fix(oauth2_http): Avoid retrying on 4xx errors during GCE metadata ping

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/ComputeEngineCredentials.java

@@ -673,6 +673,10 @@ private static boolean pingComputeEngineMetadata(
       } catch (SocketTimeoutException expected) {
         // Ignore logging timeouts which is the expected failure mode in non GCE environments.
       } catch (IOException e) {
+        if (e instanceof HttpResponseException
+            && ((HttpResponseException) e).getStatusCode() == 403) {
+          return false;
+        }
         LOGGER.log(
             Level.FINE,
             "Encountered an unexpected exception when checking"

google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/ComputeEngineCredentialsTest.java

@@ -1177,6 +1177,23 @@ void getProjectId_explicitSet_noMDsCall() {
     assertEquals(0, transportFactory.transport.getRequestCount());
   }
 
+  @Test
+  void isOnGce_forbidden_doesNotRetry() {
+    MockMetadataServerTransportFactory transportFactory = new MockMetadataServerTransportFactory();
+    transportFactory.transport.setStatusCode(HttpStatusCodes.STATUS_CODE_FORBIDDEN);
+    UnknownOsCredentialsProvider provider = new UnknownOsCredentialsProvider();
+    boolean isOnGce = ComputeEngineCredentials.isOnGce(transportFactory, provider);
+    assertFalse(isOnGce);
+    assertEquals(1, transportFactory.transport.getRequestCount());
+  }
+
+  static class UnknownOsCredentialsProvider extends DefaultCredentialsProvider {
+    @Override
+    String getOsName() {
+      return "Unknown";
+    }
+  }
+
   static class MockMetadataServerTransportFactory implements HttpTransportFactory {
 
     MockMetadataServerTransport transport =

google-auth-library-java/oauth2_http/javatests/com/google/auth/oauth2/MockMetadataServerTransport.java

@@ -71,6 +71,11 @@ public class MockMetadataServerTransport extends MockHttpTransport {
 
   private boolean emptyContent;
   private MockLowLevelHttpRequest request;
+  private int requestCount = 0;
+
+  public int getRequestCount() {
+    return requestCount;
+  }
 
   public MockMetadataServerTransport() {}
 
@@ -125,6 +130,7 @@ public MockLowLevelHttpRequest getRequest() {
 
   @Override
   public LowLevelHttpRequest buildRequest(String method, String url) throws IOException {
+    requestCount++;
     if (url.startsWith(ComputeEngineCredentials.getTokenServerEncodedUrl())) {
       this.request = getMockRequestForTokenEndpoint(url);
       return this.request;

java-showcase/.repo-metadata.json

@@ -11,6 +11,5 @@
   "repo_short": "java-showcase",
   "distribution_name": "com.google.cloud:gapic-showcase",
   "library_type": "OTHER",
-  "requires_billing": true,
-  "excluded_poms": "gapic-showcase-bom"
+  "requires_billing": true
 }