pb.go`) to handle the
authentication handshake with Omni endpoints.
* **OPAQUE Protocol Support**: Implemented
[userAuthenticator](file:///usr/local/google/home/sagnikghosh/Documents/go/google-cloud-go/spanner/omni/opaque.go)
to handle the secure OPAQUE cryptographic login flow, using timing-safe
`crypto/subtle` checks for MAC and auth tag verification.
* **omniTokenSource**: Added a new
[omniTokenSource](file:///usr/local/google/home/sagnikghosh/Documents/go/google-cloud-go/spanner/omni/connection.go)
(`oauth2.TokenSource` implementation) to dial Omni endpoints, perform
authentication handshakes, and cache the returned OAuth2 token payload.
* **Client Integration:** Updated
[ClientConfig](file:///usr/local/google/home/sagnikghosh/Documents/go/google-cloud-go/spanner/client.go)
and
[OmniClientConfig](file:///usr/local/google/home/sagnikghosh/Documents/go/google-cloud-go/spanner/admin/database/apiv1/omni_client.go)
to accept `Username` and `Password` credentials, automatically injecting
the `omniTokenSource` as a client option.

To run Integration Tests with auth login, run:
```bash
go test -v -parallel 1 -run ^TestIntegration_ . -args \
  -it.omni-endpoint="localhost:15000" \ 
  -it.omni-ca-cert="/path/to/ca.crt" \
  -it.omni-username="admin" \
  -it.omni-password="admin"
```

Author: sagnghos

spanner/admin/database/apiv1/omni_client.go

@@ -35,6 +35,8 @@ type OmniClientConfig interface {
 	GetCaCertificateFile() string
 	GetClientCertificateFile() string
 	GetClientKeyFile() string
+	GetUsername() string
+	GetPassword() []byte
 }
 
 // NewDatabaseAdminClientWithConfig creates a new database admin client with
@@ -55,6 +57,18 @@ func NewDatabaseAdminClientWithConfig(ctx context.Context, config OmniClientConf
 			return nil, err
 		}
 		opts = append(opts, omniOpts...)
+
+		hasUsername := config.GetUsername() != ""
+		hasPassword := len(config.GetPassword()) > 0
+		if hasUsername != hasPassword {
+			return nil, status.Errorf(codes.InvalidArgument, "both Username and Password must be specified for Omni authentication")
+		}
+		if hasUsername && hasPassword {
+			tsOpts := append([]option.ClientOption(nil), opts...)
+			opts = append(opts, option.WithTokenSource(omni.NewTokenSource(ctx, config.GetUsername(), config.GetPassword(), tsOpts)))
+		} else {
+			opts = append(opts, option.WithoutAuthentication())
+		}
 	}
 
 	return NewDatabaseAdminClient(ctx, opts...)

spanner/client.go

@@ -390,6 +390,14 @@ type ClientConfig struct {
 	// If unspecified, it defaults to CLOUD.
 	Type InstanceType
 
+	// Username is the username for logging into Spanner Omni.
+	// Note: This field is only applicable when Type is OMNI.
+	Username string
+
+	// Password is the password for logging into Spanner Omni.
+	// Note: This field is only applicable when Type is OMNI.
+	Password []byte
+
 	// UsePlainText specifies whether to use plain text for the connection.
 	UsePlainText bool
 
@@ -444,6 +452,16 @@ func (c ClientConfig) GetUsePlainText() bool {
 	return c.UsePlainText
 }
 
+// GetUsername returns the username for OPAQUE login.
+func (c ClientConfig) GetUsername() string {
+	return c.Username
+}
+
+// GetPassword returns the password for OPAQUE login.
+func (c ClientConfig) GetPassword() []byte {
+	return c.Password
+}
+
 // GetCaCertificateFile returns the CA certificate file path.
 func (c ClientConfig) GetCaCertificateFile() string {
 	return c.CaCertificateFile
@@ -624,6 +642,18 @@ func newClientWithConfig(ctx context.Context, database string, config ClientConf
 			return nil, err
 		}
 		opts = append(opts, omniOpts...)
+
+		hasUsername := config.Username != ""
+		hasPassword := len(config.Password) > 0
+		if hasUsername != hasPassword {
+			return nil, spannerErrorf(codes.InvalidArgument, "both Username and Password must be specified for Omni authentication")
+		}
+		if hasUsername && hasPassword {
+			tsOpts := append([]option.ClientOption(nil), opts...)
+			opts = append(opts, option.WithTokenSource(omni.NewTokenSource(ctx, config.Username, config.Password, tsOpts)))
+		} else {
+			opts = append(opts, option.WithoutAuthentication())
+		}
 	}
 
 	// Validate database path.

spanner/go.mod

@@ -22,6 +22,7 @@ require (
 	go.opentelemetry.io/otel/sdk v1.44.0
 	go.opentelemetry.io/otel/sdk/metric v1.44.0
 	go.opentelemetry.io/otel/trace v1.44.0
+	golang.org/x/crypto v0.53.0
 	golang.org/x/oauth2 v0.36.0
 	golang.org/x/sync v0.21.0
 	google.golang.org/api v0.287.1
@@ -55,7 +56,6 @@ require (
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect
-	golang.org/x/crypto v0.53.0 // indirect
 	golang.org/x/net v0.56.0 // indirect
 	golang.org/x/sys v0.46.0 // indirect
 	golang.org/x/text v0.38.0 // indirect

spanner/integration_test.go

@@ -411,6 +411,8 @@ func init() {
 	flag.StringVar(&omniConfig.caCertificateFile, "it.omni-ca-cert", "", "Path to CA certificate file for Spanner Omni connection")
 	flag.StringVar(&omniConfig.clientCertificateFile, "it.omni-client-cert", "", "Path to client certificate file for Spanner Omni connection")
 	flag.StringVar(&omniConfig.clientKeyFile, "it.omni-client-key", "", "Path to client key file for Spanner Omni connection")
+	flag.StringVar(&omniConfig.username, "it.omni-username", "", "Username for Spanner Omni connection")
+	flag.StringVar(&omniConfig.password, "it.omni-password", "", "Password for Spanner Omni connection")
 }
 
 type directPathTestConfig struct {
@@ -425,6 +427,8 @@ type spannerOmniTestConfig struct {
 	caCertificateFile     string
 	clientCertificateFile string
 	clientKeyFile         string
+	username              string
+	password              string
 }
 
 func omniConnectionConfig() ClientConfig {
@@ -438,6 +442,8 @@ func omniConnectionConfig() ClientConfig {
 		CaCertificateFile:     omniConfig.caCertificateFile,
 		ClientCertificateFile: omniConfig.clientCertificateFile,
 		ClientKeyFile:         omniConfig.clientKeyFile,
+		Username:              omniConfig.username,
+		Password:              []byte(omniConfig.password),
 	}
 }
 
@@ -5639,6 +5645,7 @@ func TestIntegration_Foreign_Key_Delete_Cascade_Action(t *testing.T) {
 
 func TestIntegration_GFE_Latency(t *testing.T) {
 	skipDirectPathTest(t)
+	skipSpannerOmniTest(t)
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
 	defer cancel()
 
@@ -6402,6 +6409,8 @@ func createClient(ctx context.Context, dbPath string, config ClientConfig) (clie
 		config.CaCertificateFile = omniConf.CaCertificateFile
 		config.ClientCertificateFile = omniConf.ClientCertificateFile
 		config.ClientKeyFile = omniConf.ClientKeyFile
+		config.Username = omniConf.Username
+		config.Password = omniConf.Password
 	}
 	client, err = makeClientWithConfig(ctx, dbPath, config, serverAddress, opts...)
 	if err != nil {
@@ -6429,6 +6438,8 @@ func createClientWithRole(ctx context.Context, dbPath string, spc SessionPoolCon
 		config.CaCertificateFile = omniConf.CaCertificateFile
 		config.ClientCertificateFile = omniConf.ClientCertificateFile
 		config.ClientKeyFile = omniConf.ClientKeyFile
+		config.Username = omniConf.Username
+		config.Password = omniConf.Password
 	}
 	client, err = makeClientWithConfig(ctx, dbPath, config, serverAddress, opts...)
 	if err != nil {
@@ -6455,6 +6466,8 @@ func createClientForProtoColumns(ctx context.Context, dbPath string, spc Session
 		config.CaCertificateFile = omniConf.CaCertificateFile
 		config.ClientCertificateFile = omniConf.ClientCertificateFile
 		config.ClientKeyFile = omniConf.ClientKeyFile
+		config.Username = omniConf.Username
+		config.Password = omniConf.Password
 	}
 	client, err = NewClientWithConfig(ctx, dbPath, config, opts...)
 	if err != nil {