Merge github.com:grpc/grpc into immolating-conversion

36 files changed, 480 insertions, 214 deletions

diff --git a/test/cpp/client/credentials_test.cc b/test/cpp/client/credentials_test.cc
index 6fb24d71e5..743ad065d1 100644
--- a/test/cpp/client/credentials_test.cc
+++ b/test/cpp/client/credentials_test.cc
@@ -31,7 +31,7 @@
  *
  */
 
-#include <grpc++/credentials.h>
+#include <grpc++/security/credentials.h>
 
 #include <memory>
 
@@ -45,8 +45,8 @@ class CredentialsTest : public ::testing::Test {
  protected:
 };
 
-TEST_F(CredentialsTest, InvalidServiceAccountCreds) {
-  std::shared_ptr<Credentials> bad1 = ServiceAccountCredentials("", "", 1);
+TEST_F(CredentialsTest, InvalidGoogleRefreshToken) {
+  std::shared_ptr<Credentials> bad1 = GoogleRefreshTokenCredentials("");
   EXPECT_EQ(static_cast<Credentials*>(nullptr), bad1.get());
 }
 
diff --git a/test/cpp/common/auth_property_iterator_test.cc b/test/cpp/common/auth_property_iterator_test.cc
index 630c38c7f6..a629ff5a90 100644
--- a/test/cpp/common/auth_property_iterator_test.cc
+++ b/test/cpp/common/auth_property_iterator_test.cc
@@ -32,14 +32,17 @@
  */
 
 #include <grpc/grpc_security.h>
-#include <grpc++/support/auth_context.h>
+#include <grpc++/security/auth_context.h>
 #include <gtest/gtest.h>
 #include "src/cpp/common/secure_auth_context.h"
+#include "test/cpp/util/string_ref_helper.h"
 
 extern "C" {
 #include "src/core/security/security_context.h"
 }
 
+using ::grpc::testing::ToString;
+
 namespace grpc {
 namespace {
 
@@ -84,12 +87,12 @@ TEST_F(AuthPropertyIteratorTest, GeneralTest) {
   AuthProperty p1 = *iter;
   iter++;
   AuthProperty p2 = *iter;
-  EXPECT_EQ("name", p0.first);
-  EXPECT_EQ("chapi", p0.second);
-  EXPECT_EQ("name", p1.first);
-  EXPECT_EQ("chapo", p1.second);
-  EXPECT_EQ("foo", p2.first);
-  EXPECT_EQ("bar", p2.second);
+  EXPECT_EQ("name", ToString(p0.first));
+  EXPECT_EQ("chapi", ToString(p0.second));
+  EXPECT_EQ("name", ToString(p1.first));
+  EXPECT_EQ("chapo", ToString(p1.second));
+  EXPECT_EQ("foo", ToString(p2.first));
+  EXPECT_EQ("bar", ToString(p2.second));
   ++iter;
   EXPECT_EQ(empty_iter, iter);
 }
diff --git a/test/cpp/common/secure_auth_context_test.cc b/test/cpp/common/secure_auth_context_test.cc
index c71ef58023..11de646999 100644
--- a/test/cpp/common/secure_auth_context_test.cc
+++ b/test/cpp/common/secure_auth_context_test.cc
@@ -32,14 +32,17 @@
  */
 
 #include <grpc/grpc_security.h>
-#include <grpc++/support/auth_context.h>
+#include <grpc++/security/auth_context.h>
 #include <gtest/gtest.h>
 #include "src/cpp/common/secure_auth_context.h"
+#include "test/cpp/util/string_ref_helper.h"
 
 extern "C" {
 #include "src/core/security/security_context.h"
 }
 
+using grpc::testing::ToString;
+
 namespace grpc {
 namespace {
 
@@ -47,7 +50,7 @@ class SecureAuthContextTest : public ::testing::Test {};
 
 // Created with nullptr
 TEST_F(SecureAuthContextTest, EmptyContext) {
-  SecureAuthContext context(nullptr);
+  SecureAuthContext context(nullptr, true);
   EXPECT_TRUE(context.GetPeerIdentity().empty());
   EXPECT_TRUE(context.GetPeerIdentityPropertyName().empty());
   EXPECT_TRUE(context.FindPropertyValues("").empty());
@@ -57,30 +60,30 @@ TEST_F(SecureAuthContextTest, EmptyContext) {
 
 TEST_F(SecureAuthContextTest, Properties) {
   grpc_auth_context* ctx = grpc_auth_context_create(NULL);
-  grpc_auth_context_add_cstring_property(ctx, "name", "chapi");
-  grpc_auth_context_add_cstring_property(ctx, "name", "chapo");
-  grpc_auth_context_add_cstring_property(ctx, "foo", "bar");
-  EXPECT_EQ(1, grpc_auth_context_set_peer_identity_property_name(ctx, "name"));
+  SecureAuthContext context(ctx, true);
+  context.AddProperty("name", "chapi");
+  context.AddProperty("name", "chapo");
+  context.AddProperty("foo", "bar");
+  EXPECT_TRUE(context.SetPeerIdentityPropertyName("name"));
 
-  SecureAuthContext context(ctx);
-  std::vector<grpc::string> peer_identity = context.GetPeerIdentity();
+  std::vector<grpc::string_ref> peer_identity = context.GetPeerIdentity();
   EXPECT_EQ(2u, peer_identity.size());
-  EXPECT_EQ("chapi", peer_identity[0]);
-  EXPECT_EQ("chapo", peer_identity[1]);
+  EXPECT_EQ("chapi", ToString(peer_identity[0]));
+  EXPECT_EQ("chapo", ToString(peer_identity[1]));
   EXPECT_EQ("name", context.GetPeerIdentityPropertyName());
-  std::vector<grpc::string> bar = context.FindPropertyValues("foo");
+  std::vector<grpc::string_ref> bar = context.FindPropertyValues("foo");
   EXPECT_EQ(1u, bar.size());
-  EXPECT_EQ("bar", bar[0]);
+  EXPECT_EQ("bar", ToString(bar[0]));
 }
 
 TEST_F(SecureAuthContextTest, Iterators) {
   grpc_auth_context* ctx = grpc_auth_context_create(NULL);
-  grpc_auth_context_add_cstring_property(ctx, "name", "chapi");
-  grpc_auth_context_add_cstring_property(ctx, "name", "chapo");
-  grpc_auth_context_add_cstring_property(ctx, "foo", "bar");
-  EXPECT_EQ(1, grpc_auth_context_set_peer_identity_property_name(ctx, "name"));
+  SecureAuthContext context(ctx, true);
+  context.AddProperty("name", "chapi");
+  context.AddProperty("name", "chapo");
+  context.AddProperty("foo", "bar");
+  EXPECT_TRUE(context.SetPeerIdentityPropertyName("name"));
 
-  SecureAuthContext context(ctx);
   AuthPropertyIterator iter = context.begin();
   EXPECT_TRUE(context.end() != iter);
   AuthProperty p0 = *iter;
@@ -88,12 +91,12 @@ TEST_F(SecureAuthContextTest, Iterators) {
   AuthProperty p1 = *iter;
   iter++;
   AuthProperty p2 = *iter;
-  EXPECT_EQ("name", p0.first);
-  EXPECT_EQ("chapi", p0.second);
-  EXPECT_EQ("name", p1.first);
-  EXPECT_EQ("chapo", p1.second);
-  EXPECT_EQ("foo", p2.first);
-  EXPECT_EQ("bar", p2.second);
+  EXPECT_EQ("name", ToString(p0.first));
+  EXPECT_EQ("chapi", ToString(p0.second));
+  EXPECT_EQ("name", ToString(p1.first));
+  EXPECT_EQ("chapo", ToString(p1.second));
+  EXPECT_EQ("foo", ToString(p2.first));
+  EXPECT_EQ("bar", ToString(p2.second));
   ++iter;
   EXPECT_EQ(context.end(), iter);
 }
diff --git a/test/cpp/end2end/async_end2end_test.cc b/test/cpp/end2end/async_end2end_test.cc
index 41b91e459b..cfb6c21edc 100644
--- a/test/cpp/end2end/async_end2end_test.cc
+++ b/test/cpp/end2end/async_end2end_test.cc
@@ -39,11 +39,9 @@
 #include <grpc++/channel.h>
 #include <grpc++/client_context.h>
 #include <grpc++/create_channel.h>
-#include <grpc++/credentials.h>
 #include <grpc++/server.h>
 #include <grpc++/server_builder.h>
 #include <grpc++/server_context.h>
-#include <grpc++/server_credentials.h>
 #include <gtest/gtest.h>
 
 #include "test/core/util/port.h"
@@ -200,9 +198,9 @@ class AsyncEnd2endTest : public ::testing::TestWithParam<bool> {
   }
 
   void ResetStub() {
-    std::shared_ptr<Channel> channel = CreateChannel(
-        server_address_.str(), InsecureCredentials(), ChannelArguments());
-    stub_ = std::move(grpc::cpp::test::util::TestService::NewStub(channel));
+    std::shared_ptr<Channel> channel =
+        CreateChannel(server_address_.str(), InsecureCredentials());
+    stub_ = grpc::cpp::test::util::TestService::NewStub(channel);
   }
 
   void SendRpc(int num_rpcs) {
@@ -750,11 +748,10 @@ TEST_P(AsyncEnd2endTest, ServerCheckDone) {
 }
 
 TEST_P(AsyncEnd2endTest, UnimplementedRpc) {
-  std::shared_ptr<Channel> channel = CreateChannel(
-      server_address_.str(), InsecureCredentials(), ChannelArguments());
+  std::shared_ptr<Channel> channel =
+      CreateChannel(server_address_.str(), InsecureCredentials());
   std::unique_ptr<grpc::cpp::test::util::UnimplementedService::Stub> stub;
-  stub =
-      std::move(grpc::cpp::test::util::UnimplementedService::NewStub(channel));
+  stub = grpc::cpp::test::util::UnimplementedService::NewStub(channel);
   EchoRequest send_request;
   EchoResponse recv_response;
   Status recv_status;
diff --git a/test/cpp/end2end/client_crash_test.cc b/test/cpp/end2end/client_crash_test.cc
index 3359080cec..058e696166 100644
--- a/test/cpp/end2end/client_crash_test.cc
+++ b/test/cpp/end2end/client_crash_test.cc
@@ -37,11 +37,9 @@
 #include <grpc++/channel.h>
 #include <grpc++/client_context.h>
 #include <grpc++/create_channel.h>
-#include <grpc++/credentials.h>
 #include <grpc++/server.h>
 #include <grpc++/server_builder.h>
 #include <grpc++/server_context.h>
-#include <grpc++/server_credentials.h>
 #include <gtest/gtest.h>
 
 #include "test/core/util/port.h"
@@ -76,7 +74,7 @@ class CrashTest : public ::testing::Test {
     }));
     GPR_ASSERT(server_);
     return grpc::cpp::test::util::TestService::NewStub(
-        CreateChannel(addr, InsecureCredentials(), ChannelArguments()));
+        CreateChannel(addr, InsecureCredentials()));
   }
 
   void KillServer() { server_.reset(); }
diff --git a/test/cpp/end2end/client_crash_test_server.cc b/test/cpp/end2end/client_crash_test_server.cc
index 79a7832874..7ffeecca70 100644
--- a/test/cpp/end2end/client_crash_test_server.cc
+++ b/test/cpp/end2end/client_crash_test_server.cc
@@ -39,7 +39,6 @@
 #include <grpc++/server.h>
 #include <grpc++/server_builder.h>
 #include <grpc++/server_context.h>
-#include <grpc++/server_credentials.h>
 #include "test/cpp/util/echo.grpc.pb.h"
 
 DEFINE_string(address, "", "Address to bind to");
diff --git a/test/cpp/end2end/end2end_test.cc b/test/cpp/end2end/end2end_test.cc
index 0d5bf36df7..bd829d96e1 100644
--- a/test/cpp/end2end/end2end_test.cc
+++ b/test/cpp/end2end/end2end_test.cc
@@ -40,11 +40,12 @@
 #include <grpc++/channel.h>
 #include <grpc++/client_context.h>
 #include <grpc++/create_channel.h>
-#include <grpc++/credentials.h>
+#include <grpc++/security/auth_metadata_processor.h>
+#include <grpc++/security/credentials.h>
+#include <grpc++/security/server_credentials.h>
 #include <grpc++/server.h>
 #include <grpc++/server_builder.h>
 #include <grpc++/server_context.h>
-#include <grpc++/server_credentials.h>
 #include <gtest/gtest.h>
 
 #include "src/core/security/credentials.h"
@@ -79,14 +80,23 @@ void MaybeEchoDeadline(ServerContext* context, const EchoRequest* request,
   }
 }
 
-void CheckServerAuthContext(const ServerContext* context) {
+void CheckServerAuthContext(const ServerContext* context,
+                            const grpc::string& expected_client_identity) {
   std::shared_ptr<const AuthContext> auth_ctx = context->auth_context();
-  std::vector<grpc::string> ssl =
+  std::vector<grpc::string_ref> ssl =
       auth_ctx->FindPropertyValues("transport_security_type");
   EXPECT_EQ(1u, ssl.size());
-  EXPECT_EQ("ssl", ssl[0]);
-  EXPECT_TRUE(auth_ctx->GetPeerIdentityPropertyName().empty());
-  EXPECT_TRUE(auth_ctx->GetPeerIdentity().empty());
+  EXPECT_EQ("ssl", ToString(ssl[0]));
+  if (expected_client_identity.length() == 0) {
+    EXPECT_TRUE(auth_ctx->GetPeerIdentityPropertyName().empty());
+    EXPECT_TRUE(auth_ctx->GetPeerIdentity().empty());
+    EXPECT_FALSE(auth_ctx->IsPeerAuthenticated());
+  } else {
+    auto identity = auth_ctx->GetPeerIdentity();
+    EXPECT_TRUE(auth_ctx->IsPeerAuthenticated());
+    EXPECT_EQ(1u, identity.size());
+    EXPECT_EQ(expected_client_identity, identity[0]);
+  }
 }
 
 bool CheckIsLocalhost(const grpc::string& addr) {
@@ -98,6 +108,54 @@ bool CheckIsLocalhost(const grpc::string& addr) {
          addr.substr(0, kIpv6.size()) == kIpv6;
 }
 
+class TestAuthMetadataProcessor : public AuthMetadataProcessor {
+ public:
+  static const char kGoodGuy[];
+
+  TestAuthMetadataProcessor(bool is_blocking) : is_blocking_(is_blocking) {}
+
+  std::shared_ptr<Credentials> GetCompatibleClientCreds() {
+    return AccessTokenCredentials(kGoodGuy);
+  }
+  std::shared_ptr<Credentials> GetIncompatibleClientCreds() {
+    return AccessTokenCredentials("Mr Hyde");
+  }
+
+  // Interface implementation
+  bool IsBlocking() const GRPC_OVERRIDE { return is_blocking_; }
+
+  Status Process(const InputMetadata& auth_metadata, AuthContext* context,
+                 OutputMetadata* consumed_auth_metadata,
+                 OutputMetadata* response_metadata) GRPC_OVERRIDE {
+    EXPECT_TRUE(consumed_auth_metadata != nullptr);
+    EXPECT_TRUE(context != nullptr);
+    EXPECT_TRUE(response_metadata != nullptr);
+    auto auth_md = auth_metadata.find(GRPC_AUTHORIZATION_METADATA_KEY);
+    EXPECT_NE(auth_md, auth_metadata.end());
+    string_ref auth_md_value = auth_md->second;
+    if (auth_md_value.ends_with(kGoodGuy)) {
+      context->AddProperty(kIdentityPropName, kGoodGuy);
+      context->SetPeerIdentityPropertyName(kIdentityPropName);
+      consumed_auth_metadata->insert(
+          std::make_pair(string(auth_md->first.data(), auth_md->first.length()),
+                         auth_md->second));
+      return Status::OK;
+    } else {
+      return Status(StatusCode::UNAUTHENTICATED,
+                    string("Invalid principal: ") +
+                        string(auth_md_value.data(), auth_md_value.length()));
+    }
+  }
+
+ protected:
+  static const char kIdentityPropName[];
+  bool is_blocking_;
+};
+
+const char TestAuthMetadataProcessor::kGoodGuy[] = "Dr Jekyll";
+const char TestAuthMetadataProcessor::kIdentityPropName[] = "novel identity";
+
+
 }  // namespace
 
 class Proxy : public ::grpc::cpp::test::util::TestService::Service {
@@ -162,8 +220,10 @@ class TestServiceImpl : public ::grpc::cpp::test::util::TestService::Service {
                                      ToString(iter->second));
       }
     }
-    if (request->has_param() && request->param().check_auth_context()) {
-      CheckServerAuthContext(context);
+    if (request->has_param() &&
+        (request->param().expected_client_identity().length() > 0 ||
+         request->param().check_auth_context())) {
+      CheckServerAuthContext(context, request->param().expected_client_identity());
     }
     if (request->has_param() &&
         request->param().response_message_length() > 0) {
@@ -259,9 +319,18 @@ class TestServiceImplDupPkg
 class End2endTest : public ::testing::TestWithParam<bool> {
  protected:
   End2endTest()
-      : kMaxMessageSize_(8192), special_service_("special") {}
+      : is_server_started_(false),
+        kMaxMessageSize_(8192),
+        special_service_("special") {}
+
+  void TearDown() GRPC_OVERRIDE {
+    if (is_server_started_) {
+      server_->Shutdown();
+      if (proxy_server_) proxy_server_->Shutdown();
+    }
+  }
 
-  void SetUp() GRPC_OVERRIDE {
+  void StartServer(const std::shared_ptr<AuthMetadataProcessor>& processor) {
     int port = grpc_pick_unused_port_or_die();
     server_address_ << "127.0.0.1:" << port;
     // Setup server
@@ -271,28 +340,29 @@ class End2endTest : public ::testing::TestWithParam<bool> {
     SslServerCredentialsOptions ssl_opts;
     ssl_opts.pem_root_certs = "";
     ssl_opts.pem_key_cert_pairs.push_back(pkcp);
-    builder.AddListeningPort(server_address_.str(),
-                             SslServerCredentials(ssl_opts));
+    auto server_creds = SslServerCredentials(ssl_opts);
+    server_creds->SetAuthMetadataProcessor(processor);
+    builder.AddListeningPort(server_address_.str(), server_creds);
     builder.RegisterService(&service_);
     builder.RegisterService("foo.test.youtube.com", &special_service_);
     builder.SetMaxMessageSize(
         kMaxMessageSize_);  // For testing max message size.
     builder.RegisterService(&dup_pkg_service_);
     server_ = builder.BuildAndStart();
-  }
-
-  void TearDown() GRPC_OVERRIDE {
-    server_->Shutdown();
-    if (proxy_server_) proxy_server_->Shutdown();
+    is_server_started_ = true;
   }
 
   void ResetChannel() {
+    if (!is_server_started_) {
+      StartServer(std::shared_ptr<AuthMetadataProcessor>());
+    }
+    EXPECT_TRUE(is_server_started_);
     SslCredentialsOptions ssl_opts = {test_root_cert, "", ""};
     ChannelArguments args;
     args.SetSslTargetNameOverride("foo.test.google.fr");
     args.SetString(GRPC_ARG_SECONDARY_USER_AGENT_STRING, "end2end_test");
-    channel_ =
-        CreateChannel(server_address_.str(), SslCredentials(ssl_opts), args);
+    channel_ = CreateCustomChannel(server_address_.str(),
+                                   SslCredentials(ssl_opts), args);
   }
 
   void ResetStub(bool use_proxy) {
@@ -307,13 +377,13 @@ class End2endTest : public ::testing::TestWithParam<bool> {
       builder.RegisterService(proxy_service_.get());
       proxy_server_ = builder.BuildAndStart();
 
-      channel_ = CreateChannel(proxyaddr.str(), InsecureCredentials(),
-                               ChannelArguments());
+      channel_ = CreateChannel(proxyaddr.str(), InsecureCredentials());
     }
 
-    stub_ = std::move(grpc::cpp::test::util::TestService::NewStub(channel_));
+    stub_ = grpc::cpp::test::util::TestService::NewStub(channel_);
   }
 
+  bool is_server_started_;
   std::shared_ptr<Channel> channel_;
   std::unique_ptr<grpc::cpp::test::util::TestService::Stub> stub_;
   std::unique_ptr<Server> server_;
@@ -563,10 +633,10 @@ TEST_F(End2endTest, DiffPackageServices) {
 
 // rpc and stream should fail on bad credentials.
 TEST_F(End2endTest, BadCredentials) {
-  std::shared_ptr<Credentials> bad_creds = ServiceAccountCredentials("", "", 1);
+  std::shared_ptr<Credentials> bad_creds = GoogleRefreshTokenCredentials("");
   EXPECT_EQ(static_cast<Credentials*>(nullptr), bad_creds.get());
   std::shared_ptr<Channel> channel =
-      CreateChannel(server_address_.str(), bad_creds, ChannelArguments());
+      CreateChannel(server_address_.str(), bad_creds);
   std::unique_ptr<grpc::cpp::test::util::TestService::Stub> stub(
       grpc::cpp::test::util::TestService::NewStub(channel));
   EchoRequest request;
@@ -744,7 +814,7 @@ TEST_F(End2endTest, SetPerCallCredentials) {
   EchoResponse response;
   ClientContext context;
   std::shared_ptr<Credentials> creds =
-      IAMCredentials("fake_token", "fake_selector");
+      GoogleIAMCredentials("fake_token", "fake_selector");
   context.set_credentials(creds);
   request.set_message("Hello");
   request.mutable_param()->set_echo_metadata(true);
@@ -781,10 +851,10 @@ TEST_F(End2endTest, OverridePerCallCredentials) {
   EchoResponse response;
   ClientContext context;
   std::shared_ptr<Credentials> creds1 =
-      IAMCredentials("fake_token1", "fake_selector1");
+      GoogleIAMCredentials("fake_token1", "fake_selector1");
   context.set_credentials(creds1);
   std::shared_ptr<Credentials> creds2 =
-      IAMCredentials("fake_token2", "fake_selector2");
+      GoogleIAMCredentials("fake_token2", "fake_selector2");
   context.set_credentials(creds2);
   request.set_message("Hello");
   request.mutable_param()->set_echo_metadata(true);
@@ -806,6 +876,82 @@ TEST_F(End2endTest, OverridePerCallCredentials) {
   EXPECT_TRUE(s.ok());
 }
 
+TEST_F(End2endTest, NonBlockingAuthMetadataProcessorSuccess) {
+  auto* processor = new TestAuthMetadataProcessor(false);
+  StartServer(std::shared_ptr<AuthMetadataProcessor>(processor));
+  ResetStub(false);
+  EchoRequest request;
+  EchoResponse response;
+  ClientContext context;
+  context.set_credentials(processor->GetCompatibleClientCreds());
+  request.set_message("Hello");
+  request.mutable_param()->set_echo_metadata(true);
+  request.mutable_param()->set_expected_client_identity(
+      TestAuthMetadataProcessor::kGoodGuy);
+
+  Status s = stub_->Echo(&context, request, &response);
+  EXPECT_EQ(request.message(), response.message());
+  EXPECT_TRUE(s.ok());
+
+  // Metadata should have been consumed by the processor.
+  EXPECT_FALSE(MetadataContains(
+      context.GetServerTrailingMetadata(), GRPC_AUTHORIZATION_METADATA_KEY,
+      grpc::string("Bearer ") + TestAuthMetadataProcessor::kGoodGuy));
+}
+
+TEST_F(End2endTest, NonBlockingAuthMetadataProcessorFailure) {
+  auto* processor = new TestAuthMetadataProcessor(false);
+  StartServer(std::shared_ptr<AuthMetadataProcessor>(processor));
+  ResetStub(false);
+  EchoRequest request;
+  EchoResponse response;
+  ClientContext context;
+  context.set_credentials(processor->GetIncompatibleClientCreds());
+  request.set_message("Hello");
+
+  Status s = stub_->Echo(&context, request, &response);
+  EXPECT_FALSE(s.ok());
+  EXPECT_EQ(s.error_code(), StatusCode::UNAUTHENTICATED);
+}
+
+TEST_F(End2endTest, BlockingAuthMetadataProcessorSuccess) {
+  auto* processor = new TestAuthMetadataProcessor(true);
+  StartServer(std::shared_ptr<AuthMetadataProcessor>(processor));
+  ResetStub(false);
+  EchoRequest request;
+  EchoResponse response;
+  ClientContext context;
+  context.set_credentials(processor->GetCompatibleClientCreds());
+  request.set_message("Hello");
+  request.mutable_param()->set_echo_metadata(true);
+  request.mutable_param()->set_expected_client_identity(
+      TestAuthMetadataProcessor::kGoodGuy);
+
+  Status s = stub_->Echo(&context, request, &response);
+  EXPECT_EQ(request.message(), response.message());
+  EXPECT_TRUE(s.ok());
+
+  // Metadata should have been consumed by the processor.
+  EXPECT_FALSE(MetadataContains(
+      context.GetServerTrailingMetadata(), GRPC_AUTHORIZATION_METADATA_KEY,
+      grpc::string("Bearer ") + TestAuthMetadataProcessor::kGoodGuy));
+}
+
+TEST_F(End2endTest, BlockingAuthMetadataProcessorFailure) {
+  auto* processor = new TestAuthMetadataProcessor(true);
+  StartServer(std::shared_ptr<AuthMetadataProcessor>(processor));
+  ResetStub(false);
+  EchoRequest request;
+  EchoResponse response;
+  ClientContext context;
+  context.set_credentials(processor->GetIncompatibleClientCreds());
+  request.set_message("Hello");
+
+  Status s = stub_->Echo(&context, request, &response);
+  EXPECT_FALSE(s.ok());
+  EXPECT_EQ(s.error_code(), StatusCode::UNAUTHENTICATED);
+}
+
 // Client sends 20 requests and the server returns CANCELLED status after
 // reading 10 requests.
 TEST_F(End2endTest, RequestStreamServerEarlyCancelTest) {
@@ -840,16 +986,17 @@ TEST_F(End2endTest, ClientAuthContext) {
   EXPECT_TRUE(s.ok());
 
   std::shared_ptr<const AuthContext> auth_ctx = context.auth_context();
-  std::vector<grpc::string> ssl =
+  std::vector<grpc::string_ref> ssl =
       auth_ctx->FindPropertyValues("transport_security_type");
   EXPECT_EQ(1u, ssl.size());
-  EXPECT_EQ("ssl", ssl[0]);
+  EXPECT_EQ("ssl", ToString(ssl[0]));
   EXPECT_EQ("x509_subject_alternative_name",
             auth_ctx->GetPeerIdentityPropertyName());
   EXPECT_EQ(3u, auth_ctx->GetPeerIdentity().size());
-  EXPECT_EQ("*.test.google.fr", auth_ctx->GetPeerIdentity()[0]);
-  EXPECT_EQ("waterzooi.test.google.be", auth_ctx->GetPeerIdentity()[1]);
-  EXPECT_EQ("*.test.youtube.com", auth_ctx->GetPeerIdentity()[2]);
+  EXPECT_EQ("*.test.google.fr", ToString(auth_ctx->GetPeerIdentity()[0]));
+  EXPECT_EQ("waterzooi.test.google.be",
+            ToString(auth_ctx->GetPeerIdentity()[1]));
+  EXPECT_EQ("*.test.youtube.com", ToString(auth_ctx->GetPeerIdentity()[2]));
 }
 
 // Make the response larger than the flow control window.
@@ -933,8 +1080,7 @@ TEST_F(End2endTest, ChannelState) {
 TEST_F(End2endTest, NonExistingService) {
   ResetChannel();
   std::unique_ptr<grpc::cpp::test::util::UnimplementedService::Stub> stub;
-  stub =
-      std::move(grpc::cpp::test::util::UnimplementedService::NewStub(channel_));
+  stub = grpc::cpp::test::util::UnimplementedService::NewStub(channel_);
 
   EchoRequest request;
   EchoResponse response;
diff --git a/test/cpp/end2end/generic_end2end_test.cc b/test/cpp/end2end/generic_end2end_test.cc
index 809eef058c..6a46916728 100644
--- a/test/cpp/end2end/generic_end2end_test.cc
+++ b/test/cpp/end2end/generic_end2end_test.cc
@@ -40,13 +40,11 @@
 #include <grpc++/channel.h>
 #include <grpc++/client_context.h>
 #include <grpc++/create_channel.h>
-#include <grpc++/credentials.h>
 #include <grpc++/generic/async_generic_service.h>
 #include <grpc++/generic/generic_stub.h>
 #include <grpc++/server.h>
 #include <grpc++/server_builder.h>
 #include <grpc++/server_context.h>
-#include <grpc++/server_credentials.h>
 #include <grpc++/support/slice.h>
 #include <gtest/gtest.h>
 
@@ -121,8 +119,8 @@ class GenericEnd2endTest : public ::testing::Test {
   }
 
   void ResetStub() {
-    std::shared_ptr<Channel> channel = CreateChannel(
-        server_address_.str(), InsecureCredentials(), ChannelArguments());
+    std::shared_ptr<Channel> channel =
+        CreateChannel(server_address_.str(), InsecureCredentials());
     generic_stub_.reset(new GenericStub(channel));
   }
 
diff --git a/test/cpp/end2end/mock_test.cc b/test/cpp/end2end/mock_test.cc
index b2c6dc39a8..9c35fede8f 100644
--- a/test/cpp/end2end/mock_test.cc
+++ b/test/cpp/end2end/mock_test.cc
@@ -39,11 +39,9 @@
 #include <grpc++/channel.h>
 #include <grpc++/client_context.h>
 #include <grpc++/create_channel.h>
-#include <grpc++/credentials.h>
 #include <grpc++/server.h>
 #include <grpc++/server_builder.h>
 #include <grpc++/server_context.h>
-#include <grpc++/server_credentials.h>
 #include <gtest/gtest.h>
 
 #include "test/core/util/port.h"
@@ -245,9 +243,9 @@ class MockTest : public ::testing::Test {
   void TearDown() GRPC_OVERRIDE { server_->Shutdown(); }
 
   void ResetStub() {
-    std::shared_ptr<Channel> channel = CreateChannel(
-        server_address_.str(), InsecureCredentials(), ChannelArguments());
-    stub_ = std::move(grpc::cpp::test::util::TestService::NewStub(channel));
+    std::shared_ptr<Channel> channel =
+        CreateChannel(server_address_.str(), InsecureCredentials());
+    stub_ = grpc::cpp::test::util::TestService::NewStub(channel);
   }
 
   std::unique_ptr<grpc::cpp::test::util::TestService::Stub> stub_;
diff --git a/test/cpp/end2end/server_crash_test.cc b/test/cpp/end2end/server_crash_test.cc
index 1a0f04e22b..4b6793abe6 100644
--- a/test/cpp/end2end/server_crash_test.cc
+++ b/test/cpp/end2end/server_crash_test.cc
@@ -37,11 +37,9 @@
 #include <grpc++/channel.h>
 #include <grpc++/client_context.h>
 #include <grpc++/create_channel.h>
-#include <grpc++/credentials.h>
 #include <grpc++/server.h>
 #include <grpc++/server_builder.h>
 #include <grpc++/server_context.h>
-#include <grpc++/server_credentials.h>
 #include <gtest/gtest.h>
 
 #include "test/core/util/port.h"
diff --git a/test/cpp/end2end/server_crash_test_client.cc b/test/cpp/end2end/server_crash_test_client.cc
index 7ca43a0c5b..17869362c2 100644
--- a/test/cpp/end2end/server_crash_test_client.cc
+++ b/test/cpp/end2end/server_crash_test_client.cc
@@ -40,7 +40,6 @@
 #include <grpc++/channel.h>
 #include <grpc++/client_context.h>
 #include <grpc++/create_channel.h>
-#include <grpc++/credentials.h>
 #include "test/cpp/util/echo.grpc.pb.h"
 
 DEFINE_string(address, "", "Address to connect to");
@@ -58,8 +57,8 @@ using namespace gflags;
 
 int main(int argc, char** argv) {
   ParseCommandLineFlags(&argc, &argv, true);
-  auto stub = grpc::cpp::test::util::TestService::NewStub(grpc::CreateChannel(
-      FLAGS_address, grpc::InsecureCredentials(), grpc::ChannelArguments()));
+  auto stub = grpc::cpp::test::util::TestService::NewStub(
+      grpc::CreateChannel(FLAGS_address, grpc::InsecureCredentials()));
 
   EchoRequest request;
   EchoResponse response;
diff --git a/test/cpp/end2end/shutdown_test.cc b/test/cpp/end2end/shutdown_test.cc
index e83f86f7ec..0549bb8b5f 100644
--- a/test/cpp/end2end/shutdown_test.cc
+++ b/test/cpp/end2end/shutdown_test.cc
@@ -38,11 +38,9 @@
 #include <grpc++/channel.h>
 #include <grpc++/client_context.h>
 #include <grpc++/create_channel.h>
-#include <grpc++/credentials.h>
 #include <grpc++/server.h>
 #include <grpc++/server_builder.h>
 #include <grpc++/server_context.h>
-#include <grpc++/server_credentials.h>
 #include <gtest/gtest.h>
 
 #include "src/core/support/env.h"
@@ -95,8 +93,8 @@ class ShutdownTest : public ::testing::Test {
 
   void ResetStub() {
     string target = "dns:localhost:" + to_string(port_);
-    channel_ = CreateChannel(target, InsecureCredentials(), ChannelArguments());
-    stub_ = std::move(grpc::cpp::test::util::TestService::NewStub(channel_));
+    channel_ = CreateChannel(target, InsecureCredentials());
+    stub_ = grpc::cpp::test::util::TestService::NewStub(channel_);
   }
 
   string to_string(const int number) {
diff --git a/test/cpp/end2end/streaming_throughput_test.cc b/test/cpp/end2end/streaming_throughput_test.cc
new file mode 100644
index 0000000000..63d49c0425
--- /dev/null
+++ b/test/cpp/end2end/streaming_throughput_test.cc
@@ -0,0 +1,189 @@
+/*
+ *
+ * Copyright 2015, Google Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#include <atomic>
+#include <mutex>
+#include <thread>
+
+#include <grpc++/channel.h>
+#include <grpc++/client_context.h>
+#include <grpc++/create_channel.h>
+#include <grpc++/security/credentials.h>
+#include <grpc++/security/server_credentials.h>
+#include <grpc++/server.h>
+#include <grpc++/server_builder.h>
+#include <grpc++/server_context.h>
+#include <grpc/grpc.h>
+#include <grpc/support/thd.h>
+#include <grpc/support/time.h>
+#include <gtest/gtest.h>
+
+#include "test/core/util/port.h"
+#include "test/core/util/test_config.h"
+#include "test/cpp/util/echo_duplicate.grpc.pb.h"
+#include "test/cpp/util/echo.grpc.pb.h"
+
+using grpc::cpp::test::util::EchoRequest;
+using grpc::cpp::test::util::EchoResponse;
+using std::chrono::system_clock;
+
+const char* kLargeString = "("
+  "To be, or not to be- that is the question:"
+  "Whether 'tis nobler in the mind to suffer"
+  "The slings and arrows of outrageous fortune"
+  "Or to take arms against a sea of troubles,"
+  "And by opposing end them. To die- to sleep-"
+  "No more; and by a sleep to say we end"
+  "The heartache, and the thousand natural shock"
+  "That flesh is heir to. 'Tis a consummation"
+  "Devoutly to be wish'd. To die- to sleep."
+  "To sleep- perchance to dream: ay, there's the rub!"
+  "For in that sleep of death what dreams may come"
+  "When we have shuffled off this mortal coil,"
+  "Must give us pause. There's the respect"
+  "That makes calamity of so long life."
+  "For who would bear the whips and scorns of time,"
+  "Th' oppressor's wrong, the proud man's contumely,"
+  "The pangs of despis'd love, the law's delay,"
+  "The insolence of office, and the spurns"
+  "That patient merit of th' unworthy takes,"
+  "When he himself might his quietus make"
+  "With a bare bodkin? Who would these fardels bear,"
+  "To grunt and sweat under a weary life,"
+  "But that the dread of something after death-"
+  "The undiscover'd country, from whose bourn"
+  "No traveller returns- puzzles the will,"
+  "And makes us rather bear those ills we have"
+  "Than fly to others that we know not of?"
+  "Thus conscience does make cowards of us all,"
+  "And thus the native hue of resolution"
+  "Is sicklied o'er with the pale cast of thought,"
+  "And enterprises of great pith and moment"
+  "With this regard their currents turn awry"
+  "And lose the name of action.- Soft you now!"
+  "The fair Ophelia!- Nymph, in thy orisons"
+  "Be all my sins rememb'red.";
+
+namespace grpc {
+namespace testing {
+
+class TestServiceImpl : public ::grpc::cpp::test::util::TestService::Service {
+ public:
+  static void BidiStream_Sender(ServerReaderWriter<EchoResponse, EchoRequest>* stream, std::atomic<bool>* should_exit) {
+    EchoResponse response;
+    response.set_message(kLargeString);
+    while (!should_exit->load()) {
+      std::this_thread::sleep_for(std::chrono::milliseconds(1));
+      stream->Write(response);
+    }
+  }
+
+  // Only implement the one method we will be calling for brevity.
+  Status BidiStream(ServerContext* context,
+                    ServerReaderWriter<EchoResponse, EchoRequest>* stream)
+      GRPC_OVERRIDE {
+    EchoRequest request;
+    std::atomic<bool> should_exit(false);
+    std::thread sender(std::bind(&TestServiceImpl::BidiStream_Sender, stream, &should_exit));
+
+    while (stream->Read(&request)) {
+      std::this_thread::sleep_for(std::chrono::milliseconds(3));
+    }
+    should_exit.store(true);
+    sender.join();
+    return Status::OK;
+  }
+};
+
+class End2endTest : public ::testing::Test {
+ protected:
+  void SetUp() GRPC_OVERRIDE {
+    int port = grpc_pick_unused_port_or_die();
+    server_address_ << "localhost:" << port;
+    // Setup server
+    ServerBuilder builder;
+    builder.AddListeningPort(server_address_.str(),
+                             InsecureServerCredentials());
+    builder.RegisterService(&service_);
+    server_ = builder.BuildAndStart();
+  }
+
+  void TearDown() GRPC_OVERRIDE { server_->Shutdown(); }
+
+  void ResetStub() {
+    std::shared_ptr<Channel> channel = CreateChannel(
+        server_address_.str(), InsecureCredentials());
+    stub_ = std::move(grpc::cpp::test::util::TestService::NewStub(channel));
+  }
+
+  std::unique_ptr<grpc::cpp::test::util::TestService::Stub> stub_;
+  std::unique_ptr<Server> server_;
+  std::ostringstream server_address_;
+  TestServiceImpl service_;
+};
+
+static void Drainer(ClientReaderWriter<EchoRequest, EchoResponse>* reader) {
+  EchoResponse response;
+  while (reader->Read(&response)) {
+      // Just drain out the responses as fast as possible.
+  }
+}
+
+TEST_F(End2endTest, StreamingThroughput) {
+  ResetStub();
+  grpc::ClientContext context;
+  auto stream = stub_->BidiStream(&context);
+
+  auto reader = stream.get();
+  std::thread receiver(std::bind(Drainer, reader));
+
+  for (int i = 0; i < 10000; i++) {
+    EchoRequest request;
+    request.set_message(kLargeString);
+    ASSERT_TRUE(stream->Write(request));
+    if (i % 1000 == 0) {
+      gpr_log(GPR_INFO, "Send count = %d", i);
+    }
+  }
+  stream->WritesDone();
+  receiver.join();
+}
+
+}  // namespace testing
+}  // namespace grpc
+
+int main(int argc, char** argv) {
+  grpc_test_init(argc, argv);
+  ::testing::InitGoogleTest(&argc, argv);
+  return RUN_ALL_TESTS();
+}
diff --git a/test/cpp/end2end/thread_stress_test.cc b/test/cpp/end2end/thread_stress_test.cc
index 8304f04d56..75a07d89c5 100644
--- a/test/cpp/end2end/thread_stress_test.cc
+++ b/test/cpp/end2end/thread_stress_test.cc
@@ -40,11 +40,9 @@
 #include <grpc++/channel.h>
 #include <grpc++/client_context.h>
 #include <grpc++/create_channel.h>
-#include <grpc++/credentials.h>
 #include <grpc++/server.h>
 #include <grpc++/server_builder.h>
 #include <grpc++/server_context.h>
-#include <grpc++/server_credentials.h>
 #include <gtest/gtest.h>
 
 #include "test/core/util/port.h"
@@ -191,9 +189,9 @@ class End2endTest : public ::testing::Test {
   void TearDown() GRPC_OVERRIDE { server_->Shutdown(); }
 
   void ResetStub() {
-    std::shared_ptr<Channel> channel = CreateChannel(
-        server_address_.str(), InsecureCredentials(), ChannelArguments());
-    stub_ = std::move(grpc::cpp::test::util::TestService::NewStub(channel));
+    std::shared_ptr<Channel> channel =
+        CreateChannel(server_address_.str(), InsecureCredentials());
+    stub_ = grpc::cpp::test::util::TestService::NewStub(channel);
   }
 
   std::unique_ptr<grpc::cpp::test::util::TestService::Stub> stub_;
diff --git a/test/cpp/end2end/zookeeper_test.cc b/test/cpp/end2end/zookeeper_test.cc
index e7d95b1c46..d4c7f0489f 100644
--- a/test/cpp/end2end/zookeeper_test.cc
+++ b/test/cpp/end2end/zookeeper_test.cc
@@ -34,11 +34,9 @@
 #include <grpc++/channel.h>
 #include <grpc++/client_context.h>
 #include <grpc++/create_channel.h>
-#include <grpc++/credentials.h>
 #include <grpc++/server.h>
 #include <grpc++/server_builder.h>
 #include <grpc++/server_context.h>
-#include <grpc++/server_credentials.h>
 #include <gtest/gtest.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_zookeeper.h>
@@ -159,7 +157,7 @@ class ZookeeperTest : public ::testing::Test {
 
   void ResetStub() {
     string target = "zookeeper://" + zookeeper_address_ + "/test";
-    channel_ = CreateChannel(target, InsecureCredentials(), ChannelArguments());
+    channel_ = CreateChannel(target, InsecureCredentials());
     stub_ = std::move(grpc::cpp::test::util::TestService::NewStub(channel_));
   }
 
diff --git a/test/cpp/interop/client.cc b/test/cpp/interop/client.cc
index cb5232153b..ba44a918db 100644
--- a/test/cpp/interop/client.cc
+++ b/test/cpp/interop/client.cc
@@ -68,7 +68,6 @@ DEFINE_string(test_case, "large_unary",
               "cancel_after_begin : cancel stream after starting it; "
               "cancel_after_first_response: cancel on first response; "
               "timeout_on_sleeping_server: deadline exceeds on stream; "
-              "service_account_creds : large_unary with service_account auth; "
               "compute_engine_creds: large_unary with compute engine auth; "
               "jwt_token_creds: large_unary with JWT token auth; "
               "oauth2_auth_token: raw oauth2 access token auth; "
@@ -114,9 +113,6 @@ int main(int argc, char** argv) {
     client.DoCancelAfterFirstResponse();
   } else if (FLAGS_test_case == "timeout_on_sleeping_server") {
     client.DoTimeoutOnSleepingServer();
-  } else if (FLAGS_test_case == "service_account_creds") {
-    grpc::string json_key = GetServiceAccountJsonKey();
-    client.DoServiceAccountCreds(json_key, FLAGS_oauth_scope);
   } else if (FLAGS_test_case == "compute_engine_creds") {
     client.DoComputeEngineCreds(FLAGS_default_service_account,
                                 FLAGS_oauth_scope);
@@ -124,11 +120,10 @@ int main(int argc, char** argv) {
     grpc::string json_key = GetServiceAccountJsonKey();
     client.DoJwtTokenCreds(json_key);
   } else if (FLAGS_test_case == "oauth2_auth_token") {
-    grpc::string json_key = GetServiceAccountJsonKey();
-    client.DoOauth2AuthToken(json_key, FLAGS_oauth_scope);
+    client.DoOauth2AuthToken(FLAGS_default_service_account, FLAGS_oauth_scope);
   } else if (FLAGS_test_case == "per_rpc_creds") {
     grpc::string json_key = GetServiceAccountJsonKey();
-    client.DoPerRpcCreds(json_key, FLAGS_oauth_scope);
+    client.DoPerRpcCreds(json_key);
   } else if (FLAGS_test_case == "status_code_and_message") {
     client.DoStatusWithMessage();
   } else if (FLAGS_test_case == "all") {
@@ -146,10 +141,10 @@ int main(int argc, char** argv) {
     // service_account_creds and jwt_token_creds can only run with ssl.
     if (FLAGS_enable_ssl) {
       grpc::string json_key = GetServiceAccountJsonKey();
-      client.DoServiceAccountCreds(json_key, FLAGS_oauth_scope);
       client.DoJwtTokenCreds(json_key);
-      client.DoOauth2AuthToken(json_key, FLAGS_oauth_scope);
-      client.DoPerRpcCreds(json_key, FLAGS_oauth_scope);
+      client.DoOauth2AuthToken(
+          FLAGS_default_service_account, FLAGS_oauth_scope);
+      client.DoPerRpcCreds(json_key);
     }
     // compute_engine_creds only runs in GCE.
   } else {
@@ -159,8 +154,7 @@ int main(int argc, char** argv) {
         "large_unary|large_compressed_unary|client_streaming|server_streaming|"
         "server_compressed_streaming|half_duplex|ping_pong|cancel_after_begin|"
         "cancel_after_first_response|timeout_on_sleeping_server|"
-        "service_account_creds|compute_engine_creds|jwt_token_creds|"
-        "oauth2_auth_token|per_rpc_creds",
+        "compute_engine_creds|jwt_token_creds|oauth2_auth_token|per_rpc_creds",
         FLAGS_test_case.c_str());
     ret = 1;
   }
diff --git a/test/cpp/interop/client_helper.cc b/test/cpp/interop/client_helper.cc
index abc14aeb98..f85aa6ad8e 100644
--- a/test/cpp/interop/client_helper.cc
+++ b/test/cpp/interop/client_helper.cc
@@ -45,7 +45,7 @@
 #include <gflags/gflags.h>
 #include <grpc++/channel.h>
 #include <grpc++/create_channel.h>
-#include <grpc++/credentials.h>
+#include <grpc++/security/credentials.h>
 
 #include "src/cpp/client/secure_credentials.h"
 #include "test/core/security/oauth2_utils.h"
@@ -64,16 +64,6 @@ DECLARE_string(oauth_scope);
 namespace grpc {
 namespace testing {
 
-namespace {
-std::shared_ptr<Credentials> CreateServiceAccountCredentials() {
-  GPR_ASSERT(FLAGS_enable_ssl);
-  grpc::string json_key = GetServiceAccountJsonKey();
-  std::chrono::seconds token_lifetime = std::chrono::hours(1);
-  return ServiceAccountCredentials(json_key, FLAGS_oauth_scope,
-                                   token_lifetime.count());
-}
-}  // namespace
-
 grpc::string GetServiceAccountJsonKey() {
   static grpc::string json_key;
   if (json_key.empty()) {
@@ -86,7 +76,7 @@ grpc::string GetServiceAccountJsonKey() {
 }
 
 grpc::string GetOauth2AccessToken() {
-  std::shared_ptr<Credentials> creds = CreateServiceAccountCredentials();
+  std::shared_ptr<Credentials> creds = GoogleComputeEngineCredentials();
   SecureCredentials* secure_creds =
       dynamic_cast<SecureCredentials*>(creds.get());
   GPR_ASSERT(secure_creds != nullptr);
@@ -107,14 +97,10 @@ std::shared_ptr<Channel> CreateChannelForTestCase(
   snprintf(host_port, host_port_buf_size, "%s:%d", FLAGS_server_host.c_str(),
            FLAGS_server_port);
 
-  if (test_case == "service_account_creds") {
-    std::shared_ptr<Credentials> creds = CreateServiceAccountCredentials();
-    return CreateTestChannel(host_port, FLAGS_server_host_override,
-                             FLAGS_enable_ssl, FLAGS_use_prod_roots, creds);
-  } else if (test_case == "compute_engine_creds") {
+  if (test_case == "compute_engine_creds") {
     std::shared_ptr<Credentials> creds;
     GPR_ASSERT(FLAGS_enable_ssl);
-    creds = ComputeEngineCredentials();
+    creds = GoogleComputeEngineCredentials();
     return CreateTestChannel(host_port, FLAGS_server_host_override,
                              FLAGS_enable_ssl, FLAGS_use_prod_roots, creds);
   } else if (test_case == "jwt_token_creds") {
diff --git a/test/cpp/interop/interop_client.cc b/test/cpp/interop/interop_client.cc
index ca13cdc53d..8124cae67a 100644
--- a/test/cpp/interop/interop_client.cc
+++ b/test/cpp/interop/interop_client.cc
@@ -44,7 +44,7 @@
 #include <grpc/support/useful.h>
 #include <grpc++/channel.h>
 #include <grpc++/client_context.h>
-#include <grpc++/credentials.h>
+#include <grpc++/security/credentials.h>
 
 #include "src/core/transport/stream_op.h"
 #include "test/cpp/interop/client_helper.h"
@@ -179,24 +179,6 @@ void InteropClient::DoComputeEngineCreds(
   gpr_log(GPR_INFO, "Large unary with compute engine creds done.");
 }
 
-void InteropClient::DoServiceAccountCreds(const grpc::string& username,
-                                          const grpc::string& oauth_scope) {
-  gpr_log(GPR_INFO,
-          "Sending a large unary rpc with service account credentials ...");
-  SimpleRequest request;
-  SimpleResponse response;
-  request.set_fill_username(true);
-  request.set_fill_oauth_scope(true);
-  request.set_response_type(PayloadType::COMPRESSABLE);
-  PerformLargeUnary(&request, &response);
-  GPR_ASSERT(!response.username().empty());
-  GPR_ASSERT(!response.oauth_scope().empty());
-  GPR_ASSERT(username.find(response.username()) != grpc::string::npos);
-  const char* oauth_scope_str = response.oauth_scope().c_str();
-  GPR_ASSERT(oauth_scope.find(oauth_scope_str) != grpc::string::npos);
-  gpr_log(GPR_INFO, "Large unary with service account creds done.");
-}
-
 void InteropClient::DoOauth2AuthToken(const grpc::string& username,
                                       const grpc::string& oauth_scope) {
   gpr_log(GPR_INFO,
@@ -214,36 +196,33 @@ void InteropClient::DoOauth2AuthToken(const grpc::string& username,
   AssertOkOrPrintErrorStatus(s);
   GPR_ASSERT(!response.username().empty());
   GPR_ASSERT(!response.oauth_scope().empty());
-  GPR_ASSERT(username.find(response.username()) != grpc::string::npos);
+  GPR_ASSERT(username == response.username());
   const char* oauth_scope_str = response.oauth_scope().c_str();
   GPR_ASSERT(oauth_scope.find(oauth_scope_str) != grpc::string::npos);
   gpr_log(GPR_INFO, "Unary with oauth2 access token credentials done.");
 }
 
-void InteropClient::DoPerRpcCreds(const grpc::string& username,
-                                  const grpc::string& oauth_scope) {
+void InteropClient::DoPerRpcCreds(const grpc::string& json_key) {
   gpr_log(GPR_INFO,
-          "Sending a unary rpc with per-rpc raw oauth2 access token ...");
+          "Sending a unary rpc with per-rpc JWT access token ...");
   SimpleRequest request;
   SimpleResponse response;
   request.set_fill_username(true);
-  request.set_fill_oauth_scope(true);
   std::unique_ptr<TestService::Stub> stub(TestService::NewStub(channel_));
 
   ClientContext context;
-  grpc::string access_token = GetOauth2AccessToken();
-  std::shared_ptr<Credentials> creds = AccessTokenCredentials(access_token);
+  std::chrono::seconds token_lifetime = std::chrono::hours(1);
+  std::shared_ptr<Credentials> creds =
+      ServiceAccountJWTAccessCredentials(json_key, token_lifetime.count());
+
   context.set_credentials(creds);
 
   Status s = stub->UnaryCall(&context, request, &response);
 
   AssertOkOrPrintErrorStatus(s);
   GPR_ASSERT(!response.username().empty());
-  GPR_ASSERT(!response.oauth_scope().empty());
-  GPR_ASSERT(username.find(response.username()) != grpc::string::npos);
-  const char* oauth_scope_str = response.oauth_scope().c_str();
-  GPR_ASSERT(oauth_scope.find(oauth_scope_str) != grpc::string::npos);
-  gpr_log(GPR_INFO, "Unary with per-rpc oauth2 access token done.");
+  GPR_ASSERT(json_key.find(response.username()) != grpc::string::npos);
+  gpr_log(GPR_INFO, "Unary with per-rpc JWT access token done.");
 }
 
 void InteropClient::DoJwtTokenCreds(const grpc::string& username) {
diff --git a/test/cpp/interop/interop_client.h b/test/cpp/interop/interop_client.h
index 5e26cc82e6..7bcb58571e 100644
--- a/test/cpp/interop/interop_client.h
+++ b/test/cpp/interop/interop_client.h
@@ -68,15 +68,11 @@ class InteropClient {
   void DoJwtTokenCreds(const grpc::string& username);
   void DoComputeEngineCreds(const grpc::string& default_service_account,
                             const grpc::string& oauth_scope);
-  // username is a string containing the user email
-  void DoServiceAccountCreds(const grpc::string& username,
-                             const grpc::string& oauth_scope);
-  // username is a string containing the user email
+  // username the GCE default service account email
   void DoOauth2AuthToken(const grpc::string& username,
                          const grpc::string& oauth_scope);
   // username is a string containing the user email
-  void DoPerRpcCreds(const grpc::string& username,
-                     const grpc::string& oauth_scope);
+  void DoPerRpcCreds(const grpc::string& json_key);
 
  private:
   void PerformLargeUnary(SimpleRequest* request, SimpleResponse* response);
diff --git a/test/cpp/interop/reconnect_interop_server.cc b/test/cpp/interop/reconnect_interop_server.cc
index d4f171b1d0..f52417bae0 100644
--- a/test/cpp/interop/reconnect_interop_server.cc
+++ b/test/cpp/interop/reconnect_interop_server.cc
@@ -45,7 +45,6 @@
 #include <grpc++/server.h>
 #include <grpc++/server_builder.h>
 #include <grpc++/server_context.h>
-#include <grpc++/server_credentials.h>
 
 #include "test/core/util/reconnect_server.h"
 #include "test/cpp/util/test_config.h"
diff --git a/test/cpp/interop/server.cc b/test/cpp/interop/server.cc
index 4921fde9fa..03b6532447 100644
--- a/test/cpp/interop/server.cc
+++ b/test/cpp/interop/server.cc
@@ -46,7 +46,7 @@
 #include <grpc++/server.h>
 #include <grpc++/server_builder.h>
 #include <grpc++/server_context.h>
-#include <grpc++/server_credentials.h>
+#include <grpc++/security/server_credentials.h>
 
 #include "test/cpp/interop/server_helper.h"
 #include "test/cpp/util/test_config.h"
diff --git a/test/cpp/interop/server_helper.cc b/test/cpp/interop/server_helper.cc
index e897f4ebf0..015198354e 100644
--- a/test/cpp/interop/server_helper.cc
+++ b/test/cpp/interop/server_helper.cc
@@ -36,7 +36,7 @@
 #include <memory>
 
 #include <gflags/gflags.h>
-#include <grpc++/server_credentials.h>
+#include <grpc++/security/server_credentials.h>
 
 #include "src/core/surface/call.h"
 #include "test/core/end2end/data/ssl_test_data.h"
diff --git a/test/cpp/interop/server_helper.h b/test/cpp/interop/server_helper.h
index 7b6b12cd4d..dc0ae1dccd 100644
--- a/test/cpp/interop/server_helper.h
+++ b/test/cpp/interop/server_helper.h
@@ -38,7 +38,7 @@
 
 #include <grpc/compression.h>
 #include <grpc++/server_context.h>
-#include <grpc++/server_credentials.h>
+#include <grpc++/security/server_credentials.h>
 
 namespace grpc {
 namespace testing {
diff --git a/test/cpp/qps/client_sync.cc b/test/cpp/qps/client_sync.cc
index 123dca6600..beef604856 100644
--- a/test/cpp/qps/client_sync.cc
+++ b/test/cpp/qps/client_sync.cc
@@ -31,8 +31,6 @@
  *
  */
 
-#include <sys/signal.h>
-
 #include <cassert>
 #include <chrono>
 #include <memory>
diff --git a/test/cpp/qps/driver.cc b/test/cpp/qps/driver.cc
index 3bd61ea4e8..6e71c45935 100644
--- a/test/cpp/qps/driver.cc
+++ b/test/cpp/qps/driver.cc
@@ -31,7 +31,6 @@
  *
  */
 
-#include <unistd.h>
 #include <list>
 #include <thread>
 #include <deque>
@@ -154,14 +153,14 @@ std::unique_ptr<ScenarioResult> RunScenario(
   // where class contained in std::vector must have a copy constructor
   auto* servers = new ServerData[num_servers];
   for (size_t i = 0; i < num_servers; i++) {
-    servers[i].stub = std::move(Worker::NewStub(
-        CreateChannel(workers[i], InsecureCredentials(), ChannelArguments())));
+    servers[i].stub = Worker::NewStub(CreateChannel(workers[i],
+                                                    InsecureCredentials()));
     ServerArgs args;
     result_server_config = server_config;
     result_server_config.set_host(workers[i]);
     *args.mutable_setup() = server_config;
     servers[i].stream =
-        std::move(servers[i].stub->RunServer(runsc::AllocContext(&contexts)));
+        servers[i].stub->RunServer(runsc::AllocContext(&contexts));
     GPR_ASSERT(servers[i].stream->Write(args));
     ServerStatus init_status;
     GPR_ASSERT(servers[i].stream->Read(&init_status));
@@ -182,14 +181,14 @@ std::unique_ptr<ScenarioResult> RunScenario(
   // where class contained in std::vector must have a copy constructor
   auto* clients = new ClientData[num_clients];
   for (size_t i = 0; i < num_clients; i++) {
-    clients[i].stub = std::move(Worker::NewStub(CreateChannel(
-        workers[i + num_servers], InsecureCredentials(), ChannelArguments())));
+    clients[i].stub = Worker::NewStub(CreateChannel(workers[i + num_servers],
+                                                    InsecureCredentials()));
     ClientArgs args;
     result_client_config = client_config;
     result_client_config.set_host(workers[i + num_servers]);
     *args.mutable_setup() = client_config;
     clients[i].stream =
-        std::move(clients[i].stub->RunTest(runsc::AllocContext(&contexts)));
+        clients[i].stub->RunTest(runsc::AllocContext(&contexts));
     GPR_ASSERT(clients[i].stream->Write(args));
     ClientStatus init_status;
     GPR_ASSERT(clients[i].stream->Read(&init_status));
diff --git a/test/cpp/qps/perf_db_client.h b/test/cpp/qps/perf_db_client.h
index ae5d17074b..72ebe79c3c 100644
--- a/test/cpp/qps/perf_db_client.h
+++ b/test/cpp/qps/perf_db_client.h
@@ -41,7 +41,7 @@
 #include <grpc++/channel.h>
 #include <grpc++/client_context.h>
 #include <grpc++/create_channel.h>
-#include <grpc++/credentials.h>
+#include <grpc++/security/credentials.h>
 #include "test/cpp/qps/perf_db.grpc.pb.h"
 
 namespace grpc {
diff --git a/test/cpp/qps/qps_worker.cc b/test/cpp/qps/qps_worker.cc
index 51e955a80a..d19499be43 100644
--- a/test/cpp/qps/qps_worker.cc
+++ b/test/cpp/qps/qps_worker.cc
@@ -49,7 +49,7 @@
 #include <grpc++/client_context.h>
 #include <grpc++/server.h>
 #include <grpc++/server_builder.h>
-#include <grpc++/server_credentials.h>
+#include <grpc++/security/server_credentials.h>
 
 #include "test/core/util/grpc_profiler.h"
 #include "test/cpp/qps/qpstest.pb.h"
@@ -229,7 +229,7 @@ QpsWorker::QpsWorker(int driver_port, int server_port) {
 
   gpr_free(server_address);
 
-  server_ = std::move(builder.BuildAndStart());
+  server_ = builder.BuildAndStart();
 }
 
 QpsWorker::~QpsWorker() {}
diff --git a/test/cpp/qps/report.h b/test/cpp/qps/report.h
index 620abade39..5914fc4e30 100644
--- a/test/cpp/qps/report.h
+++ b/test/cpp/qps/report.h
@@ -116,8 +116,8 @@ class PerfDbReporter : public Reporter {
         test_name_(test_name),
         sys_info_(sys_info),
         tag_(tag) {
-    perf_db_client_.init(grpc::CreateChannel(
-        server_address, grpc::InsecureCredentials(), ChannelArguments()));
+    perf_db_client_.init(
+        grpc::CreateChannel(server_address, grpc::InsecureCredentials()));
   }
   ~PerfDbReporter() GRPC_OVERRIDE { SendData(); };
 
diff --git a/test/cpp/qps/server_async.cc b/test/cpp/qps/server_async.cc
index 77415f42ce..0ed2048d4a 100644
--- a/test/cpp/qps/server_async.cc
+++ b/test/cpp/qps/server_async.cc
@@ -35,9 +35,6 @@
 #include <functional>
 #include <memory>
 #include <mutex>
-#include <sys/time.h>
-#include <sys/resource.h>
-#include <sys/signal.h>
 #include <thread>
 
 #include <gflags/gflags.h>
@@ -49,7 +46,7 @@
 #include <grpc++/server.h>
 #include <grpc++/server_builder.h>
 #include <grpc++/server_context.h>
-#include <grpc++/server_credentials.h>
+#include <grpc++/security/server_credentials.h>
 #include <gtest/gtest.h>
 
 #include "test/cpp/qps/qpstest.grpc.pb.h"
@@ -71,7 +68,7 @@ class AsyncQpsServerTest : public Server {
 
     builder.RegisterAsyncService(&async_service_);
     for (int i = 0; i < config.threads(); i++) {
-      srv_cqs_.emplace_back(std::move(builder.AddCompletionQueue()));
+      srv_cqs_.emplace_back(builder.AddCompletionQueue());
     }
 
     server_ = builder.BuildAndStart();
diff --git a/test/cpp/qps/server_sync.cc b/test/cpp/qps/server_sync.cc
index 29ec19cd4b..d930ba2464 100644
--- a/test/cpp/qps/server_sync.cc
+++ b/test/cpp/qps/server_sync.cc
@@ -31,8 +31,6 @@
  *
  */
 
-#include <sys/signal.h>
-#include <unistd.h>
 #include <thread>
 
 #include <gflags/gflags.h>
@@ -43,7 +41,7 @@
 #include <grpc++/server.h>
 #include <grpc++/server_builder.h>
 #include <grpc++/server_context.h>
-#include <grpc++/server_credentials.h>
+#include <grpc++/security/server_credentials.h>
 
 #include "test/cpp/qps/qpstest.grpc.pb.h"
 #include "test/cpp/qps/server.h"
diff --git a/test/cpp/util/cli_call_test.cc b/test/cpp/util/cli_call_test.cc
index 111a0e9f76..9c8d59987e 100644
--- a/test/cpp/util/cli_call_test.cc
+++ b/test/cpp/util/cli_call_test.cc
@@ -37,11 +37,9 @@
 #include <grpc++/channel.h>
 #include <grpc++/client_context.h>
 #include <grpc++/create_channel.h>
-#include <grpc++/credentials.h>
 #include <grpc++/server.h>
 #include <grpc++/server_builder.h>
 #include <grpc++/server_context.h>
-#include <grpc++/server_credentials.h>
 #include <gtest/gtest.h>
 
 #include "test/core/util/port.h"
@@ -91,9 +89,8 @@ class CliCallTest : public ::testing::Test {
   void TearDown() GRPC_OVERRIDE { server_->Shutdown(); }
 
   void ResetStub() {
-    channel_ = CreateChannel(server_address_.str(), InsecureCredentials(),
-                             ChannelArguments());
-    stub_ = std::move(grpc::cpp::test::util::TestService::NewStub(channel_));
+    channel_ = CreateChannel(server_address_.str(), InsecureCredentials());
+    stub_ = grpc::cpp::test::util::TestService::NewStub(channel_);
   }
 
   std::shared_ptr<Channel> channel_;
diff --git a/test/cpp/util/create_test_channel.cc b/test/cpp/util/create_test_channel.cc
index 161b4bdc1d..f0d5bfc7eb 100644
--- a/test/cpp/util/create_test_channel.cc
+++ b/test/cpp/util/create_test_channel.cc
@@ -34,7 +34,7 @@
 #include "test/cpp/util/create_test_channel.h"
 
 #include <grpc++/create_channel.h>
-#include <grpc++/credentials.h>
+#include <grpc++/security/credentials.h>
 
 #include "test/core/end2end/data/ssl_test_data.h"
 
@@ -74,9 +74,9 @@ std::shared_ptr<Channel> CreateTestChannel(
     if (creds.get()) {
       channel_creds = CompositeCredentials(creds, channel_creds);
     }
-    return CreateChannel(connect_to, channel_creds, channel_args);
+    return CreateCustomChannel(connect_to, channel_creds, channel_args);
   } else {
-    return CreateChannel(server, InsecureCredentials(), channel_args);
+    return CreateChannel(server, InsecureCredentials());
   }
 }
 
diff --git a/test/cpp/util/create_test_channel.h b/test/cpp/util/create_test_channel.h
index 1263d4ed68..a4750689a0 100644
--- a/test/cpp/util/create_test_channel.h
+++ b/test/cpp/util/create_test_channel.h
@@ -36,7 +36,7 @@
 
 #include <memory>
 
-#include <grpc++/credentials.h>
+#include <grpc++/security/credentials.h>
 
 namespace grpc {
 class Channel;
diff --git a/test/cpp/util/grpc_cli.cc b/test/cpp/util/grpc_cli.cc
index a4888efebe..334b6efb6a 100644
--- a/test/cpp/util/grpc_cli.cc
+++ b/test/cpp/util/grpc_cli.cc
@@ -1,5 +1,5 @@
 /*
- *
+
  * Copyright 2015, Google Inc.
  * All rights reserved.
  *
@@ -67,7 +67,7 @@
 #include <grpc/grpc.h>
 #include <grpc++/channel.h>
 #include <grpc++/create_channel.h>
-#include <grpc++/credentials.h>
+#include <grpc++/security/credentials.h>
 #include <grpc++/support/string_ref.h>
 
 #include "test/cpp/util/cli_call.h"
@@ -159,7 +159,7 @@ int main(int argc, char** argv) {
     }
   }
   std::shared_ptr<grpc::Channel> channel =
-      grpc::CreateChannel(server_address, creds, grpc::ChannelArguments());
+      grpc::CreateChannel(server_address, creds);
 
   grpc::string response;
   std::multimap<grpc::string, grpc::string> client_metadata;
diff --git a/test/cpp/util/messages.proto b/test/cpp/util/messages.proto
index 359d1db74f..a022707be9 100644
--- a/test/cpp/util/messages.proto
+++ b/test/cpp/util/messages.proto
@@ -40,6 +40,7 @@ message RequestParams {
   bool check_auth_context = 5;
   int32 response_message_length = 6;
   bool echo_peer = 7;
+  string expected_client_identity = 8;  // will force check_auth_context.
 }
 
 message EchoRequest {
diff --git a/test/cpp/util/string_ref_test.cc b/test/cpp/util/string_ref_test.cc
index c4ca4fce84..465072d43e 100644
--- a/test/cpp/util/string_ref_test.cc
+++ b/test/cpp/util/string_ref_test.cc
@@ -100,8 +100,8 @@ TEST_F(StringRefTest, Assignment) {
 TEST_F(StringRefTest, Iterator) {
   string_ref s(kTestString);
   size_t i = 0;
-  for (char c : s) {
-    EXPECT_EQ(kTestString[i++], c);
+  for (auto it = s.cbegin(); it != s.cend(); ++it) {
+    EXPECT_EQ(kTestString[i++], *it);
   }
   EXPECT_EQ(strlen(kTestString), i);
 }