feat(KotlinSDK): Adding IAP support for the Kotlin SDK (#1662) by MitchellGale · Pull Request #1672 · looker-open-source/sdk-codegen

MitchellGale · 2026-03-24T21:53:14Z

This PR adds support for routing API requests through Identity-Aware Proxy. This is done by putting an OIDC token in the header as Proxy-Authorization: Bearer <token>. The OIDC is generated through IamCredentialsClient.

To use, users need to provide their iap_client_id and iap_service_account_email to the SDK's configuration payload.

        Map<String, String> lookerConfig = new HashMap<>();
        lookerConfig.put("base_url", "<Base_Url>");

        lookerConfig.put("kotlin_http_transport", "JAVA_NET");
        lookerConfig.put("client_id", "<Client_ID>");
        lookerConfig.put("client_secret", "<Client_Secret>");
        lookerConfig.put("iap_client_id", "<IAP_Client_ID>");
        lookerConfig.put("iap_service_account_email", "<IAP_Service_Account_Email>);
        
        ConfigurationProvider settings = ApiSettings.fromMap(lookerConfig);
        
        Transport transport = new Transport(settings);
        AuthSession session = new AuthSession(settings, transport);
        
        LookerSDK sdk = new LookerSDK(session);

iap_client_id is the OAuth client ID that was set-up when configuring the the identity-aware proxy.
iap_service_account_email is the service account that is authorized to bypass IAP.

This PR adds support for routing API requests through Identity-Aware Proxy. This is done by putting an OIDC token in the header as `Proxy-Authorization: Bearer <token>`. The OIDC is generated through IamCredentialsClient. To use, users need to provide their `iap_client_id` and `iap_service_account_email` to the SDK's configuration payload. ``` Map<String, String> lookerConfig = new HashMap<>(); lookerConfig.put("base_url", "<Base_Url>"); lookerConfig.put("kotlin_http_transport", "JAVA_NET"); lookerConfig.put("client_id", "<Client_ID>"); lookerConfig.put("client_secret", "<Client_Secret>"); lookerConfig.put("iap_client_id", "<IAP_Client_ID>"); lookerConfig.put("iap_service_account_email", "<IAP_Service_Account_Email>); ConfigurationProvider settings = ApiSettings.fromMap(lookerConfig); Transport transport = new Transport(settings); AuthSession session = new AuthSession(settings, transport); LookerSDK sdk = new LookerSDK(session); ``` `iap_client_id` is the OAuth client ID that was set-up when configuring the the identity-aware proxy. `iap_service_account_email` is the service account that is authorized to bypass IAP.

gemini-code-assist · 2026-03-24T21:53:34Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the Kotlin SDK by introducing support for Google Cloud's Identity-Aware Proxy (IAP). This allows the SDK to securely connect to Looker instances that are protected by IAP, by automatically generating and managing OIDC tokens. The changes involve integrating new Google Cloud libraries, adding new configuration options for IAP credentials, and modifying the authentication and request handling mechanisms to incorporate IAP tokens, thereby broadening the SDK's compatibility with secure deployment patterns.

Highlights

Identity-Aware Proxy (IAP) Support: Added comprehensive support for routing API requests through Google Cloud's Identity-Aware Proxy, enabling secure access to Looker instances protected by IAP.
OIDC Token Generation and Caching: Integrated with IamCredentialsClient to generate OIDC tokens, which are then cached for 50 minutes to optimize performance and reduce repeated token requests.
New Configuration Parameters: Introduced iap_client_id and iap_service_account_email configuration options, allowing users to specify their IAP OAuth client ID and service account for authentication.
Enhanced Authentication Flow: Modified the AuthSession to automatically fetch and include the IAP OIDC token in the Proxy-Authorization header for all API requests, including login and logout.
Improved Error Handling: Enhanced error messages during authentication to provide clearer guidance when IAP-related issues occur, distinguishing them from standard Looker credential problems.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces support for Google IAP (Identity-Aware Proxy) authentication to the Kotlin SDK. This includes adding necessary Google Cloud IAM Credentials dependencies, implementing IAP token generation and caching within AuthSession, and integrating IAP token usage into authentication, login, and logout flows. The Transport layer was updated to allow custom request configuration and to handle potential null HTTP response content more robustly. However, several iapToken properties added to RequestSettings, TransportOptions, TransportSettings, and ApiSettings appear to be redundant as the IAP token is handled directly via request headers and configuration reading, suggesting an opportunity to simplify the data structures.

kotlin/src/main/com/looker/rtl/AuthSession.kt

kotlin/src/main/com/looker/rtl/Transport.kt

gemini-code-assist · 2026-03-24T21:55:32Z

kotlin/src/main/com/looker/rtl/Transport.kt

    var headers: Map<String, String>
    var environmentPrefix: String
    var httpTransport: String
+    var iapToken: String?


The iapToken property added to the TransportOptions interface seems unused. The AuthSession class reads IAP configuration from apiSettings.readConfig() but does not set this iapToken property on the ConfigurationProvider or TransportOptions instance. This redundancy can lead to confusion.

References

Avoid introducing unused fields or variables to maintain code clarity and prevent confusion.

kotlin/src/main/com/looker/rtl/Transport.kt

kotlin/src/main/com/looker/sdk/ApiSettings.kt

github-actions · 2026-03-24T21:57:56Z

APIX Tests

0 tests ±0 0 ✅ ±0 0s ⏱️ ±0s
0 suites ±0 0 💤 ±0
0 files ±0 0 ❌ ±0

Results for commit 01533cb. ± Comparison against base commit 77fc3b4.

♻️ This comment has been updated with latest results.

github-actions · 2026-03-24T21:58:05Z

Typescript Tests

2 files ±0 56 suites ±0 59s ⏱️ -3s
209 tests ±0 207 ✅ ±0 2 💤 ±0 0 ❌ ±0
446 runs ±0 442 ✅ ±0 4 💤 ±0 0 ❌ ±0

Results for commit 01533cb. ± Comparison against base commit 77fc3b4.

♻️ This comment has been updated with latest results.

github-actions · 2026-03-24T22:00:15Z

Codegen Tests

442 tests ±0 403 ✅ ±0 35s ⏱️ -15s
19 suites ±0 39 💤 ±0
1 files ±0 0 ❌ ±0

Results for commit 01533cb. ± Comparison against base commit 77fc3b4.

♻️ This comment has been updated with latest results.

…apper

MitchellGale · 2026-03-25T17:06:49Z

Hey @drstrangelooker when you get a chance, can you please review this PR?

drstrangelooker · 2026-03-25T18:13:11Z

@MitchellGale can you resolve the issues that Gemini found?

…rce/sdk-codegen into AddingIAPSupport

MitchellGale · 2026-03-25T22:46:57Z

@MitchellGale can you resolve the issues that Gemini found?

@drstrangelooker all resolved

This PR adds support for routing API requests through Identity-Aware Proxy. This is done by putting an OIDC token in the header as `Proxy-Authorization: Bearer <token>`. The OIDC is generated through IamCredentialsClient. To use, users need to provide their `iap_client_id` and `iap_service_account_email` to the SDK's configuration payload. ``` Map<String, String> lookerConfig = new HashMap<>(); lookerConfig.put("base_url", "<Base_Url>"); lookerConfig.put("kotlin_http_transport", "JAVA_NET"); lookerConfig.put("client_id", "<Client_ID>"); lookerConfig.put("client_secret", "<Client_Secret>"); lookerConfig.put("iap_client_id", "<IAP_Client_ID>"); lookerConfig.put("iap_service_account_email", "<IAP_Service_Account_Email>); ConfigurationProvider settings = ApiSettings.fromMap(lookerConfig); Transport transport = new Transport(settings); AuthSession session = new AuthSession(settings, transport); LookerSDK sdk = new LookerSDK(session); ``` `iap_client_id` is the OAuth client ID that was set-up when configuring the the identity-aware proxy. `iap_service_account_email` is the service account that is authorized to bypass IAP. Release-As: 26.6.2

🤖 I have created a release *beep* *boop* --- <details><summary>sdk-codegen-all: 26.6.2</summary> ## [26.6.2](sdk-codegen-all-v26.6.1...sdk-codegen-all-v26.6.2) (2026-03-27) ### Features * **KotlinSDK:** Adding IAP support for the Kotlin SDK ([#1662](#1662)) ([#1672](#1672)) ([80b34e1](80b34e1)) </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

MitchellGale requested a review from a team as a code owner March 24, 2026 21:53

gemini-code-assist bot reviewed Mar 24, 2026

View reviewed changes

MitchellGale and others added 7 commits March 24, 2026 15:49

updating yarn.lock

708d710

dedup yarn.lock

77f4e35

dedup yarn.lock with fewer

63a0084

Updating jest.config.js with information about cherrio

dd951ef

Updating jest.config.js with information about cherrio in moduleNameM…

75879c9

…apper

chore: fixing cheerio conflict for jest tests

efa18b0

Merge branch 'main' into AddingIAPSupport

b04104a

MitchellGale requested a review from drstrangelooker March 25, 2026 17:07

MitchellGale mentioned this pull request Mar 25, 2026

Adding support for IAP (identity-aware proxy) in the JDBC driver. looker-open-source/calcite-avatica#27

Open

MitchellGale added 2 commits March 25, 2026 15:35

Removing unused iapToken

5230196

Merge branch 'AddingIAPSupport' of https://github.com/looker-open-sou…

01533cb

…rce/sdk-codegen into AddingIAPSupport

drstrangelooker approved these changes Mar 26, 2026

View reviewed changes

MitchellGale merged commit bc4d6c3 into main Mar 26, 2026
27 checks passed

MitchellGale deleted the AddingIAPSupport branch March 26, 2026 22:44

looker-open-source-automation-bot mentioned this pull request Mar 26, 2026

chore: release main #1680

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(KotlinSDK): Adding IAP support for the Kotlin SDK (#1662)#1672

feat(KotlinSDK): Adding IAP support for the Kotlin SDK (#1662)#1672
MitchellGale merged 10 commits intomainfrom
AddingIAPSupport

MitchellGale commented Mar 24, 2026

Uh oh!

gemini-code-assist bot commented Mar 24, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gemini-code-assist bot Mar 24, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Mar 24, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 24, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 24, 2026 •

edited

Loading

Uh oh!

MitchellGale commented Mar 25, 2026

Uh oh!

drstrangelooker commented Mar 25, 2026

Uh oh!

MitchellGale commented Mar 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

MitchellGale commented Mar 24, 2026

Uh oh!

gemini-code-assist bot commented Mar 24, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gemini-code-assist bot Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

APIX Tests

Uh oh!

github-actions bot commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Typescript Tests

Uh oh!

github-actions bot commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codegen Tests

Uh oh!

MitchellGale commented Mar 25, 2026

Uh oh!

drstrangelooker commented Mar 25, 2026

Uh oh!

MitchellGale commented Mar 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions bot commented Mar 24, 2026 •

edited

Loading

github-actions bot commented Mar 24, 2026 •

edited

Loading

github-actions bot commented Mar 24, 2026 •

edited

Loading