Class: Google::Auth::ServiceAccountCredentials

Inherits:
Signet::OAuth2::Client show all
Extended by:
CredentialsLoader, JsonKeyReader
Defined in:
lib/googleauth/service_account.rb

Overview

Authenticates requests using Google's Service Account credentials via an OAuth access token.

This class allows authorizing requests for service accounts directly from credentials from a json key file downloaded from the developer console (via 'Generate new Json Key').

cf [Application Default Credentials](cloud.google.com/docs/authentication/production)

Constant Summary collapse

TOKEN_CRED_URI = 
"https://www.googleapis.com/oauth2/v4/token".freeze

Constants included from CredentialsLoader

CredentialsLoader::ACCOUNT_TYPE_VAR, CredentialsLoader::CLIENT_EMAIL_VAR, CredentialsLoader::CLIENT_ID_VAR, CredentialsLoader::CLIENT_SECRET_VAR, CredentialsLoader::CLOUD_SDK_CLIENT_ID, CredentialsLoader::CLOUD_SDK_CREDENTIALS_WARNING, CredentialsLoader::CREDENTIALS_FILE_NAME, CredentialsLoader::ENV_VAR, CredentialsLoader::GCLOUD_CONFIG_COMMAND, CredentialsLoader::GCLOUD_POSIX_COMMAND, CredentialsLoader::GCLOUD_WINDOWS_COMMAND, CredentialsLoader::NOT_FOUND_ERROR, CredentialsLoader::PRIVATE_KEY_VAR, CredentialsLoader::PROJECT_ID_VAR, CredentialsLoader::REFRESH_TOKEN_VAR, CredentialsLoader::SYSTEM_DEFAULT_ERROR, CredentialsLoader::WELL_KNOWN_ERROR, CredentialsLoader::WELL_KNOWN_PATH

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Methods included from JsonKeyReader

read_json_key

Methods included from CredentialsLoader

from_env, from_system_default_path, from_well_known_path, load_gcloud_project_id, make_creds, warn_if_cloud_sdk_credentials

Methods inherited from Signet::OAuth2::Client

#apply, #build_default_connection, #configure_connection, #fetch_access_token!, #notify_refresh_listeners, #on_refresh, #orig_fetch_access_token!, #retry_with_error, #updater_proc

Constructor Details

#initialize(options = {}) ⇒ ServiceAccountCredentials

Returns a new instance of ServiceAccountCredentials.


94
95
96
97
98
 
# File 'lib/googleauth/service_account.rb', line 94

def initialize options = {}
  @project_id = options[:project_id]
  @quota_project_id = options[:quota_project_id]
  super options
end

Instance Attribute Details

#project_id ⇒ Object (readonly)

Returns the value of attribute project_id


53
54
55
 
# File 'lib/googleauth/service_account.rb', line 53

def project_id
  @project_id
end

#quota_project_id ⇒ Object (readonly)

Returns the value of attribute quota_project_id


54
55
56
 
# File 'lib/googleauth/service_account.rb', line 54

def quota_project_id
  @quota_project_id
end

Class Method Details

.make_creds(options = {}) ⇒ Object

Creates a ServiceAccountCredentials.

Parameters:

  • json_key_io (IO) —

    an IO from which the JSON key can be read

  • scope (string|array|nil) —

    the scope(s) to access

Raises:

  • (ArgumentError) 

60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
 
# File 'lib/googleauth/service_account.rb', line 60

def self.make_creds options = {}
  json_key_io, scope, target_audience = options.values_at :json_key_io, :scope, :target_audience
  raise ArgumentError, "Cannot specify both scope and target_audience" if scope && target_audience

  if json_key_io
    private_key, client_email, project_id, quota_project_id = read_json_key json_key_io
  else
    private_key = unescape ENV[CredentialsLoader::PRIVATE_KEY_VAR]
    client_email = ENV[CredentialsLoader::CLIENT_EMAIL_VAR]
    project_id = ENV[CredentialsLoader::PROJECT_ID_VAR]
    quota_project_id = nil
  end
  project_id ||= CredentialsLoader.load_gcloud_project_id

  new(token_credential_uri: TOKEN_CRED_URI,
      audience:             TOKEN_CRED_URI,
      scope:                scope,
      target_audience:      target_audience,
      issuer:               client_email,
      signing_key:          OpenSSL::PKey::RSA.new(private_key),
      project_id:           project_id,
      quota_project_id:     quota_project_id)
    .configure_connection(options)
end

.unescape(str) ⇒ Object

Handles certain escape sequences that sometimes appear in input. Specifically, interprets the “n” sequence for newline, and removes enclosing quotes.


88
89
90
91
92
 
# File 'lib/googleauth/service_account.rb', line 88

def self.unescape str
  str = str.gsub '\n', "\n"
  str = str[1..-2] if str.start_with?('"') && str.end_with?('"')
  str
end

Instance Method Details

#apply!(a_hash, opts = {}) ⇒ Object

Extends the base class.

If scope(s) is not set, it creates a transient ServiceAccountJwtHeaderCredentials instance and uses that to authenticate instead.


105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
 
# File 'lib/googleauth/service_account.rb', line 105

def apply! a_hash, opts = {}
  # Use the base implementation if scopes are set
  unless scope.nil? && target_audience.nil?
    super
    return
  end

  # Use the ServiceAccountJwtHeaderCredentials using the same cred values
  # if no scopes are set.
  cred_json = {
    private_key:  @signing_key.to_s,
    client_email: @issuer
  }
  alt_clz = ServiceAccountJwtHeaderCredentials
  key_io = StringIO.new MultiJson.dump(cred_json)
  alt = alt_clz.make_creds json_key_io: key_io
  alt.apply! a_hash
end