iam: add conformance tests for IAM Identity Management APIs for GCP #186

SriramGuduri · 2025-12-03T05:44:35Z

Summary

GCP IAM Admin API Conformance Testing Strategy

Specific challenges encountered with the GCP IAM Admin Java Client that necessitated a different testing approach compared to the standard REST-based conformance tests.

1. Client Transport Limitations (gRPC vs. REST)

Unlike other GCP client libraries we use, the google-iam-admin library does not natively expose an HTTP/JSON (REST) transport option in its StubSettings. It forces the use of gRPC, which requires HTTP/2. This prevented us from using our standard HTTP-based WireMock recording setup.

2. WireMock gRPC Extension Limitations

While we utilized the wiremock-grpc-extension to handle the HTTP/2 connection and protocol framing, it currently lacks full parity with the standard WireMock HTTP recorder:

No Auto-Recording: The extension cannot transparently proxy binary gRPC streams and serialize the Protobuf responses into readable JSON files automatically.
Strict Matching: The extension requires precise endpoint matching (e.g., strict leading slashes), which caused UNIMPLEMENTED errors when using standard auto-loaded mappings.

3. Implementation of Custom Record/Replay Pattern

To bridge this gap, we implemented a manual Record/Replay workflow:

Record Mode:
- Bypassed WireMock to connect directly to GCP.
- Intercepted the response objects.
- Manually serialized the Protobuf messages to JSON using JsonFormat and saved them to a dedicated recorded_responses directory (avoiding conflicts with WireMock's auto-scanner).
Replay Mode:
- Configured the client with SSL/ALPN to negotiate HTTP/2 with WireMock.
- Programmatically loaded the JSON files, parsed them back into Protobuf objects, and registered them as stubs using the gRPC Extension DSL.

codecov-commenter · 2025-12-03T05:51:28Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.21%. Comparing base (ce4f06c) to head (f12dcbd).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##               main     #186   +/-   ##
=========================================
  Coverage     83.21%   83.21%           
  Complexity       91       91           
=========================================
  Files           150      150           
  Lines          8190     8190           
  Branches        950      950           
=========================================
  Hits           6815     6815           
  Misses          925      925           
  Partials        450      450

Flag	Coverage Δ
unittests	`83.21% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

SriramGuduri · 2025-12-12T07:34:34Z

Unrelated build check failure.
Found the same issue with a dummy PR from main branch here: https://github.com/salesforce/multicloudj/pull/202/checks

LihaoLiuXs · 2025-12-15T21:27:23Z

iam/iam-gcp/src/test/java/com/salesforce/multicloudj/iam/gcp/GcpIamIT.java

+ * 
+ * <p><b>Usage:</b>
+ * <ul>
+ *   <li>Record mode: {@code mvn test -Drecord} - Saves responses to {@code src/test/resources/recordings/iam/}</li>


We don't need this instruction in comment here. We can remove it.

LihaoLiuXs · 2025-12-15T21:28:26Z

...cloudj-common-gcp/src/test/java/com/salesforce/multicloudj/common/gcp/util/TestsUtilGcp.java

+     * @param endpoint The gRPC endpoint to connect to
+     * @return A configured TransportChannelProvider for gRPC
+     */
+    public static TransportChannelProvider getGrpcTransportChannelProvider(int port, String endpoint) {


I didn't find any usage of this method in this PR. Where we need this getGrpcTransportChannelProvider?

It's not needed anymore. I'll remove it in follow up commit.

LihaoLiuXs · 2025-12-15T21:29:45Z

iam/iam-client/src/test/java/com/salesforce/multicloudj/iam/client/AbstractIamIT.java

+        AbstractIam iam = harness.createIamDriver(true);
+        IamClient iamClient = new IamClient(iam);
+
+        String identityId = iamClient.createIdentity(


After the Identity creation, do we have any clean up step for these test created resources?

Good catch. CleanUp is not implemented. I'll address it in follow up commits.

sandeepvinayak · 2025-12-16T19:25:25Z

iam/iam-gcp/src/test/java/com/salesforce/multicloudj/iam/gcp/GcpIamIT.java

+ * <p>NOTE: GCP IAM Admin API is gRPC-only. Unlike other conformance tests that use
+ * HTTP/HTTPS proxy-based WireMock recording, this test uses:
+ * <ul>
+ *   <li><b>RECORD mode:</b> Wraps IAMClient to intercept and save responses as JSON files</li>


that's exactly what happens for other conformance tests, which part is unlike other conf tests?

sandeepvinayak · 2025-12-16T19:31:43Z

iam/iam-gcp/src/test/java/com/salesforce/multicloudj/iam/gcp/GcpIamIT.java

+    private static final Logger logger = LoggerFactory.getLogger(GcpIamIT.class);
+    private static WireMockServer grpcWireMockServer;
+    private static WireMockGrpcService mockIamService;
+    private static final String GRPC_DIR = "src/test/resources/grpc";


it's okay to use the same path for recording and let the wiremock framework take care of creating directories. I see now we have to create directories and all manually.

scratch this please, I see it's a setup for grpc here https://github.com/wiremock/wiremock-grpc-extension

sandeepvinayak · 2025-12-16T21:30:52Z

iam/iam-gcp/src/test/java/com/salesforce/multicloudj/iam/gcp/GcpIamIT.java

+        private static final String TRUSTED_PRINCIPAL = "[email protected]";
+
+        @Override
+        public AbstractIam createIamDriver(boolean useValidCredentials) {


I think useValidCredentials pattern is taken from blobstore, we aren't used it here, I think we should remove it, it doesn't add much value.

sandeepvinayak · 2025-12-16T21:31:16Z

iam/iam-gcp/src/test/java/com/salesforce/multicloudj/iam/gcp/GcpIamIT.java

+            ProjectsSettings.Builder projectsSettingsBuilder = ProjectsSettings.newBuilder()
+                    .setTransportChannelProvider(channelProvider);
+            try {
+                if (isRecordMode && useValidCredentials) {


sandeepvinayak · 2025-12-16T21:43:08Z

iam/iam-gcp/src/test/java/com/salesforce/multicloudj/iam/gcp/GcpIamIT.java

+                if (isRecordMode && useValidCredentials) {
+                    // RECORD mode: Use gRPC interceptor to capture and save responses
+                    logger.info("--- RECORD MODE: Connecting to Real GCP with Recording ---");
+                    Files.createDirectories(Paths.get(RECORDINGS_DIR));


Let's create the directory manually as one time operation and assume that it exists, this won't work in bazel fork where build works in temp location.
(Also I believe the recordings directory should be taken care of wiremock for creation.)

sandeepvinayak · 2025-12-17T00:20:30Z

iam/iam-gcp/src/test/java/com/salesforce/multicloudj/iam/gcp/GcpIamIT.java

+            return;
+        }
+        // 1. Prepare directories and clean up old descriptor files
+        Files.createDirectories(Paths.get(GRPC_DIR));


ditto, let's create it manually as one time

sandeepvinayak · 2025-12-17T00:33:13Z

iam/iam-gcp/src/test/java/com/salesforce/multicloudj/iam/gcp/GcpIamIT.java

+    /**
+     * Loads all stub files from the recordings directory.
+     */
+    private static void loadAllStubs() throws IOException {


don't wiremock load the recordings automatically for gRPC?

sandeepvinayak · 2025-12-17T00:33:45Z

iam/iam-gcp/src/test/java/com/salesforce/multicloudj/iam/gcp/GcpIamIT.java

+        Message responseMessage = parseResponseForMethod(methodNameFromJson, responseJson);
+
+        if (responseMessage == null) {
+            logger.error("  ERROR: Unknown method type, skipping: {}", methodNameFromJson);


nit: remove tab in log

sandeepvinayak · 2025-12-17T00:34:03Z

iam/iam-gcp/src/test/java/com/salesforce/multicloudj/iam/gcp/GcpIamIT.java

+                        .willReturn(message(responseMessage))
+        );
+
+        logger.info("  ✓ Successfully registered stub for: {}", methodNameFromJson);


nit: remove genAI special symbols

salesforce-cla bot added the cla:signed label Dec 3, 2025

SriramGuduri force-pushed the W-20347771/iam_gcp_conformance branch 4 times, most recently from 7693624 to 741577f Compare December 5, 2025 08:36

SriramGuduri force-pushed the W-20347771/iam_gcp_conformance branch 2 times, most recently from 3fc467e to 99f415d Compare December 12, 2025 06:42

SriramGuduri force-pushed the W-20347771/iam_gcp_conformance branch 6 times, most recently from 799509a to 149ac5a Compare December 15, 2025 13:47

LihaoLiuXs reviewed Dec 15, 2025

View reviewed changes

SriramGuduri force-pushed the W-20347771/iam_gcp_conformance branch from bc4175b to d549cb3 Compare December 16, 2025 13:16

iam: add conformance tests for IAM Identity Management APIs for GCP

f12dcbd

SriramGuduri force-pushed the W-20347771/iam_gcp_conformance branch from d549cb3 to f12dcbd Compare December 16, 2025 14:48

LihaoLiuXs approved these changes Dec 16, 2025

View reviewed changes

sandeepvinayak reviewed Dec 16, 2025

View reviewed changes

sandeepvinayak reviewed Dec 17, 2025

View reviewed changes

iam: add conformance tests for IAM Identity Management APIs for GCP #186

Are you sure you want to change the base?

iam: add conformance tests for IAM Identity Management APIs for GCP #186

Uh oh!

Conversation

SriramGuduri commented Dec 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

GCP IAM Admin API Conformance Testing Strategy

1. Client Transport Limitations (gRPC vs. REST)

2. WireMock gRPC Extension Limitations

3. Implementation of Custom Record/Replay Pattern

Uh oh!

codecov-commenter commented Dec 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

SriramGuduri commented Dec 12, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sandeepvinayak Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

SriramGuduri commented Dec 3, 2025 •

edited

Loading

codecov-commenter commented Dec 3, 2025 •

edited

Loading

sandeepvinayak Dec 16, 2025 •

edited

Loading