[Bigtable] LongRunning API response throws auth error on polling

[yash30201]

Environment details

• OS:Debian
• PHP version:8.1
• Package name and version: cloud-bigtable:1.24.0

Steps to reproduce

Try any operation which returns an instance of a long running API (\Google\ApiCore\OperationResponse) and poll it untill completion in Bigtable's PHP client library. For eg, to create an instance, we can just try running the create_production_instance sample.

Code example

It's reproducible from the above code snippet.

Code

```php projectName($projectId); $instanceName = $instanceAdminClient->instanceName($projectId, $instanceId); $serveNodes = 3; $storageType = StorageType::SSD; $production = InstanceType::PRODUCTION; $labels = ['prod-label' => 'prod-label']; $instance = new Instance(); $instance->setDisplayName($instanceId); $instance->setLabels($labels); $instance->setType($production); $cluster = new Cluster(); $cluster->setDefaultStorageType($storageType); $locationName = $instanceAdminClient->locationName($projectId, $locationId); $cluster->setLocation($locationName); $cluster->setServeNodes($serveNodes); $clusters = [ $clusterId => $cluster ]; try { $instanceAdminClient->getInstance($instanceName); printf('Instance %s already exists.' . PHP_EOL, $instanceId); throw new Exception(sprintf('Instance %s already exists.' . PHP_EOL, $instanceId)); } catch (ApiException $e) { if ($e->getStatus() === 'NOT_FOUND') { printf('Creating an Instance: %s' . PHP_EOL, $instanceId); $operationResponse = $instanceAdminClient->createInstance( $projectName, $instanceId, $instance, $clusters ); $operationResponse->pollUntilComplete(); if (!$operationResponse->operationSucceeded()) { print('Error: ' . $operationResponse->getError()->getMessage()); } else { printf('Instance %s created.', $instanceId); } } else { throw $e; } } } create_production_instance( 'PROJECT_ID', 'INSTANCE_ID', 'CLUSTER_ID', 'LOCATION_ID' ); ```

Error log / message

PHP Fatal error:  Uncaught Google\ApiCore\ApiException: {
    "message": "Request had invalid authentication credentials. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https:\/\/developers.google.com\/identity\/sign-in\/web\/devconsole-project.",
    "code": 16,
    "status": "UNAUTHENTICATED",
    "details": [
        {
            "@type": "google.rpc.debuginfo-bin",
            "stackEntries": [],
            "detail": "Authentication error: 16; Error Details: Audience mismatch. Audience should be one of the following: [https:\/\/bigtableadmin.googleapis.com\/, https:\/\/bigtableadmin.googleapis.com\/google.longrunning.Operations, https:\/\/bigtableadmin.googleapis.com\/, https:\/\/bigtableadmin.clients6.google.com\/, https:\/\/content-bigtableadmin.googleapis.com\/, https:\/\/bigtableadmin.mtls.googleapis.com\/, https:\/\/bigtableadmin.mtls.clients6.google.com\/, https:\/\/content-bigtableadmin.mtls.googleapis.com\/], but is https:\/\/longrunning.googleapis.com\/."
        },
        {
            "@type": "grpc-status-details-bin",
            "data": "<Unknown Binary Data>"
        }
    ]
}

  thrown in [YOUR_DIR]/Bigtable/vendor/google/gax/src/ApiException.php on line 267

Reason of this issue

Mentioned in comment

[yash30201]

Observed that this issue started arising from version 1.7.1 of the cloud-bigtable package. On running for 1.7.0 and below, the code snippet runs perfectly fine.

~The PR after which Bigtable started experiencing this error is: PR 3576. Observing this PR brings us to the reason of this issue:~

~This is due to the changing of fieldName from scopes to defaultScopes in credentialsConfig in Gapic base clients~

[yash30201]

Verified that this is happening in both php7.4 and php8.2

[oytuntez]

We also started seeing this error in vision library. Reverting back to 1.6.5.

[yash30201]

Confirmed that this is happening across all the products in which APIs return a operationResponse to depict an long running process upon which that can be polled until it's completed.

The affected products(at least) are(found by searching samples which have pollUntilComplete()):

• Asset
• Bigtable
• Compute
  • Firewall
  • Instances
• Media
  • Livestream
• ~Spanner~ (Spanner handles these apis in an entire different way by using their handwritten layer to create an instance of LongRunningOperation implemented in Core. This receives parent's $connection and auth scopes are transferred here correctly as parent's scopes are also forwarded.(code pointer of instantiation)
• Speech
• Translate
• Video
• Vision

The error seems to be that scopes of parent product are not getting passed down to the long running api and thus the requests made by that long running api (essentially pollUntilComplete() fails due to the auth error.

[yash30201]

I'm not sure right now why the tests for these are not failing, investigating this.

Updated: The reason is that issue error arised due to a recent update in gax-php and we don't have any updates in any of these affected libraries in the past month, thus undetected. This PR helped in tracking down the reason.

[bshaffer]

This should be fixed in the latest release (v1.21.1)

[yash30201]

I've confirmed by running tests that the related API's are running perfectly fine, hence closing this issue.