Refactor OIDC-based auth mechanism (#2049)

This PR changes the two flavors of OIDC authentication mechanisms to
verify the same audience. This allows the same token to pass both
mechanisms. Previously the regular OIDC flavor uses the project id as
its required audience, which does not work for local user credentials
(such as ones used by the nomulus tool), which requires a valid OAuth
client ID as audience when minting the token (project id is NOT a valid
OAuth client ID).

I considered allowing multiple audiences, but the result is not as clean
as just using the same everywhere, because the fall-through logic would
have generated a lot of noises for failed attempts.

This PR also changes the client side to solely use OIDC token whenever
possible, including the proxy, cloud scheduler and cloud tasks. The nomulus
tool still uses OAuth access token by default because it requires USER level
authentication, which in turn requires us to fill the User table with objects
corresponding to the email address of everyone needing access to the tool.

TESTED=verified each client is able to make authenticated calls on QA with or
without IAP.

core/src/test/java/google/registry/batch/AsyncTaskEnqueuerTest.java

@@ -73,7 +73,7 @@ public class AsyncTaskEnqueuerTest {
     cloudTasksHelper.assertTasksEnqueued(
         QUEUE_ASYNC_ACTIONS,
         new CloudTasksHelper.TaskMatcher()
-            .url(ResaveEntityAction.PATH)
+            .path(ResaveEntityAction.PATH)
             .method(HttpMethod.POST)
             .service("backend")
             .header("content-type", "application/x-www-form-urlencoded")
@@ -93,7 +93,7 @@ public class AsyncTaskEnqueuerTest {
     cloudTasksHelper.assertTasksEnqueued(
         QUEUE_ASYNC_ACTIONS,
         new TaskMatcher()
-            .url(ResaveEntityAction.PATH)
+            .path(ResaveEntityAction.PATH)
             .method(HttpMethod.POST)
             .service("backend")
             .header("content-type", "application/x-www-form-urlencoded")

core/src/test/java/google/registry/batch/CloudTasksUtilsTest.java

@@ -30,6 +30,7 @@ import com.google.common.collect.ImmutableMultimap;
 import com.google.common.collect.LinkedListMultimap;
 import google.registry.batch.CloudTasksUtils.SerializableCloudTasksClient;
 import google.registry.request.Action.Service;
+import google.registry.testing.CloudTasksHelper.FakeGoogleCredentialsBundle;
 import google.registry.testing.FakeClock;
 import google.registry.testing.FakeSleeper;
 import google.registry.util.Retrier;
@@ -47,14 +48,14 @@ public class CloudTasksUtilsTest {
   private final LinkedListMultimap<String, String> params = LinkedListMultimap.create();
   private final SerializableCloudTasksClient mockClient = mock(SerializableCloudTasksClient.class);
   private final FakeClock clock = new FakeClock(DateTime.parse("2021-11-08"));
-  private CloudTasksUtils cloudTasksUtils =
+  private final CloudTasksUtils cloudTasksUtils =
       new CloudTasksUtils(
           new Retrier(new FakeSleeper(clock), 1),
           clock,
           "project",
           "location",
-          Optional.empty(),
-          Optional.empty(),
+          "clientId",
+          FakeGoogleCredentialsBundle.create(),
           mockClient);
 
   @BeforeEach
@@ -66,208 +67,6 @@ public class CloudTasksUtilsTest {
         .thenAnswer(invocation -> invocation.getArgument(3));
   }
 
-  @Test
-  void testSuccess_createGetTasks() {
-    Task task = cloudTasksUtils.createGetTask("/the/path", Service.BACKEND, params);
-    assertThat(task.getAppEngineHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.GET);
-    assertThat(task.getAppEngineHttpRequest().getRelativeUri())
-        .isEqualTo("/the/path?key1=val1&key2=val2&key1=val3");
-    assertThat(task.getAppEngineHttpRequest().getAppEngineRouting().getService())
-        .isEqualTo(Service.BACKEND.toString());
-    assertThat(task.getScheduleTime().getSeconds()).isEqualTo(0);
-  }
-
-  @Test
-  void testSuccess_createPostTasks() {
-    Task task = cloudTasksUtils.createPostTask("/the/path", Service.BACKEND, params);
-    assertThat(task.getAppEngineHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.POST);
-    assertThat(task.getAppEngineHttpRequest().getRelativeUri()).isEqualTo("/the/path");
-    assertThat(task.getAppEngineHttpRequest().getAppEngineRouting().getService())
-        .isEqualTo(Service.BACKEND.toString());
-    assertThat(task.getAppEngineHttpRequest().getHeadersMap().get("Content-Type"))
-        .isEqualTo("application/x-www-form-urlencoded");
-    assertThat(task.getAppEngineHttpRequest().getBody().toString(StandardCharsets.UTF_8))
-        .isEqualTo("key1=val1&key2=val2&key1=val3");
-    assertThat(task.getScheduleTime().getSeconds()).isEqualTo(0);
-  }
-
-  @Test
-  void testSuccess_createGetTasks_withNullParams() {
-    Task task = cloudTasksUtils.createGetTask("/the/path", Service.BACKEND, null);
-    assertThat(task.getAppEngineHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.GET);
-    assertThat(task.getAppEngineHttpRequest().getRelativeUri()).isEqualTo("/the/path");
-    assertThat(task.getAppEngineHttpRequest().getAppEngineRouting().getService())
-        .isEqualTo(Service.BACKEND.toString());
-    assertThat(task.getScheduleTime().getSeconds()).isEqualTo(0);
-  }
-
-  @Test
-  void testSuccess_createPostTasks_withNullParams() {
-    Task task = cloudTasksUtils.createPostTask("/the/path", Service.BACKEND, null);
-    assertThat(task.getAppEngineHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.POST);
-    assertThat(task.getAppEngineHttpRequest().getRelativeUri()).isEqualTo("/the/path");
-    assertThat(task.getAppEngineHttpRequest().getAppEngineRouting().getService())
-        .isEqualTo(Service.BACKEND.toString());
-    assertThat(task.getAppEngineHttpRequest().getBody().toString(StandardCharsets.UTF_8)).isEmpty();
-    assertThat(task.getScheduleTime().getSeconds()).isEqualTo(0);
-  }
-
-  @Test
-  void testSuccess_createGetTasks_withEmptyParams() {
-    Task task = cloudTasksUtils.createGetTask("/the/path", Service.BACKEND, ImmutableMultimap.of());
-    assertThat(task.getAppEngineHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.GET);
-    assertThat(task.getAppEngineHttpRequest().getRelativeUri()).isEqualTo("/the/path");
-    assertThat(task.getAppEngineHttpRequest().getAppEngineRouting().getService())
-        .isEqualTo(Service.BACKEND.toString());
-    assertThat(task.getScheduleTime().getSeconds()).isEqualTo(0);
-  }
-
-  @Test
-  void testSuccess_createPostTasks_withEmptyParams() {
-    Task task =
-        cloudTasksUtils.createPostTask("/the/path", Service.BACKEND, ImmutableMultimap.of());
-    assertThat(task.getAppEngineHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.POST);
-    assertThat(task.getAppEngineHttpRequest().getRelativeUri()).isEqualTo("/the/path");
-    assertThat(task.getAppEngineHttpRequest().getAppEngineRouting().getService())
-        .isEqualTo(Service.BACKEND.toString());
-    assertThat(task.getAppEngineHttpRequest().getBody().toString(StandardCharsets.UTF_8)).isEmpty();
-    assertThat(task.getScheduleTime().getSeconds()).isEqualTo(0);
-  }
-
-  @SuppressWarnings("ProtoTimestampGetSecondsGetNano")
-  @Test
-  void testSuccess_createGetTasks_withJitterSeconds() {
-    Task task =
-        cloudTasksUtils.createGetTaskWithJitter(
-            "/the/path", Service.BACKEND, params, Optional.of(100));
-    assertThat(task.getAppEngineHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.GET);
-    assertThat(task.getAppEngineHttpRequest().getRelativeUri())
-        .isEqualTo("/the/path?key1=val1&key2=val2&key1=val3");
-    assertThat(task.getAppEngineHttpRequest().getAppEngineRouting().getService())
-        .isEqualTo(Service.BACKEND.toString());
-
-    Instant scheduleTime = Instant.ofEpochSecond(task.getScheduleTime().getSeconds());
-    Instant lowerBoundTime = Instant.ofEpochMilli(clock.nowUtc().getMillis());
-    Instant upperBound = Instant.ofEpochMilli(clock.nowUtc().plusSeconds(100).getMillis());
-
-    assertThat(scheduleTime.isBefore(lowerBoundTime)).isFalse();
-    assertThat(upperBound.isBefore(scheduleTime)).isFalse();
-  }
-
-  @SuppressWarnings("ProtoTimestampGetSecondsGetNano")
-  @Test
-  void testSuccess_createPostTasks_withJitterSeconds() {
-    Task task =
-        cloudTasksUtils.createPostTaskWithJitter(
-            "/the/path", Service.BACKEND, params, Optional.of(1));
-    assertThat(task.getAppEngineHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.POST);
-    assertThat(task.getAppEngineHttpRequest().getRelativeUri()).isEqualTo("/the/path");
-    assertThat(task.getAppEngineHttpRequest().getAppEngineRouting().getService())
-        .isEqualTo(Service.BACKEND.toString());
-    assertThat(task.getAppEngineHttpRequest().getHeadersMap().get("Content-Type"))
-        .isEqualTo("application/x-www-form-urlencoded");
-    assertThat(task.getAppEngineHttpRequest().getBody().toString(StandardCharsets.UTF_8))
-        .isEqualTo("key1=val1&key2=val2&key1=val3");
-    assertThat(task.getScheduleTime().getSeconds()).isNotEqualTo(0);
-
-    Instant scheduleTime = Instant.ofEpochSecond(task.getScheduleTime().getSeconds());
-    Instant lowerBoundTime = Instant.ofEpochMilli(clock.nowUtc().getMillis());
-    Instant upperBound = Instant.ofEpochMilli(clock.nowUtc().plusSeconds(1).getMillis());
-
-    assertThat(scheduleTime.isBefore(lowerBoundTime)).isFalse();
-    assertThat(upperBound.isBefore(scheduleTime)).isFalse();
-  }
-
-  @Test
-  void testSuccess_createPostTasks_withEmptyJitterSeconds() {
-    Task task =
-        cloudTasksUtils.createPostTaskWithJitter(
-            "/the/path", Service.BACKEND, params, Optional.empty());
-    assertThat(task.getAppEngineHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.POST);
-    assertThat(task.getAppEngineHttpRequest().getRelativeUri()).isEqualTo("/the/path");
-    assertThat(task.getAppEngineHttpRequest().getAppEngineRouting().getService())
-        .isEqualTo(Service.BACKEND.toString());
-    assertThat(task.getAppEngineHttpRequest().getHeadersMap().get("Content-Type"))
-        .isEqualTo("application/x-www-form-urlencoded");
-    assertThat(task.getAppEngineHttpRequest().getBody().toString(StandardCharsets.UTF_8))
-        .isEqualTo("key1=val1&key2=val2&key1=val3");
-    assertThat(task.getScheduleTime().getSeconds()).isEqualTo(0);
-  }
-
-  @Test
-  void testSuccess_createGetTasks_withEmptyJitterSeconds() {
-    Task task =
-        cloudTasksUtils.createGetTaskWithJitter(
-            "/the/path", Service.BACKEND, params, Optional.empty());
-    assertThat(task.getAppEngineHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.GET);
-    assertThat(task.getAppEngineHttpRequest().getRelativeUri())
-        .isEqualTo("/the/path?key1=val1&key2=val2&key1=val3");
-    assertThat(task.getAppEngineHttpRequest().getAppEngineRouting().getService())
-        .isEqualTo(Service.BACKEND.toString());
-    assertThat(task.getScheduleTime().getSeconds()).isEqualTo(0);
-  }
-
-  @Test
-  void testSuccess_createPostTasks_withZeroJitterSeconds() {
-    Task task =
-        cloudTasksUtils.createPostTaskWithJitter(
-            "/the/path", Service.BACKEND, params, Optional.of(0));
-    assertThat(task.getAppEngineHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.POST);
-    assertThat(task.getAppEngineHttpRequest().getRelativeUri()).isEqualTo("/the/path");
-    assertThat(task.getAppEngineHttpRequest().getAppEngineRouting().getService())
-        .isEqualTo(Service.BACKEND.toString());
-    assertThat(task.getAppEngineHttpRequest().getHeadersMap().get("Content-Type"))
-        .isEqualTo("application/x-www-form-urlencoded");
-    assertThat(task.getAppEngineHttpRequest().getBody().toString(StandardCharsets.UTF_8))
-        .isEqualTo("key1=val1&key2=val2&key1=val3");
-    assertThat(task.getScheduleTime().getSeconds()).isEqualTo(0);
-  }
-
-  @Test
-  void testSuccess_createGetTasks_withZeroJitterSeconds() {
-    Task task =
-        cloudTasksUtils.createGetTaskWithJitter(
-            "/the/path", Service.BACKEND, params, Optional.of(0));
-    assertThat(task.getAppEngineHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.GET);
-    assertThat(task.getAppEngineHttpRequest().getRelativeUri())
-        .isEqualTo("/the/path?key1=val1&key2=val2&key1=val3");
-    assertThat(task.getAppEngineHttpRequest().getAppEngineRouting().getService())
-        .isEqualTo(Service.BACKEND.toString());
-    assertThat(task.getScheduleTime().getSeconds()).isEqualTo(0);
-  }
-
-  @Test
-  void testSuccess_createGetTasks_withDelay() {
-    Task task =
-        cloudTasksUtils.createGetTaskWithDelay(
-            "/the/path", Service.BACKEND, params, Duration.standardMinutes(10));
-    assertThat(task.getAppEngineHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.GET);
-    assertThat(task.getAppEngineHttpRequest().getRelativeUri())
-        .isEqualTo("/the/path?key1=val1&key2=val2&key1=val3");
-    assertThat(task.getAppEngineHttpRequest().getAppEngineRouting().getService())
-        .isEqualTo(Service.BACKEND.toString());
-    assertThat(Instant.ofEpochSecond(task.getScheduleTime().getSeconds()))
-        .isEqualTo(Instant.ofEpochMilli(clock.nowUtc().plusMinutes(10).getMillis()));
-  }
-
-  @Test
-  void testSuccess_createPostTasks_withDelay() {
-    Task task =
-        cloudTasksUtils.createPostTaskWithDelay(
-            "/the/path", Service.BACKEND, params, Duration.standardMinutes(10));
-    assertThat(task.getAppEngineHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.POST);
-    assertThat(task.getAppEngineHttpRequest().getRelativeUri()).isEqualTo("/the/path");
-    assertThat(task.getAppEngineHttpRequest().getAppEngineRouting().getService())
-        .isEqualTo(Service.BACKEND.toString());
-    assertThat(task.getAppEngineHttpRequest().getHeadersMap().get("Content-Type"))
-        .isEqualTo("application/x-www-form-urlencoded");
-    assertThat(task.getAppEngineHttpRequest().getBody().toString(StandardCharsets.UTF_8))
-        .isEqualTo("key1=val1&key2=val2&key1=val3");
-    assertThat(task.getScheduleTime().getSeconds()).isNotEqualTo(0);
-    assertThat(Instant.ofEpochSecond(task.getScheduleTime().getSeconds()))
-        .isEqualTo(Instant.ofEpochMilli(clock.nowUtc().plusMinutes(10).getMillis()));
-  }
-
   @Test
   void testFailure_createGetTasks_withNegativeDelay() {
     IllegalArgumentException thrown =
@@ -290,34 +89,6 @@ public class CloudTasksUtilsTest {
     assertThat(thrown).hasMessageThat().isEqualTo("Negative duration is not supported.");
   }
 
-  @Test
-  void testSuccess_createPostTasks_withZeroDelay() {
-    Task task =
-        cloudTasksUtils.createPostTaskWithDelay(
-            "/the/path", Service.BACKEND, params, Duration.ZERO);
-    assertThat(task.getAppEngineHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.POST);
-    assertThat(task.getAppEngineHttpRequest().getRelativeUri()).isEqualTo("/the/path");
-    assertThat(task.getAppEngineHttpRequest().getAppEngineRouting().getService())
-        .isEqualTo(Service.BACKEND.toString());
-    assertThat(task.getAppEngineHttpRequest().getHeadersMap().get("Content-Type"))
-        .isEqualTo("application/x-www-form-urlencoded");
-    assertThat(task.getAppEngineHttpRequest().getBody().toString(StandardCharsets.UTF_8))
-        .isEqualTo("key1=val1&key2=val2&key1=val3");
-    assertThat(task.getScheduleTime().getSeconds()).isEqualTo(0);
-  }
-
-  @Test
-  void testSuccess_createGetTasks_withZeroDelay() {
-    Task task =
-        cloudTasksUtils.createGetTaskWithDelay("/the/path", Service.BACKEND, params, Duration.ZERO);
-    assertThat(task.getAppEngineHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.GET);
-    assertThat(task.getAppEngineHttpRequest().getRelativeUri())
-        .isEqualTo("/the/path?key1=val1&key2=val2&key1=val3");
-    assertThat(task.getAppEngineHttpRequest().getAppEngineRouting().getService())
-        .isEqualTo(Service.BACKEND.toString());
-    assertThat(task.getScheduleTime().getSeconds()).isEqualTo(0);
-  }
-
   @Test
   void testFailure_illegalPath() {
     assertThrows(
@@ -357,22 +128,20 @@ public class CloudTasksUtilsTest {
   }
 
   @Test
-  void testSuccess_nonAppEngine_createGetTasks() {
-    createOidcTasksUtils();
+  void testSuccess_createGetTasks() {
     Task task = cloudTasksUtils.createGetTask("/the/path", Service.BACKEND, params);
     assertThat(task.getHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.GET);
     assertThat(task.getHttpRequest().getUrl())
-        .isEqualTo("https://localhost/the/path?key1=val1&key2=val2&key1=val3");
+        .isEqualTo("https://backend.example.com/the/path?key1=val1&key2=val2&key1=val3");
     verifyOidcToken(task);
     assertThat(task.getScheduleTime().getSeconds()).isEqualTo(0);
   }
 
   @Test
-  void testSuccess_nonAppEngine_createPostTasks() {
-    createOidcTasksUtils();
+  void testSuccess_createPostTasks() {
     Task task = cloudTasksUtils.createPostTask("/the/path", Service.BACKEND, params);
     assertThat(task.getHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.POST);
-    assertThat(task.getHttpRequest().getUrl()).isEqualTo("https://localhost/the/path");
+    assertThat(task.getHttpRequest().getUrl()).isEqualTo("https://backend.example.com/the/path");
     assertThat(task.getHttpRequest().getHeadersMap().get("Content-Type"))
         .isEqualTo("application/x-www-form-urlencoded");
     assertThat(task.getHttpRequest().getBody().toString(StandardCharsets.UTF_8))
@@ -382,43 +151,39 @@ public class CloudTasksUtilsTest {
   }
 
   @Test
-  void testSuccess_nonAppEngine_createGetTasks_withNullParams() {
-    createOidcTasksUtils();
+  void testSuccess_createGetTasks_withNullParams() {
     Task task = cloudTasksUtils.createGetTask("/the/path", Service.BACKEND, null);
     assertThat(task.getHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.GET);
-    assertThat(task.getHttpRequest().getUrl()).isEqualTo("https://localhost/the/path");
+    assertThat(task.getHttpRequest().getUrl()).isEqualTo("https://backend.example.com/the/path");
     verifyOidcToken(task);
     assertThat(task.getScheduleTime().getSeconds()).isEqualTo(0);
   }
 
   @Test
-  void testSuccess_nonAppEngine_createPostTasks_withNullParams() {
-    createOidcTasksUtils();
+  void testSuccess_createPostTasks_withNullParams() {
     Task task = cloudTasksUtils.createPostTask("/the/path", Service.BACKEND, null);
     assertThat(task.getHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.POST);
-    assertThat(task.getHttpRequest().getUrl()).isEqualTo("https://localhost/the/path");
+    assertThat(task.getHttpRequest().getUrl()).isEqualTo("https://backend.example.com/the/path");
     assertThat(task.getHttpRequest().getBody().toString(StandardCharsets.UTF_8)).isEmpty();
     verifyOidcToken(task);
     assertThat(task.getScheduleTime().getSeconds()).isEqualTo(0);
   }
 
   @Test
-  void testSuccess_nonAppEngine_createGetTasks_withEmptyParams() {
-    createOidcTasksUtils();
+  void testSuccess_createGetTasks_withEmptyParams() {
     Task task = cloudTasksUtils.createGetTask("/the/path", Service.BACKEND, ImmutableMultimap.of());
     assertThat(task.getHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.GET);
-    assertThat(task.getHttpRequest().getUrl()).isEqualTo("https://localhost/the/path");
+    assertThat(task.getHttpRequest().getUrl()).isEqualTo("https://backend.example.com/the/path");
     verifyOidcToken(task);
     assertThat(task.getScheduleTime().getSeconds()).isEqualTo(0);
   }
 
   @Test
-  void testSuccess_nonAppEngine_createPostTasks_withEmptyParams() {
-    createOidcTasksUtils();
+  void testSuccess_createPostTasks_withEmptyParams() {
     Task task =
         cloudTasksUtils.createPostTask("/the/path", Service.BACKEND, ImmutableMultimap.of());
     assertThat(task.getHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.POST);
-    assertThat(task.getHttpRequest().getUrl()).isEqualTo("https://localhost/the/path");
+    assertThat(task.getHttpRequest().getUrl()).isEqualTo("https://backend.example.com/the/path");
     assertThat(task.getHttpRequest().getBody().toString(StandardCharsets.UTF_8)).isEmpty();
     verifyOidcToken(task);
     assertThat(task.getScheduleTime().getSeconds()).isEqualTo(0);
@@ -426,14 +191,13 @@ public class CloudTasksUtilsTest {
 
   @SuppressWarnings("ProtoTimestampGetSecondsGetNano")
   @Test
-  void testSuccess_nonAppEngine_createGetTasks_withJitterSeconds() {
-    createOidcTasksUtils();
+  void testSuccess_createGetTasks_withJitterSeconds() {
     Task task =
         cloudTasksUtils.createGetTaskWithJitter(
             "/the/path", Service.BACKEND, params, Optional.of(100));
     assertThat(task.getHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.GET);
     assertThat(task.getHttpRequest().getUrl())
-        .isEqualTo("https://localhost/the/path?key1=val1&key2=val2&key1=val3");
+        .isEqualTo("https://backend.example.com/the/path?key1=val1&key2=val2&key1=val3");
     verifyOidcToken(task);
 
     Instant scheduleTime = Instant.ofEpochSecond(task.getScheduleTime().getSeconds());
@@ -446,13 +210,12 @@ public class CloudTasksUtilsTest {
 
   @SuppressWarnings("ProtoTimestampGetSecondsGetNano")
   @Test
-  void testSuccess_nonAppEngine_createPostTasks_withJitterSeconds() {
-    createOidcTasksUtils();
+  void testSuccess_createPostTasks_withJitterSeconds() {
     Task task =
         cloudTasksUtils.createPostTaskWithJitter(
             "/the/path", Service.BACKEND, params, Optional.of(1));
     assertThat(task.getHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.POST);
-    assertThat(task.getHttpRequest().getUrl()).isEqualTo("https://localhost/the/path");
+    assertThat(task.getHttpRequest().getUrl()).isEqualTo("https://backend.example.com/the/path");
     assertThat(task.getHttpRequest().getHeadersMap().get("Content-Type"))
         .isEqualTo("application/x-www-form-urlencoded");
     assertThat(task.getHttpRequest().getBody().toString(StandardCharsets.UTF_8))
@@ -469,13 +232,12 @@ public class CloudTasksUtilsTest {
   }
 
   @Test
-  void testSuccess_nonAppEngine_createPostTasks_withEmptyJitterSeconds() {
-    createOidcTasksUtils();
+  void testSuccess_createPostTasks_withEmptyJitterSeconds() {
     Task task =
         cloudTasksUtils.createPostTaskWithJitter(
             "/the/path", Service.BACKEND, params, Optional.empty());
     assertThat(task.getHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.POST);
-    assertThat(task.getHttpRequest().getUrl()).isEqualTo("https://localhost/the/path");
+    assertThat(task.getHttpRequest().getUrl()).isEqualTo("https://backend.example.com/the/path");
     assertThat(task.getHttpRequest().getHeadersMap().get("Content-Type"))
         .isEqualTo("application/x-www-form-urlencoded");
     assertThat(task.getHttpRequest().getBody().toString(StandardCharsets.UTF_8))
@@ -485,26 +247,24 @@ public class CloudTasksUtilsTest {
   }
 
   @Test
-  void testSuccess_nonAppEngine_createGetTasks_withEmptyJitterSeconds() {
-    createOidcTasksUtils();
+  void testSuccess_createGetTasks_withEmptyJitterSeconds() {
     Task task =
         cloudTasksUtils.createGetTaskWithJitter(
             "/the/path", Service.BACKEND, params, Optional.empty());
     assertThat(task.getHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.GET);
     assertThat(task.getHttpRequest().getUrl())
-        .isEqualTo("https://localhost/the/path?key1=val1&key2=val2&key1=val3");
+        .isEqualTo("https://backend.example.com/the/path?key1=val1&key2=val2&key1=val3");
     verifyOidcToken(task);
     assertThat(task.getScheduleTime().getSeconds()).isEqualTo(0);
   }
 
   @Test
-  void testSuccess_nonAppEngine_createPostTasks_withZeroJitterSeconds() {
-    createOidcTasksUtils();
+  void testSuccess_createPostTasks_withZeroJitterSeconds() {
     Task task =
         cloudTasksUtils.createPostTaskWithJitter(
             "/the/path", Service.BACKEND, params, Optional.of(0));
     assertThat(task.getHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.POST);
-    assertThat(task.getHttpRequest().getUrl()).isEqualTo("https://localhost/the/path");
+    assertThat(task.getHttpRequest().getUrl()).isEqualTo("https://backend.example.com/the/path");
     assertThat(task.getHttpRequest().getHeadersMap().get("Content-Type"))
         .isEqualTo("application/x-www-form-urlencoded");
     assertThat(task.getHttpRequest().getBody().toString(StandardCharsets.UTF_8))
@@ -514,40 +274,37 @@ public class CloudTasksUtilsTest {
   }
 
   @Test
-  void testSuccess_nonAppEngine_createGetTasks_withZeroJitterSeconds() {
-    createOidcTasksUtils();
+  void testSuccess_createGetTasks_withZeroJitterSeconds() {
     Task task =
         cloudTasksUtils.createGetTaskWithJitter(
             "/the/path", Service.BACKEND, params, Optional.of(0));
     assertThat(task.getHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.GET);
     assertThat(task.getHttpRequest().getUrl())
-        .isEqualTo("https://localhost/the/path?key1=val1&key2=val2&key1=val3");
+        .isEqualTo("https://backend.example.com/the/path?key1=val1&key2=val2&key1=val3");
     verifyOidcToken(task);
     assertThat(task.getScheduleTime().getSeconds()).isEqualTo(0);
   }
 
   @Test
-  void testSuccess_nonAppEngine_createGetTasks_withDelay() {
-    createOidcTasksUtils();
+  void testSuccess_createGetTasks_withDelay() {
     Task task =
         cloudTasksUtils.createGetTaskWithDelay(
             "/the/path", Service.BACKEND, params, Duration.standardMinutes(10));
     assertThat(task.getHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.GET);
     assertThat(task.getHttpRequest().getUrl())
-        .isEqualTo("https://localhost/the/path?key1=val1&key2=val2&key1=val3");
+        .isEqualTo("https://backend.example.com/the/path?key1=val1&key2=val2&key1=val3");
     verifyOidcToken(task);
     assertThat(Instant.ofEpochSecond(task.getScheduleTime().getSeconds()))
         .isEqualTo(Instant.ofEpochMilli(clock.nowUtc().plusMinutes(10).getMillis()));
   }
 
   @Test
-  void testSuccess_nonAppEngine_createPostTasks_withDelay() {
-    createOidcTasksUtils();
+  void testSuccess_createPostTasks_withDelay() {
     Task task =
         cloudTasksUtils.createPostTaskWithDelay(
             "/the/path", Service.BACKEND, params, Duration.standardMinutes(10));
     assertThat(task.getHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.POST);
-    assertThat(task.getHttpRequest().getUrl()).isEqualTo("https://localhost/the/path");
+    assertThat(task.getHttpRequest().getUrl()).isEqualTo("https://backend.example.com/the/path");
     assertThat(task.getHttpRequest().getHeadersMap().get("Content-Type"))
         .isEqualTo("application/x-www-form-urlencoded");
     assertThat(task.getHttpRequest().getBody().toString(StandardCharsets.UTF_8))
@@ -559,13 +316,12 @@ public class CloudTasksUtilsTest {
   }
 
   @Test
-  void testSuccess_nonAppEngine_createPostTasks_withZeroDelay() {
-    createOidcTasksUtils();
+  void testSuccess_createPostTasks_withZeroDelay() {
     Task task =
         cloudTasksUtils.createPostTaskWithDelay(
             "/the/path", Service.BACKEND, params, Duration.ZERO);
     assertThat(task.getHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.POST);
-    assertThat(task.getHttpRequest().getUrl()).isEqualTo("https://localhost/the/path");
+    assertThat(task.getHttpRequest().getUrl()).isEqualTo("https://backend.example.com/the/path");
     assertThat(task.getHttpRequest().getHeadersMap().get("Content-Type"))
         .isEqualTo("application/x-www-form-urlencoded");
     assertThat(task.getHttpRequest().getBody().toString(StandardCharsets.UTF_8))
@@ -575,35 +331,22 @@ public class CloudTasksUtilsTest {
   }
 
   @Test
-  void testSuccess_nonAppEngine_createGetTasks_withZeroDelay() {
-    createOidcTasksUtils();
+  void testSuccess_createGetTasks_withZeroDelay() {
     Task task =
         cloudTasksUtils.createGetTaskWithDelay("/the/path", Service.BACKEND, params, Duration.ZERO);
     assertThat(task.getHttpRequest().getHttpMethod()).isEqualTo(HttpMethod.GET);
     assertThat(task.getHttpRequest().getUrl())
-        .isEqualTo("https://localhost/the/path?key1=val1&key2=val2&key1=val3");
+        .isEqualTo("https://backend.example.com/the/path?key1=val1&key2=val2&key1=val3");
     verifyOidcToken(task);
     assertThat(task.getScheduleTime().getSeconds()).isEqualTo(0);
   }
 
-  private void createOidcTasksUtils() {
-    cloudTasksUtils =
-        new CloudTasksUtils(
-            new Retrier(new FakeSleeper(clock), 1),
-            clock,
-            "project",
-            "location",
-            Optional.of("defaultServiceAccount"),
-            Optional.of("iapClientId"),
-            mockClient);
-  }
-
-  private void verifyOidcToken(Task task) {
+  private static void verifyOidcToken(Task task) {
     assertThat(task.getHttpRequest().getOidcToken())
         .isEqualTo(
             OidcToken.newBuilder()
-                .setServiceAccountEmail("defaultServiceAccount")
-                .setAudience("iapClientId")
+                .setServiceAccountEmail("service@account.com")
+                .setAudience("clientId")
                 .build());
   }
 }

core/src/test/java/google/registry/batch/RelockDomainActionTest.java

@@ -305,7 +305,7 @@ public class RelockDomainActionTest {
     cloudTasksHelper.assertTasksEnqueued(
         QUEUE_ASYNC_ACTIONS,
         new TaskMatcher()
-            .url(RelockDomainAction.PATH)
+            .path(RelockDomainAction.PATH)
             .method(HttpMethod.POST)
             .param(
                 RelockDomainAction.OLD_UNLOCK_REVISION_ID_PARAM,

core/src/test/java/google/registry/batch/ResaveEntityActionTest.java

@@ -136,7 +136,7 @@ public class ResaveEntityActionTest {
     cloudTasksHelper.assertTasksEnqueued(
         QUEUE_ASYNC_ACTIONS,
         new TaskMatcher()
-            .url(ResaveEntityAction.PATH)
+            .path(ResaveEntityAction.PATH)
             .method(HttpMethod.POST)
             .service("backend")
             .header("content-type", "application/x-www-form-urlencoded")

core/src/test/java/google/registry/beam/rde/RdePipelineTest.java

@@ -464,7 +464,7 @@ public class RdePipelineTest {
     cloudTasksHelper.assertTasksEnqueued(
         "brda",
         new TaskMatcher()
-            .url("/_dr/task/brdaCopy")
+            .path("/_dr/task/brdaCopy")
             .service("backend")
             .param("tld", "soy")
             .param("watermark", now.toString())
@@ -472,7 +472,7 @@ public class RdePipelineTest {
     cloudTasksHelper.assertTasksEnqueued(
         "rde-upload",
         new TaskMatcher()
-            .url("/_dr/task/rdeUpload")
+            .path("/_dr/task/rdeUpload")
             .service("backend")
             .param("tld", "soy")
             .param("prefix", "rde-job/"));

core/src/test/java/google/registry/cron/TldFanoutActionTest.java

@@ -91,14 +91,14 @@ class TldFanoutActionTest {
             .map(
                 namespace ->
                     new TaskMatcher()
-                        .url(ENDPOINT)
+                        .path(ENDPOINT)
                         .header("content-type", "application/x-www-form-urlencoded")
                         .param("tld", namespace))
             .collect(toImmutableList()));
   }
 
   private void assertTaskWithoutTld() {
-    cloudTasksHelper.assertTasksEnqueued(QUEUE, new TaskMatcher().url(ENDPOINT));
+    cloudTasksHelper.assertTasksEnqueued(QUEUE, new TaskMatcher().path(ENDPOINT));
   }
 
   @Test
@@ -211,7 +211,7 @@ class TldFanoutActionTest {
   void testSuccess_additionalArgsFlowThroughToPostParams() {
     run(getParamsMap("forEachTestTld", "", "newkey", "newval"));
     cloudTasksHelper.assertTasksEnqueued(
-        QUEUE, new TaskMatcher().url("/the/servlet").param("newkey", "newval"));
+        QUEUE, new TaskMatcher().path("/the/servlet").param("newkey", "newval"));
   }
 
   @Test
@@ -224,9 +224,9 @@ class TldFanoutActionTest {
     String expectedResponse =
         String.format(
             "OK: Launched the following 3 tasks in queue the-queue\n"
-                + "- Task: '%s', tld: 'com', endpoint: '/the/servlet'\n"
-                + "- Task: '%s', tld: 'net', endpoint: '/the/servlet'\n"
-                + "- Task: '%s', tld: 'org', endpoint: '/the/servlet'\n",
+                + "- Task: '%s', tld: 'com', endpoint: 'https://backend.example.com/the/servlet'\n"
+                + "- Task: '%s', tld: 'net', endpoint: 'https://backend.example.com/the/servlet'\n"
+                + "- Task: '%s', tld: 'org', endpoint: 'https://backend.example.com/the/servlet'\n",
             taskList.get(0).getName(), taskList.get(1).getName(), taskList.get(2).getName());
     assertThat(response.getPayload()).isEqualTo(expectedResponse);
   }
@@ -241,7 +241,7 @@ class TldFanoutActionTest {
     String expectedResponse =
         String.format(
             "OK: Launched the following 1 tasks in queue the-queue\n"
-                + "- Task: '%s', tld: '', endpoint: '/the/servlet'\n",
+                + "- Task: '%s', tld: '', endpoint: 'https://backend.example.com/the/servlet'\n",
             taskList.get(0).getName());
     assertThat(response.getPayload()).isEqualTo(expectedResponse);
   }

core/src/test/java/google/registry/dns/PublishDnsUpdatesActionTest.java

@@ -294,7 +294,7 @@ public class PublishDnsUpdatesActionTest {
     cloudTasksHelper.assertTasksEnqueued(
         DNS_PUBLISH_PUSH_QUEUE_NAME,
         new TaskMatcher()
-            .url(PublishDnsUpdatesAction.PATH)
+            .path(PublishDnsUpdatesAction.PATH)
             .param(PARAM_TLD, "xn--q9jyb4c")
             .param(PARAM_DNS_WRITER, "correctWriter")
             .param(PARAM_LOCK_INDEX, "1")
@@ -305,7 +305,7 @@ public class PublishDnsUpdatesActionTest {
             .param(PARAM_HOSTS, "")
             .header("content-type", "application/x-www-form-urlencoded"),
         new TaskMatcher()
-            .url(PublishDnsUpdatesAction.PATH)
+            .path(PublishDnsUpdatesAction.PATH)
             .param(PARAM_TLD, "xn--q9jyb4c")
             .param(PARAM_DNS_WRITER, "correctWriter")
             .param(PARAM_LOCK_INDEX, "1")
@@ -333,7 +333,7 @@ public class PublishDnsUpdatesActionTest {
     cloudTasksHelper.assertTasksEnqueued(
         DNS_PUBLISH_PUSH_QUEUE_NAME,
         new TaskMatcher()
-            .url(PublishDnsUpdatesAction.PATH)
+            .path(PublishDnsUpdatesAction.PATH)
             .param(PARAM_TLD, "xn--q9jyb4c")
             .param(PARAM_DNS_WRITER, "correctWriter")
             .param(PARAM_LOCK_INDEX, "1")
@@ -344,7 +344,7 @@ public class PublishDnsUpdatesActionTest {
             .param(PARAM_HOSTS, "")
             .header("content-type", "application/x-www-form-urlencoded"),
         new TaskMatcher()
-            .url(PublishDnsUpdatesAction.PATH)
+            .path(PublishDnsUpdatesAction.PATH)
             .param(PARAM_TLD, "xn--q9jyb4c")
             .param(PARAM_DNS_WRITER, "correctWriter")
             .param(PARAM_LOCK_INDEX, "1")
@@ -370,7 +370,7 @@ public class PublishDnsUpdatesActionTest {
     cloudTasksHelper.assertTasksEnqueued(
         DNS_PUBLISH_PUSH_QUEUE_NAME,
         new TaskMatcher()
-            .url(PublishDnsUpdatesAction.PATH)
+            .path(PublishDnsUpdatesAction.PATH)
             .param(PARAM_TLD, "xn--q9jyb4c")
             .param(PARAM_DNS_WRITER, "correctWriter")
             .param(PARAM_LOCK_INDEX, "1")
@@ -381,7 +381,7 @@ public class PublishDnsUpdatesActionTest {
             .param(PARAM_HOSTS, "")
             .header("content-type", "application/x-www-form-urlencoded"),
         new TaskMatcher()
-            .url(PublishDnsUpdatesAction.PATH)
+            .path(PublishDnsUpdatesAction.PATH)
             .param(PARAM_TLD, "xn--q9jyb4c")
             .param(PARAM_DNS_WRITER, "correctWriter")
             .param(PARAM_LOCK_INDEX, "1")

core/src/test/java/google/registry/dns/ReadDnsRefreshRequestsActionTest.java

@@ -225,7 +225,7 @@ public class ReadDnsRefreshRequestsActionTest {
     cloudTasksHelper.assertTasksEnqueued(
         "dns-publish",
         new TaskMatcher()
-            .url("/_dr/task/publishDnsUpdates")
+            .path("/_dr/task/publishDnsUpdates")
             .service("BACKEND")
             .param("tld", "tld")
             .param("dnsWriter", "FooWriter")
@@ -236,7 +236,7 @@ public class ReadDnsRefreshRequestsActionTest {
             .param("domains", "domain.tld,future.tld")
             .param("hosts", "ns1.domain.tld"),
         new TaskMatcher()
-            .url("/_dr/task/publishDnsUpdates")
+            .path("/_dr/task/publishDnsUpdates")
             .service("BACKEND")
             .param("tld", "tld")
             .param("dnsWriter", "BarWriter")

core/src/test/java/google/registry/flows/domain/DomainDeleteFlowTest.java

@@ -304,7 +304,7 @@ class DomainDeleteFlowTest extends ResourceFlowTestCase<DomainDeleteFlow, Domain
     cloudTasksHelper.assertTasksEnqueued(
         QUEUE_ASYNC_ACTIONS,
         new TaskMatcher()
-            .url(ResaveEntityAction.PATH)
+            .path(ResaveEntityAction.PATH)
             .method(HttpMethod.POST)
             .service("backend")
             .header("content-type", "application/x-www-form-urlencoded")

core/src/test/java/google/registry/flows/domain/DomainTransferRequestFlowTest.java

@@ -520,7 +520,7 @@ class DomainTransferRequestFlowTest
     cloudTasksHelper.assertTasksEnqueued(
         QUEUE_ASYNC_ACTIONS,
         new TaskMatcher()
-            .url(ResaveEntityAction.PATH)
+            .path(ResaveEntityAction.PATH)
             .method(HttpMethod.POST)
             .service("backend")
             .header("content-type", "application/x-www-form-urlencoded")

core/src/test/java/google/registry/flows/host/HostUpdateFlowTest.java

@@ -207,7 +207,7 @@ class HostUpdateFlowTest extends ResourceFlowTestCase<HostUpdateFlow, Host> {
     cloudTasksHelper.assertTasksEnqueued(
         QUEUE_HOST_RENAME,
         new TaskMatcher()
-            .url(RefreshDnsOnHostRenameAction.PATH)
+            .path(RefreshDnsOnHostRenameAction.PATH)
             .method(HttpMethod.POST)
             .service("backend")
             .param(PARAM_HOST_KEY, renamedHost.createVKey().stringify()));

core/src/test/java/google/registry/rde/RdeUploadActionTest.java

@@ -227,7 +227,7 @@ public class RdeUploadActionTest {
             action, Tld.get("lol"), standardSeconds(23), CursorType.RDE_UPLOAD, standardDays(1));
     cloudTasksHelper.assertTasksEnqueued(
         "rde-report",
-        new TaskMatcher().url(RdeReportAction.PATH).param(RequestParameters.PARAM_TLD, "lol"));
+        new TaskMatcher().path(RdeReportAction.PATH).param(RequestParameters.PARAM_TLD, "lol"));
     verifyNoMoreInteractions(runner);
   }
 
@@ -244,7 +244,7 @@ public class RdeUploadActionTest {
     cloudTasksHelper.assertTasksEnqueued(
         "rde-report",
         new TaskMatcher()
-            .url(RdeReportAction.PATH)
+            .path(RdeReportAction.PATH)
             .param(RequestParameters.PARAM_TLD, "lol")
             .param(RdeModule.PARAM_PREFIX, "job-name/"));
     verifyNoMoreInteractions(runner);

core/src/test/java/google/registry/reporting/billing/GenerateInvoicesActionTest.java

@@ -74,7 +74,7 @@ class GenerateInvoicesActionTest extends BeamActionTestBase {
     cloudTasksHelper.assertTasksEnqueued(
         "beam-reporting",
         new TaskMatcher()
-            .url("/_dr/task/publishInvoices")
+            .path("/_dr/task/publishInvoices")
             .method(HttpMethod.POST)
             .param("jobId", "jobid")
             .param("yearMonth", "2017-10")

core/src/test/java/google/registry/reporting/billing/PublishInvoicesActionTest.java

@@ -83,7 +83,7 @@ class PublishInvoicesActionTest {
     verify(emailUtils).emailOverallInvoice();
     TaskMatcher matcher =
         new TaskMatcher()
-            .url("/_dr/task/copyDetailReports")
+            .path("/_dr/task/copyDetailReports")
             .method(HttpMethod.POST)
             .param("yearMonth", "2017-10");
     cloudTasksHelper.assertTasksEnqueued("retryable-cron-tasks", matcher);

core/src/test/java/google/registry/reporting/icann/IcannReportingStagingActionTest.java

@@ -78,7 +78,7 @@ class IcannReportingStagingActionTest {
     cloudTasksHelper.assertTasksEnqueued(
         "retryable-cron-tasks",
         new TaskMatcher()
-            .url("/_dr/task/icannReportingUpload")
+            .path("/_dr/task/icannReportingUpload")
             .method(HttpMethod.POST)
             .scheduleTime(clock.nowUtc().plus(Duration.standardMinutes(2))));
   }

core/src/test/java/google/registry/reporting/spec11/GenerateSpec11ReportActionTest.java

@@ -86,7 +86,7 @@ class GenerateSpec11ReportActionTest extends BeamActionTestBase {
     cloudTasksHelper.assertTasksEnqueued(
         "beam-reporting",
         new TaskMatcher()
-            .url("/_dr/task/publishSpec11")
+            .path("/_dr/task/publishSpec11")
             .method(HttpMethod.POST)
             .param("jobId", "jobid")
             .param("date", "2018-06-11")

core/src/test/java/google/registry/request/auth/OidcTokenAuthenticationMechanismTest.java

@@ -29,7 +29,7 @@ import com.google.api.client.json.webtoken.JsonWebSignature;
 import com.google.api.client.json.webtoken.JsonWebSignature.Header;
 import com.google.auth.oauth2.TokenVerifier;
 import com.google.auth.oauth2.TokenVerifier.VerificationException;
-import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableSet;
 import dagger.Component;
 import dagger.Module;
 import dagger.Provides;
@@ -54,8 +54,8 @@ public class OidcTokenAuthenticationMechanismTest {
   private static final String rawToken = "this-token";
   private static final String email = "user@email.test";
   private static final String gaiaId = "gaia-id";
-  private static final ImmutableList<String> serviceAccounts =
-      ImmutableList.of("service@email.test", "email@service.goog");
+  private static final ImmutableSet<String> serviceAccounts =
+      ImmutableSet.of("service@email.test", "email@service.goog");
 
   private final Payload payload = new Payload();
   private final User user =
@@ -222,9 +222,16 @@ public class OidcTokenAuthenticationMechanismTest {
 
     @Provides
     @Singleton
-    @Config("serviceAccountEmails")
-    ImmutableList<String> provideServiceAccountEmails() {
+    @Config("allowedServiceAccountEmails")
+    ImmutableSet<String> provideAllowedServiceAccountEmails() {
       return serviceAccounts;
     }
+
+    @Provides
+    @Singleton
+    @Config("oauthClientId")
+    String provideOauthClientId() {
+      return "client-id";
+    }
   }
 }

core/src/test/java/google/registry/testing/CloudTasksHelper.java

@@ -24,7 +24,9 @@ import static google.registry.util.DiffUtils.prettyPrintEntityDeepDiff;
 import static java.util.Arrays.asList;
 import static java.util.stream.Collectors.joining;
 
+import com.google.auth.oauth2.GoogleCredentials;
 import com.google.cloud.tasks.v2.HttpMethod;
+import com.google.cloud.tasks.v2.HttpRequest;
 import com.google.cloud.tasks.v2.Task;
 import com.google.common.base.Ascii;
 import com.google.common.base.Joiner;
@@ -45,6 +47,7 @@ import dagger.Module;
 import dagger.Provides;
 import google.registry.batch.CloudTasksUtils;
 import google.registry.model.ImmutableObject;
+import google.registry.util.GoogleCredentialsBundle;
 import google.registry.util.Retrier;
 import java.io.Serializable;
 import java.net.URI;
@@ -58,12 +61,13 @@ import java.util.List;
 import java.util.Map;
 import java.util.NoSuchElementException;
 import java.util.Objects;
-import java.util.Optional;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentMap;
 import java.util.concurrent.atomic.AtomicInteger;
 import java.util.function.Function;
 import java.util.function.Predicate;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 import javax.annotation.Nonnull;
 import javax.inject.Singleton;
 import org.joda.time.DateTime;
@@ -104,8 +108,8 @@ public class CloudTasksHelper implements Serializable {
             clock,
             PROJECT_ID,
             LOCATION_ID,
-            Optional.empty(),
-            Optional.empty(),
+            "client.id",
+            FakeGoogleCredentialsBundle.create(),
             new FakeCloudTasksClient());
     testTasks.put(instanceId, Multimaps.synchronizedListMultimap(LinkedListMultimap.create()));
   }
@@ -219,18 +223,35 @@ public class CloudTasksHelper implements Serializable {
     }
   }
 
+  public static class FakeGoogleCredentialsBundle extends GoogleCredentialsBundle {
+
+    private static final long serialVersionUID = -3251343247195058893L;
+
+    private static final FakeGoogleCredentialsBundle INSTANCE = new FakeGoogleCredentialsBundle();
+
+    public static GoogleCredentialsBundle create() {
+      return INSTANCE;
+    }
+
+    private FakeGoogleCredentialsBundle() {
+      super(new GoogleCredentials(null));
+    }
+
+    @Override
+    public String serviceAccount() {
+      return "service@account.com";
+    }
+  }
+
   /** An adapter to clean up a {@link Task} for ease of matching. */
   private static class MatchableTask extends ImmutableObject {
 
+    private static final Pattern HOSTNAME_PATTERN =
+        Pattern.compile("(?<=https://)[a-z]+(?=\\.example\\.com)");
     String taskName;
     String service;
-    // App Engine TaskOption methods default to "POST".  This isn't obvious from the code, so we
-    // default it to POST here so that we don't accidentally create an entry with a GET method when
-    // converting to CloudTasksUtils, which requires that the method be specified explicitly.
-    // Should we ever actually want to do a GET, we'll likewise have to set this explicitly for the
-    // tests.
-    HttpMethod method = HttpMethod.POST;
-    String url;
+    HttpMethod method;
+    String path;
     Timestamp scheduleTime;
     Multimap<String, String> headers = ArrayListMultimap.create();
     Multimap<String, String> params = ArrayListMultimap.create();
@@ -238,24 +259,24 @@ public class CloudTasksHelper implements Serializable {
     MatchableTask() {}
 
     MatchableTask(Task task) {
+      HttpRequest request = task.getHttpRequest();
+      taskName = task.getName();
+      String url = request.getUrl();
+      // URI class provides helper method to extract query parameters.
       URI uri;
       try {
-        // Construct a fake full URI for parsing purpose. The relative URI must start with a slash.
-        uri =
-            new URI(
-                String.format(
-                    "https://nomulus.foo%s", task.getAppEngineHttpRequest().getRelativeUri()));
+        uri = new URI(url);
       } catch (URISyntaxException e) {
         throw new IllegalArgumentException(e);
       }
-      taskName = task.getName();
-      service =
-          Ascii.toLowerCase(task.getAppEngineHttpRequest().getAppEngineRouting().getService());
-      method = task.getAppEngineHttpRequest().getHttpMethod();
-      url = uri.getPath();
+      Matcher hostnameMatcher = HOSTNAME_PATTERN.matcher(url);
+      assertThat(hostnameMatcher.find()).isTrue();
+      service = Ascii.toLowerCase(hostnameMatcher.group());
+      path = url.substring(String.format("https://%s.example.com", service).length());
+      method = request.getHttpMethod();
       scheduleTime = task.getScheduleTime();
       ImmutableMultimap.Builder<String, String> headerBuilder = new ImmutableMultimap.Builder<>();
-      task.getAppEngineHttpRequest()
+      request
           .getHeadersMap()
           .forEach(
               (key, value) -> {
@@ -269,14 +290,13 @@ public class CloudTasksHelper implements Serializable {
       // where parameters are not properly URL-encoded); it always does a best-effort parse.
       if (method == HttpMethod.GET && uri.getQuery() != null) {
         paramBuilder.putAll(UriParameters.parse(uri.getQuery()));
-      } else if (method == HttpMethod.POST && !task.getAppEngineHttpRequest().getBody().isEmpty()) {
+      } else if (method == HttpMethod.POST && !request.getBody().isEmpty()) {
         assertThat(
                 headers.containsEntry(
                     Ascii.toLowerCase(HttpHeaders.CONTENT_TYPE), MediaType.FORM_DATA.toString()))
             .isTrue();
         paramBuilder.putAll(
-            UriParameters.parse(
-                task.getAppEngineHttpRequest().getBody().toString(StandardCharsets.UTF_8)));
+            UriParameters.parse(request.getBody().toString(StandardCharsets.UTF_8)));
       }
       params = paramBuilder.build();
     }
@@ -286,7 +306,7 @@ public class CloudTasksHelper implements Serializable {
       builder.put("taskName", taskName);
       builder.put("method", method);
       builder.put("service", service);
-      builder.put("url", url);
+      builder.put("path", path);
       builder.put("headers", headers);
       builder.put("params", params);
       builder.put("scheduleTime", scheduleTime);
@@ -310,8 +330,8 @@ public class CloudTasksHelper implements Serializable {
       return this;
     }
 
-    public TaskMatcher url(String url) {
-      expected.url = url;
+    public TaskMatcher path(String path) {
+      expected.path = path;
       return this;
     }
 
@@ -371,7 +391,7 @@ public class CloudTasksHelper implements Serializable {
     public boolean test(@Nonnull Task task) {
       MatchableTask actual = new MatchableTask(task);
       return (expected.taskName == null || Objects.equals(expected.taskName, actual.taskName))
-          && (expected.url == null || Objects.equals(expected.url, actual.url))
+          && (expected.path == null || Objects.equals(expected.path, actual.path))
           && (expected.method == null || Objects.equals(expected.method, actual.method))
           && (expected.service == null || Objects.equals(expected.service, actual.service))
           && (expected.scheduleTime == null

core/src/test/java/google/registry/tmch/NordnUploadActionTest.java

@@ -252,7 +252,7 @@ class NordnUploadActionTest {
     cloudTasksHelper.assertTasksEnqueued(
         NordnVerifyAction.QUEUE,
         new TaskMatcher()
-            .url(NordnVerifyAction.PATH)
+            .path(NordnVerifyAction.PATH)
             .param(NordnVerifyAction.NORDN_URL_PARAM, LOCATION_URL)
             .param(RequestParameters.PARAM_TLD, "tld")
             .header(CONTENT_TYPE, FORM_DATA.toString()));

core/src/test/java/google/registry/tools/DomainLockUtilsTest.java

@@ -259,7 +259,7 @@ public final class DomainLockUtilsTest {
     cloudTasksHelper.assertTasksEnqueued(
         QUEUE_ASYNC_ACTIONS,
         new TaskMatcher()
-            .url(RelockDomainAction.PATH)
+            .path(RelockDomainAction.PATH)
             .method(HttpMethod.POST)
             .service("backend")
             .param(
@@ -481,7 +481,7 @@ public final class DomainLockUtilsTest {
     cloudTasksHelper.assertTasksEnqueued(
         QUEUE_ASYNC_ACTIONS,
         new CloudTasksHelper.TaskMatcher()
-            .url(RelockDomainAction.PATH)
+            .path(RelockDomainAction.PATH)
             .method(HttpMethod.POST)
             .service("backend")
             .param(

core/src/test/java/google/registry/tools/GcpProjectConnectionTest.java

@@ -73,7 +73,7 @@ final class GcpProjectConnectionTest {
       ByteArrayOutputStream output = new ByteArrayOutputStream();
       getStreamingContent().writeTo(output);
       output.close();
-      return new String(output.toByteArray(), UTF_8);
+      return output.toString(UTF_8);
     }
   }
 
@@ -97,7 +97,7 @@ final class GcpProjectConnectionTest {
         .isEqualTo("MyContent");
     assertThat(httpTransport.method).isEqualTo("GET");
     assertThat(httpTransport.url)
-        .isEqualTo("https://localhost/my/path?query&key1=value1&key2=value2");
+        .isEqualTo("https://tools.example.com/my/path?query&key1=value1&key2=value2");
     assertThat(lowLevelHttpRequest.headers).containsEntry("Cache-Control", "no-cache");
     assertThat(lowLevelHttpRequest.headers).containsEntry("x-requested-with", "RegistryTool");
   }
@@ -113,7 +113,7 @@ final class GcpProjectConnectionTest {
         .isEqualTo("MyContent");
     assertThat(httpTransport.method).isEqualTo("POST");
     assertThat(httpTransport.url)
-        .isEqualTo("https://localhost/my/path?query&key1=value1&key2=value2");
+        .isEqualTo("https://tools.example.com/my/path?query&key1=value1&key2=value2");
     assertThat(lowLevelHttpRequest.getContentType()).isEqualTo("text/plain; charset=utf-8");
     assertThat(lowLevelHttpRequest.getContentString()).isEqualTo("some data");
     assertThat(lowLevelHttpRequest.headers).containsEntry("Cache-Control", "no-cache");
@@ -130,7 +130,7 @@ final class GcpProjectConnectionTest {
                 "/my/path?query", ImmutableMap.of("string", "value1", "bool", true)))
         .containsExactly("key", "value");
     assertThat(httpTransport.method).isEqualTo("POST");
-    assertThat(httpTransport.url).isEqualTo("https://localhost/my/path?query");
+    assertThat(httpTransport.url).isEqualTo("https://tools.example.com/my/path?query");
     assertThat(lowLevelHttpRequest.getContentType()).isEqualTo("application/json; charset=utf-8");
     assertThat(lowLevelHttpRequest.getContentString())
         .isEqualTo("{\"string\":\"value1\",\"bool\":true}");

core/src/test/java/google/registry/tools/GenerateEscrowDepositCommandTest.java

@@ -187,7 +187,7 @@ public class GenerateEscrowDepositCommandTest
     cloudTasksHelper.assertTasksEnqueued(
         "rde-report",
         new TaskMatcher()
-            .url("/_dr/task/rdeStaging")
+            .path("/_dr/task/rdeStaging")
             .param("mode", "THIN")
             .param("lenient", "true")
             .param("watermarks", "2017-01-01T00:00:00.000Z")
@@ -204,7 +204,7 @@ public class GenerateEscrowDepositCommandTest
     cloudTasksHelper.assertTasksEnqueued(
         "rde-report",
         new TaskMatcher()
-            .url("/_dr/task/rdeStaging")
+            .path("/_dr/task/rdeStaging")
             .param("mode", "THIN")
             .param("lenient", "false")
             .param("watermarks", "2017-01-01T00:00:00.000Z")
@@ -221,7 +221,7 @@ public class GenerateEscrowDepositCommandTest
     cloudTasksHelper.assertTasksEnqueued(
         "rde-report",
         new TaskMatcher()
-            .url("/_dr/task/rdeStaging")
+            .path("/_dr/task/rdeStaging")
             .param("lenient", "false")
             .param("mode", "THIN")
             .param("watermarks", "2017-01-01T00:00:00.000Z")
@@ -237,7 +237,7 @@ public class GenerateEscrowDepositCommandTest
     cloudTasksHelper.assertTasksEnqueued(
         "rde-report",
         new TaskMatcher()
-            .url("/_dr/task/rdeStaging")
+            .path("/_dr/task/rdeStaging")
             .param("mode", "FULL")
             .param("lenient", "false")
             .param("watermarks", "2017-01-01T00:00:00.000Z")
@@ -259,7 +259,7 @@ public class GenerateEscrowDepositCommandTest
     cloudTasksHelper.assertTasksEnqueued(
         "rde-report",
         new TaskMatcher()
-            .url("/_dr/task/rdeStaging")
+            .path("/_dr/task/rdeStaging")
             .param("mode", "THIN")
             .param("lenient", "false")
             .param("watermarks", "2017-01-01T00:00:00.000Z,2017-01-02T00:00:00.000Z")

core/src/test/java/google/registry/tools/RequestFactoryModuleTest.java

@@ -35,7 +35,6 @@ import com.google.auth.oauth2.UserCredentials;
 import google.registry.config.RegistryConfig;
 import google.registry.testing.SystemPropertyExtension;
 import google.registry.util.GoogleCredentialsBundle;
-import java.util.Optional;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
@@ -65,7 +64,7 @@ public class RequestFactoryModuleTest {
     RegistryConfig.CONFIG_SETTINGS.get().gcpProject.isLocal = true;
     try {
       HttpRequestFactory factory =
-          RequestFactoryModule.provideHttpRequestFactory(credentialsBundle, Optional.empty());
+          RequestFactoryModule.provideHttpRequestFactory(credentialsBundle, "client-id");
       HttpRequestInitializer initializer = factory.getInitializer();
       assertThat(initializer).isNotNull();
       HttpRequest request = factory.buildGetRequest(new GenericUrl("http://localhost"));
@@ -79,29 +78,7 @@ public class RequestFactoryModuleTest {
   @Test
   void test_provideHttpRequestFactory_remote() throws Exception {
     when(credentialsBundle.getHttpRequestInitializer()).thenReturn(httpRequestInitializer);
-    // Make sure that example.com creates a request factory with the UNITTEST client id but no
-    boolean origIsLocal = RegistryConfig.CONFIG_SETTINGS.get().gcpProject.isLocal;
-    RegistryConfig.CONFIG_SETTINGS.get().gcpProject.isLocal = false;
-    try {
-      HttpRequestFactory factory =
-          RequestFactoryModule.provideHttpRequestFactory(credentialsBundle, Optional.empty());
-      HttpRequestInitializer initializer = factory.getInitializer();
-      assertThat(initializer).isNotNull();
-      // HttpRequestFactory#buildGetRequest() calls initialize() once.
-      HttpRequest request = factory.buildGetRequest(new GenericUrl("http://localhost"));
-      verify(httpRequestInitializer).initialize(request);
-      assertThat(request.getConnectTimeout()).isEqualTo(REQUEST_TIMEOUT_MS);
-      assertThat(request.getReadTimeout()).isEqualTo(REQUEST_TIMEOUT_MS);
-      verifyNoMoreInteractions(httpRequestInitializer);
-    } finally {
-      RegistryConfig.CONFIG_SETTINGS.get().gcpProject.isLocal = origIsLocal;
-    }
-  }
-
-  @Test
-  void test_provideHttpRequestFactory_remote_withIap() throws Exception {
-    when(credentialsBundle.getHttpRequestInitializer()).thenReturn(httpRequestInitializer);
-    // Mock the request/response to/from the IAP server requesting an ID token
+    // Mock the request/response to/from the OIDC server requesting an ID token
     UserCredentials mockUserCredentials = mock(UserCredentials.class);
     when(credentialsBundle.getGoogleCredentials()).thenReturn(mockUserCredentials);
     HttpTransport mockTransport = mock(HttpTransport.class);
@@ -114,17 +91,16 @@ public class RequestFactoryModuleTest {
     HttpResponse mockResponse = mock(HttpResponse.class);
     when(mockPostRequest.execute()).thenReturn(mockResponse);
     GenericData genericDataResponse = new GenericData();
-    genericDataResponse.set("id_token", "iapIdToken");
+    genericDataResponse.set("id_token", "oidc.token");
     when(mockResponse.parseAs(GenericData.class)).thenReturn(genericDataResponse);
 
     boolean origIsLocal = RegistryConfig.CONFIG_SETTINGS.get().gcpProject.isLocal;
     RegistryConfig.CONFIG_SETTINGS.get().gcpProject.isLocal = false;
     try {
       HttpRequestFactory factory =
-          RequestFactoryModule.provideHttpRequestFactory(
-              credentialsBundle, Optional.of("iapClientId"));
+          RequestFactoryModule.provideHttpRequestFactory(credentialsBundle, "clientId");
       HttpRequest request = factory.buildGetRequest(new GenericUrl("http://localhost"));
-      assertThat(request.getHeaders().get("Proxy-Authorization")).isEqualTo("Bearer iapIdToken");
+      assertThat(request.getHeaders().get("Proxy-Authorization")).isEqualTo("Bearer oidc.token");
       assertThat(request.getConnectTimeout()).isEqualTo(REQUEST_TIMEOUT_MS);
       assertThat(request.getReadTimeout()).isEqualTo(REQUEST_TIMEOUT_MS);
       verify(httpRequestInitializer).initialize(request);

core/src/test/java/google/registry/tools/ServiceConnectionTest.java

@@ -26,13 +26,13 @@ public class ServiceConnectionTest {
   void testServerUrl_notCanary() {
     ServiceConnection connection = new ServiceConnection().withService(DEFAULT, false);
     String serverUrl = connection.getServer().toString();
-    assertThat(serverUrl).isEqualTo("https://localhost"); // See default-config.yaml
+    assertThat(serverUrl).isEqualTo("https://default.example.com"); // See default-config.yaml
   }
 
   @Test
   void testServerUrl_canary() {
     ServiceConnection connection = new ServiceConnection().withService(DEFAULT, true);
     String serverUrl = connection.getServer().toString();
-    assertThat(serverUrl).isEqualTo("https://nomulus-dot-localhost");
+    assertThat(serverUrl).isEqualTo("https://nomulus-dot-default.example.com");
   }
 }

core/src/test/java/google/registry/ui/server/registrar/RegistrarSettingsActionTest.java

@@ -70,7 +70,7 @@ class RegistrarSettingsActionTest extends RegistrarSettingsActionTestCase {
     cloudTasksHelper.assertTasksEnqueued(
         "sheet",
         new TaskMatcher()
-            .url(SyncRegistrarsSheetAction.PATH)
+            .path(SyncRegistrarsSheetAction.PATH)
             .service("Backend")
             .method(HttpMethod.GET));
     assertMetric(CLIENT_ID, "update", "[OWNER]", "SUCCESS");