Skip to content

feat: expose method to manually obtain ADC from gcloud CLI well-known…#1188

Merged
diegomarquezp merged 22 commits intomainfrom
default-credential-expose
May 5, 2023
Merged

feat: expose method to manually obtain ADC from gcloud CLI well-known…#1188
diegomarquezp merged 22 commits intomainfrom
default-credential-expose

Conversation

@diegomarquezp
Copy link
Copy Markdown
Contributor

Second attempt to fix #1181

This time using an approach validated by @TimurSadykov

It exposes a method in GoogleCredentials to manually obtain ADC from the well-known file (docs)

@diegomarquezp diegomarquezp requested review from a team and TimurSadykov March 29, 2023 18:10
@product-auto-label product-auto-label Bot added the size: m Pull request size is medium. label Mar 29, 2023
@TimurSadykov TimurSadykov added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Apr 7, 2023
@kokoro-team kokoro-team removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Apr 7, 2023
Copy link
Copy Markdown

@TimurSadykov TimurSadykov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry for late comments, did not submit earlier (

* @return the credentials, or null if not found
* @throws IOException if the credentials cannot be created in the current environment.
*/
public static GoogleCredentials getFromGcloudCliWellKnownFile() throws IOException {
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we avoid having this?

With a path you can explicitly initialize a credential.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't want to add public method here unless it has a wide use case.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@TimurSadykov I modified the PR to expose the path only, using DefaultCredentialProvider.getWellKnownCredentialsFile().getAbsolutePath(). Our use case requires accessing a public method of this library

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@TimurSadykov If not a public method in GoogleCredentials, where would it make most sense to expose the path method?

}

@VisibleForTesting
final GoogleCredentials tryGetFromWellKnownCredentialsFile(HttpTransportFactory transportFactory)
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IIRC, we agreed on exposing the logic that returns the path, not the actual credential. This logic has some ADC-specific stuff, like printing warnings about user credentials, that you don't need.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems like the getWellKnownCredentialsFile is what you need, or new method that encapsulates just the Path part of the File creation.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I exposed a method to wrap getWellKnownCredentialsFile's path.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep, that is better

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You probably want to revert this change (as no longer needed) or cover it with tests... either works

Copy link
Copy Markdown

@TimurSadykov TimurSadykov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested an alternative

* @throws IOException if the credentials cannot be created in the current environment.
*/
public static String getWellKnownCredentialsPath() {
return defaultCredentialsProvider.getWellKnownCredentialsPath();
Copy link
Copy Markdown

@TimurSadykov TimurSadykov Apr 28, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This could backfire because here we rely on the fact that default credentials provider is static and always the same. This could change and if we decide to change it - this method will make things more complicated.

How about you move the logic of the getWellKnownCredentialsPath into a new public Utils class, like GoogleAuthUtils. (all the existing utils classes are internal and therefore private) IIUC the path logic is actually static. We already have some other public static methods that could be moved to the new Utils class as well.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I created a GoogleAuthUtils with a getPath method that would use the default provider instance to resolve the path. It also has internal methods to use a test provider

}

@VisibleForTesting
final GoogleCredentials tryGetFromWellKnownCredentialsFile(HttpTransportFactory transportFactory)
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You probably want to revert this change (as no longer needed) or cover it with tests... either works

@diegomarquezp diegomarquezp requested a review from TimurSadykov May 1, 2023 21:46
Copy link
Copy Markdown

@TimurSadykov TimurSadykov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall looks good, just comments

Comment thread oauth2_http/java/com/google/auth/oauth2/GoogleAuthUtils.java Outdated
Comment thread oauth2_http/java/com/google/auth/oauth2/GoogleAuthUtils.java
Comment thread oauth2_http/java/com/google/auth/oauth2/GoogleAuthUtils.java Outdated
Comment thread oauth2_http/java/com/google/auth/oauth2/GoogleAuthUtils.java Outdated
Comment thread oauth2_http/java/com/google/auth/oauth2/GoogleAuthUtils.java Outdated
Comment thread oauth2_http/java/com/google/auth/oauth2/GoogleAuthUtils.java Outdated
@diegomarquezp diegomarquezp requested a review from TimurSadykov May 2, 2023 19:39
Copy link
Copy Markdown

@TimurSadykov TimurSadykov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

one nit request

@diegomarquezp diegomarquezp requested review from a team and TimurSadykov May 4, 2023 22:32
@diegomarquezp diegomarquezp merged commit 2fa9d52 into main May 5, 2023
@diegomarquezp diegomarquezp deleted the default-credential-expose branch May 5, 2023 19:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size: m Pull request size is medium.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

DefaultCredentialsProvider should have an option to clear cached Credentials

3 participants