From 8c67fe60e741f8ffca7cb40938f80094a4cadccd Mon Sep 17 00:00:00 2001
From: hidingmyname <hidingmyname@users.noreply.github.com>
Date: Wed, 4 Nov 2026 03:00:04 +0800
Subject: [PATCH] alts: Ignore case when matching the peer service account

AuthorizationUtil.clientAuthorizationCheck used Collection.contains(),
so an expected service account written in mixed case never matched the
peer service account reported by the handshaker. Compare with
String.equalsIgnoreCase() instead, which is what grpc-go's
ClientAuthorizationCheck does (strings.EqualFold). Exact matches are
unaffected.

Fixes #13156
---
 .../main/java/io/grpc/alts/AuthorizationUtil.java   | 13 ++++++++-----
 .../java/io/grpc/alts/AuthorizationUtilTest.java    |  8 ++++++++
 2 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/alts/src/main/java/io/grpc/alts/AuthorizationUtil.java b/alts/src/main/java/io/grpc/alts/AuthorizationUtil.java
index 53e45105d9b..e0d9dede47f 100644
--- a/alts/src/main/java/io/grpc/alts/AuthorizationUtil.java
+++ b/alts/src/main/java/io/grpc/alts/AuthorizationUtil.java
@@ -29,8 +29,8 @@ private AuthorizationUtil() {}
 
   /**
    * Given a server call, performs client authorization check, i.e., checks if the client service
-   * account matches one of the expected service accounts. It returns OK if client is authorized and
-   * an error otherwise.
+   * account matches one of the expected service accounts, ignoring case. It returns OK if client
+   * is authorized and an error otherwise.
    */
   public static Status clientAuthorizationCheck(
       ServerCall<?, ?> call, Collection<String> expectedServiceAccounts) {
@@ -39,10 +39,13 @@ public static Status clientAuthorizationCheck(
     if (altsContext == null) {
       return Status.PERMISSION_DENIED.withDescription("Peer ALTS AuthContext not found");
     }
-    if (expectedServiceAccounts.contains(altsContext.getPeerServiceAccount())) {
-      return Status.OK;
+    String peerServiceAccount = altsContext.getPeerServiceAccount();
+    for (String serviceAccount : expectedServiceAccounts) {
+      if (peerServiceAccount.equalsIgnoreCase(serviceAccount)) {
+        return Status.OK;
+      }
     }
     return Status.PERMISSION_DENIED.withDescription(
-        "Client " + altsContext.getPeerServiceAccount() + " is not authorized");
+        "Client " + peerServiceAccount + " is not authorized");
   }
 }
diff --git a/alts/src/test/java/io/grpc/alts/AuthorizationUtilTest.java b/alts/src/test/java/io/grpc/alts/AuthorizationUtilTest.java
index 8b4691df331..703d80e73b7 100644
--- a/alts/src/test/java/io/grpc/alts/AuthorizationUtilTest.java
+++ b/alts/src/test/java/io/grpc/alts/AuthorizationUtilTest.java
@@ -55,6 +55,14 @@ public void altsAuthorizationCheck() throws Exception {
     assertThat(status.getDescription()).endsWith("not authorized");
   }
 
+  @Test
+  public void altsAuthorizationCheck_ignoresCase() throws Exception {
+    Status status =
+        AuthorizationUtil.clientAuthorizationCheck(
+            new FakeServerCall("alice"), Lists.newArrayList("ALICE", "Bob"));
+    assertThat(status.getCode()).isEqualTo(Status.Code.OK);
+  }
+
   private static class FakeServerCall extends ServerCall<String, String> {
     final Attributes attrs;