Skip to content
This repository was archived by the owner on Sep 26, 2023. It is now read-only.

Commit ed39c34

Browse files
arithmetic1728arithmetic1728
authored
feat: add UseJwtAccessWithScope to GoogleCredentialsProvider (#1420)
1 parent 0fe20f3 commit ed39c34

3 files changed

Lines changed: 59 additions & 16 deletions

File tree

‎dependencies.properties‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ version.io_grpc=1.37.0
3434
# 2) Replace all characters which are neither alphabetic nor digits with the underscore ('_') character
3535
maven.com_google_api_grpc_proto_google_common_protos=com.google.api.grpc:proto-google-common-protos:2.0.1
3636
maven.com_google_api_grpc_grpc_google_common_protos=com.google.api.grpc:grpc-google-common-protos:2.0.1
37-
maven.com_google_auth_google_auth_library_oauth2_http=com.google.auth:google-auth-library-oauth2-http:0.24.0
37+
maven.com_google_auth_google_auth_library_oauth2_http=com.google.auth:google-auth-library-oauth2-http:0.27.0
3838
maven.com_google_auth_google_auth_library_credentials=com.google.auth:google-auth-library-credentials:1.0.0
3939
maven.io_opencensus_opencensus_api=io.opencensus:opencensus-api:0.28.0
4040
maven.io_opencensus_opencensus_contrib_grpc_metrics=io.opencensus:opencensus-contrib-grpc-metrics:0.28.0

‎gax/src/main/java/com/google/api/gax/core/GoogleCredentialsProvider.java‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,9 @@ public abstract class GoogleCredentialsProvider implements CredentialsProvider {
5656
@BetaApi
5757
public abstract List<String> getJwtEnabledScopes();
5858

59+
@BetaApi
60+
public abstract boolean getUseJwtAccessWithScope();
61+
5962
@VisibleForTesting
6063
@Nullable
6164
abstract GoogleCredentials getOAuth2Credentials();
@@ -91,12 +94,19 @@ public Credentials getCredentials() throws IOException {
9194
if (credentials.createScopedRequired()) {
9295
credentials = credentials.createScoped(getScopesToApply());
9396
}
97+
98+
if (getUseJwtAccessWithScope() && credentials instanceof ServiceAccountCredentials) {
99+
// See https://google.aip.dev/auth/4111 for self signed JWT.
100+
ServiceAccountCredentials serviceAccount = (ServiceAccountCredentials) credentials;
101+
return serviceAccount.createWithUseJwtAccessWithScope(true);
102+
}
94103
return credentials;
95104
}
96105

97106
public static Builder newBuilder() {
98107
return new AutoValue_GoogleCredentialsProvider.Builder()
99-
.setJwtEnabledScopes(ImmutableList.<String>of());
108+
.setJwtEnabledScopes(ImmutableList.<String>of())
109+
.setUseJwtAccessWithScope(false);
100110
}
101111

102112
public abstract Builder toBuilder();
@@ -134,9 +144,18 @@ public abstract static class Builder {
134144
@BetaApi
135145
public abstract List<String> getJwtEnabledScopes();
136146

147+
/** Whether self signed JWT with scopes should be used for service account credentials. */
148+
@BetaApi
149+
public abstract Builder setUseJwtAccessWithScope(boolean val);
150+
151+
/** The UseJwtAccessWithScope value previously provided. */
152+
@BetaApi
153+
public abstract boolean getUseJwtAccessWithScope();
154+
137155
public GoogleCredentialsProvider build() {
138156
setScopesToApply(ImmutableList.copyOf(getScopesToApply()));
139157
setJwtEnabledScopes(ImmutableList.copyOf(getJwtEnabledScopes()));
158+
setUseJwtAccessWithScope(getUseJwtAccessWithScope());
140159
return autoBuild();
141160
}
142161

‎gax/src/test/java/com/google/api/gax/core/GoogleCredentialsProviderTest.java‎

Lines changed: 38 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
package com.google.api.gax.core;
3131

3232
import static com.google.common.truth.Truth.assertThat;
33+
import static org.junit.Assert.assertTrue;
3334

3435
import com.google.auth.Credentials;
3536
import com.google.auth.oauth2.ServiceAccountCredentials;
@@ -43,15 +44,18 @@
4344

4445
@RunWith(JUnit4.class)
4546
public class GoogleCredentialsProviderTest {
47+
ServiceAccountCredentials CreateServiceAccountCredentials() {
48+
return ServiceAccountCredentials.newBuilder()
49+
.setClientId("fake-client-id")
50+
.setClientEmail("[email protected]")
51+
.setPrivateKeyId("fake-private-key")
52+
.setPrivateKey(Mockito.mock(PrivateKey.class))
53+
.build();
54+
}
55+
4656
@Test
4757
public void serviceAccountReplacedWithJwtTokens() throws Exception {
48-
ServiceAccountCredentials serviceAccountCredentials =
49-
ServiceAccountCredentials.newBuilder()
50-
.setClientId("fake-client-id")
51-
.setClientEmail("[email protected]")
52-
.setPrivateKeyId("fake-private-key")
53-
.setPrivateKey(Mockito.mock(PrivateKey.class))
54-
.build();
58+
ServiceAccountCredentials serviceAccountCredentials = CreateServiceAccountCredentials();
5559

5660
GoogleCredentialsProvider provider =
5761
GoogleCredentialsProvider.newBuilder()
@@ -71,13 +75,7 @@ public void serviceAccountReplacedWithJwtTokens() throws Exception {
7175

7276
@Test
7377
public void noJwtWithoutScopeMatch() throws Exception {
74-
ServiceAccountCredentials serviceAccountCredentials =
75-
ServiceAccountCredentials.newBuilder()
76-
.setClientId("fake-client-id")
77-
.setClientEmail("[email protected]")
78-
.setPrivateKeyId("fake-private-key")
79-
.setPrivateKey(Mockito.mock(PrivateKey.class))
80-
.build();
78+
ServiceAccountCredentials serviceAccountCredentials = CreateServiceAccountCredentials();
8179

8280
GoogleCredentialsProvider provider =
8381
GoogleCredentialsProvider.newBuilder()
@@ -100,4 +98,30 @@ public void noJwtWithoutScopeMatch() throws Exception {
10098
.isEqualTo(serviceAccountCredentials.getPrivateKey());
10199
assertThat(serviceAccountCredentials2.getScopes()).containsExactly("scope1", "scope2");
102100
}
101+
102+
@Test
103+
public void useJwtAccessWithScope() throws Exception {
104+
ServiceAccountCredentials serviceAccountCredentials = CreateServiceAccountCredentials();
105+
106+
GoogleCredentialsProvider provider =
107+
GoogleCredentialsProvider.newBuilder()
108+
.setScopesToApply(ImmutableList.of("scope1", "scope2"))
109+
.setOAuth2Credentials(serviceAccountCredentials)
110+
.setUseJwtAccessWithScope(true)
111+
.build();
112+
113+
Credentials credentials = provider.getCredentials();
114+
assertThat(credentials).isInstanceOf(ServiceAccountCredentials.class);
115+
116+
ServiceAccountCredentials serviceAccountCredentials2 = (ServiceAccountCredentials) credentials;
117+
assertThat(serviceAccountCredentials2.getClientId())
118+
.isEqualTo(serviceAccountCredentials.getClientId());
119+
assertThat(serviceAccountCredentials2.getClientEmail())
120+
.isEqualTo(serviceAccountCredentials.getClientEmail());
121+
assertThat(serviceAccountCredentials2.getPrivateKeyId())
122+
.isEqualTo(serviceAccountCredentials.getPrivateKeyId());
123+
assertThat(serviceAccountCredentials2.getPrivateKey())
124+
.isEqualTo(serviceAccountCredentials.getPrivateKey());
125+
assertTrue(serviceAccountCredentials2.getUseJwtAccessWithScope());
126+
}
103127
}

0 commit comments

Comments
 (0)