tree c98c6fdc6ec800192e5746d2c702c76dd47c6d96
parent f1e270a6d2a7f3a5cee678d1358d1b8dd755063e
author Andy Zhao <andyzhao@google.com> 1581720266 -0800
committer Chris Broadfoot <cbro@google.com> 1582578682 +0000

transport/http: add Application Default Credentials support for DCA/mTLS

The overall ADC logic for mTLS is as follows:
1. If both endpoint override and client certificate are specified, use them as is.
2. If user does not specify client certificate, we will attempt to use default
   client certificate.
3. If user does not specify endpoint override, we will use defaultMtlsEndpoint if
   client certificate is available and defaultEndpoint otherwise.

Implications of the above logic:
1. If the user specifies a non-mTLS endpoint override but client certificate is
   available, we will pass along the cert anyway and let the server decide what to do.
2. If the user specifies an mTLS endpoint override but client certificate is not
   available, we will not fail-fast, but let backend throw error when connecting.

We would like to avoid introducing client-side logic that parses whether the
endpoint override is an mTLS url, since the url pattern may change at anytime.

Change-Id: Ic0492ae2a8d96a775add1bfbebfa228b3193a560
Reviewed-on: https://code-review.googlesource.com/c/google-api-go-client/+/52010
Reviewed-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Chris Broadfoot <cbro@google.com>