core: update SPIFFE certificate extraction to comply with X509-SVID spec

- Modify `SpiffeUtil.extractCert` to ignore all but the first certificate if the `x5c` JWK parameter contains multiple values.
- Modify `SpiffeUtil.extractCert` to skip the JWK entry (`continue`) instead of stopping execution (`break`) or throwing when `x5c` is missing or contains an empty list, complying with the requirement that entries without `x5c` must be
     ignored.
- Update `SpiffeUtilTest.java` to treat multi-cert, missing `x5c`, and empty `x5c` list cases as success cases, asserting that the valid certificates are successfully extracted.
- Add `spiffebundle_ignored_keys.json` to verify the combination of missing `x5c`, empty `x5c` list, and multi-cert parameters.

Author: kannanjgithub

core/src/main/java/io/grpc/internal/SpiffeUtil.java

@@ -231,14 +231,8 @@ private static List<X509Certificate> extractCert(List<Map<String, ?>> keysNode,
     for (Map<String, ?> keyNode : keysNode) {
       checkJwkEntry(keyNode, trustDomainName);
       List<String> rawCerts = JsonUtil.getListOfStrings(keyNode, "x5c");
-      if (rawCerts == null) {
-        throw new IllegalArgumentException(String.format("'x5c' parameter is required. Certificate "
-            + "loading for trust domain '%s' failed.", trustDomainName));
-      }
-      if (rawCerts.size() != 1) {
-        throw new IllegalArgumentException(String.format("Exactly 1 certificate is expected, but "
-            + "%s found. Certificate loading for trust domain '%s' failed.", rawCerts.size(),
-            trustDomainName));
+      if (rawCerts == null || rawCerts.isEmpty()) {
+        continue;
       }
       InputStream stream = new ByteArrayInputStream((CERTIFICATE_PREFIX + rawCerts.get(0) + "\n"
           + CERTIFICATE_SUFFIX)

core/src/test/java/io/grpc/internal/SpiffeUtilTest.java

@@ -231,6 +231,8 @@ public static class CertificateApiTest {
     private static final String SPIFFE_TRUST_BUNDLE_WRONG_ROOT = "spiffebundle_wrong_root.json";
     private static final String SPIFFE_TRUST_BUNDLE_WRONG_SEQ = "spiffebundle_wrong_seq_type.json";
     private static final String SPIFFE_TRUST_BUNDLE_MISSING_X5C = "spiffebundle_missing_x5c.json";
+    private static final String SPIFFE_TRUST_BUNDLE_EMPTY_X5C = "spiffebundle_empty_x5c.json";
+    private static final String SPIFFE_TRUST_BUNDLE_IGNORED_KEYS = "spiffebundle_ignored_keys.json";
     private static final String DOMAIN_ERROR_MESSAGE =
         " Certificate loading for trust domain 'google.com' failed.";
 
@@ -330,6 +332,54 @@ public void loadTrustBundleFromFileSuccessTest() throws Exception {
       assertEquals("foo.bar.com", spiffeId_ec.get().getTrustDomain());
     }
 
+    @Test
+    public void loadTrustBundleFromFileWithMultiCertsSuccessTest() throws Exception {
+      SpiffeBundle tb = SpiffeUtil.loadTrustBundleFromFile(
+          copyFileToTmp(SPIFFE_TRUST_BUNDLE_WRONG_MULTI_CERTS));
+      assertEquals(1, tb.getSequenceNumbers().size());
+      assertEquals(123L, (long) tb.getSequenceNumbers().get("google.com"));
+      assertEquals(1, tb.getBundleMap().size());
+      assertEquals(1, tb.getBundleMap().get("google.com").size());
+      Optional<SpiffeId> spiffeId = SpiffeUtil.extractSpiffeId(
+          tb.getBundleMap().get("google.com").toArray(new X509Certificate[0]));
+      assertTrue(spiffeId.isPresent());
+      assertEquals("foo.bar.com", spiffeId.get().getTrustDomain());
+    }
+
+    @Test
+    public void loadTrustBundleFromFileWithMissingX5cSuccessTest() throws Exception {
+      SpiffeBundle tb = SpiffeUtil.loadTrustBundleFromFile(
+          copyFileToTmp(SPIFFE_TRUST_BUNDLE_MISSING_X5C));
+      assertEquals(1, tb.getBundleMap().size());
+      assertEquals(1, tb.getBundleMap().get("google.com").size());
+    }
+
+    @Test
+    public void loadTrustBundleFromFileWithEmptyX5cSuccessTest() throws Exception {
+      SpiffeBundle tb = SpiffeUtil.loadTrustBundleFromFile(
+          copyFileToTmp(SPIFFE_TRUST_BUNDLE_EMPTY_X5C));
+      assertEquals(1, tb.getBundleMap().size());
+      assertEquals(1, tb.getBundleMap().get("google.com").size());
+      Optional<SpiffeId> spiffeId = SpiffeUtil.extractSpiffeId(
+          tb.getBundleMap().get("google.com").toArray(new X509Certificate[0]));
+      assertTrue(spiffeId.isPresent());
+      assertEquals("foo.bar.com", spiffeId.get().getTrustDomain());
+    }
+
+    @Test
+    public void loadTrustBundleFromFileWithIgnoredKeysSuccessTest() throws Exception {
+      SpiffeBundle tb = SpiffeUtil.loadTrustBundleFromFile(
+          copyFileToTmp(SPIFFE_TRUST_BUNDLE_IGNORED_KEYS));
+      assertEquals(1, tb.getSequenceNumbers().size());
+      assertEquals(123L, (long) tb.getSequenceNumbers().get("google.com"));
+      assertEquals(1, tb.getBundleMap().size());
+      assertEquals(1, tb.getBundleMap().get("google.com").size());
+      Optional<SpiffeId> spiffeId = SpiffeUtil.extractSpiffeId(
+          tb.getBundleMap().get("google.com").toArray(new X509Certificate[0]));
+      assertTrue(spiffeId.isPresent());
+      assertEquals("foo.bar.com", spiffeId.get().getTrustDomain());
+    }
+
     @Test
     public void loadTrustBundleFromFileFailureTest() {
       // Check the exception if JSON root element is different from 'trust_domains'
@@ -352,10 +402,6 @@ public void loadTrustBundleFromFileFailureTest() {
       iae = assertThrows(IllegalArgumentException.class, () -> SpiffeUtil
           .loadTrustBundleFromFile(copyFileToTmp(SPIFFE_TRUST_BUNDLE_CORRUPTED_CERT)));
       assertEquals("Certificate can't be parsed." + DOMAIN_ERROR_MESSAGE, iae.getMessage());
-      // Check the exception if a key entry is missing the 'x5c' parameter
-      iae = assertThrows(IllegalArgumentException.class, () -> SpiffeUtil
-          .loadTrustBundleFromFile(copyFileToTmp(SPIFFE_TRUST_BUNDLE_MISSING_X5C)));
-      assertEquals("'x5c' parameter is required." + DOMAIN_ERROR_MESSAGE, iae.getMessage());
       // Check the exception if 'kty' value differs from 'RSA'
       iae = assertThrows(IllegalArgumentException.class, () -> SpiffeUtil
           .loadTrustBundleFromFile(copyFileToTmp(SPIFFE_TRUST_BUNDLE_WRONG_KTY)));
@@ -371,11 +417,6 @@ public void loadTrustBundleFromFileFailureTest() {
           .loadTrustBundleFromFile(copyFileToTmp(SPIFFE_TRUST_BUNDLE_WRONG_USE)));
       assertEquals("'use' parameter must be 'x509-svid' but 'i_am_not_x509-svid' found."
           + DOMAIN_ERROR_MESSAGE, iae.getMessage());
-      // Check the exception if multiple certs are provided for 'x5c'
-      iae = assertThrows(IllegalArgumentException.class, () -> SpiffeUtil
-          .loadTrustBundleFromFile(copyFileToTmp(SPIFFE_TRUST_BUNDLE_WRONG_MULTI_CERTS)));
-      assertEquals("Exactly 1 certificate is expected, but 2 found." + DOMAIN_ERROR_MESSAGE,
-          iae.getMessage());
     }
 
     @Test