From 93b923b17712ea7caa6f71ef8efb2eb2e8d3e336 Mon Sep 17 00:00:00 2001
From: Jean de Klerk <deklerk@google.com>
Date: Sun, 31 Dec 2017 13:58:48 -0800
Subject: [PATCH] Per issue #1704, return appropriate errors from
 PerRPCCredential errors

---
 credentials/credentials.go | 5 +++--
 transport/http2_client.go  | 6 +++++-
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/credentials/credentials.go b/credentials/credentials.go
index 1d2e864f8f46..3351bf0ee5f8 100644
--- a/credentials/credentials.go
+++ b/credentials/credentials.go
@@ -43,8 +43,9 @@ type PerRPCCredentials interface {
 	// GetRequestMetadata gets the current request metadata, refreshing
 	// tokens if required. This should be called by the transport layer on
 	// each request, and the data should be populated in headers or other
-	// context. uri is the URI of the entry point for the request. When
-	// supported by the underlying implementation, ctx can be used for
+	// context. If a status code is returned, it will be used as the status
+	// for the RPC. uri is the URI of the entry point for the request.
+	// When supported by the underlying implementation, ctx can be used for
 	// timeout and cancellation.
 	// TODO(zhaoq): Define the set of the qualified keys instead of leaving
 	// it as an arbitrary string.
diff --git a/transport/http2_client.go b/transport/http2_client.go
index 4a122692af2c..18fc41f08110 100644
--- a/transport/http2_client.go
+++ b/transport/http2_client.go
@@ -380,7 +380,11 @@ func (t *http2Client) NewStream(ctx context.Context, callHdr *CallHdr) (_ *Strea
 	for _, c := range t.creds {
 		data, err := c.GetRequestMetadata(ctx, audience)
 		if err != nil {
-			return nil, streamErrorf(codes.Internal, "transport: %v", err)
+			if _, ok := status.FromError(err); ok {
+				return nil, err
+			}
+
+			return nil, streamErrorf(codes.Unauthenticated, "transport: %v", err)
 		}
 		for k, v := range data {
 			// Capital header names are illegal in HTTP/2.