Adding 3-legged auth for users getting started. #539

dhermes · 2015-01-13T23:11:05Z

Addresses final part of #335.

@tseaver Writing Test_get_credentials_from_user_flow.test_succeeds made me feel icky inside. Any suggestions on how to make this less massive?

@silvolu PTAL at the docstrings introduced and the print statements. Should we put this somewhere special in our documentation? We don't have an auth or a getting started section anywhere but I encourage you to clone my repo, check out the add-3LO branch and run

from gcloud import credentials
from gcloud.datastore import SCOPE
credentials = credentials.get_credentials_from_user_flow(SCOPE)

First without a client secrets file present (to test failure modes) and then with one (to test the messages printed, inputs requested).

@craigcitro Also PTAL / see what we could pull into oauth2client.

coveralls · 2015-01-13T23:13:37Z

Coverage remained the same when pulling ca14078 on dhermes:add-3LO into dcb73d3 on GoogleCloudPlatform:master.

craigcitro · 2015-01-13T23:16:41Z

substituting @anthmgoogle in my place, who has more feelings about 3LO

gcloud/credentials.py

Addresses final part of googleapis#335.

silvolu · 2015-01-13T23:36:49Z

@dhermes There is a getting started section on the landing page, that is currently explaining how to install the package, maybe we can add it there. Alternatively, we could add it to the " in 10 seconds" expandables of each top-level module (e.g. Cloud Datastore)

coveralls · 2015-01-13T23:44:53Z

Coverage remained the same when pulling d50cc57 on dhermes:add-3LO into 8a42ef5 on GoogleCloudPlatform:master.

gcloud/credentials.py

dhermes · 2015-01-14T21:04:50Z

Now that I think about it, the process described in the docstring for get_credentials_from_user_flow() is not any simpler than the process required to set up the files / env vars needed for get_credentials() or get_for_service_account_p12().

@silvolu Do we really need / want user 3LO? I can see cases where someone would want to write a CLI application and have users go through a flow, but we support plugging in arbitrary credentials to our Connection classes so this doesn't preclude them. Instead it puts the onus on those users to define their own flow.

anthmgoogle · 2015-01-15T01:47:03Z

I provided some comments on the implementation.

I think a GCloud-specific wrapper for 3LO is relatively low priority, since
there is no user-owned data at stake, so you would typically just use it as
a way to reusing the user's permissions.

One thing that may not be widely known yet is that you can actually now use
the GCloud SDK for this. As of a release in late 2014, the Cloud SDK's
"gcloud auth login" command will also set up the Application Default
Credentials in the well-known-file location and it includes all Cloud API
scopes. This means you can use 3LO with your own credentials as a proxy at
development time, but you don't need to have an any actual 3LO related UI
in you application. We'd love to get feedback about whether this works for
scenarios like this.

That being said, I do belive there is a need for better 3L0 libraries,
primarily for APIs like that DO represent end user data (e.g. Calendar,
GMail). Ultimately I think we should provide a better wrapped
implementation of 3LO in oauth2client, such that writing code such as that
in this change list bcomes 95% UI logic only a few library calls instead of
needed this embedded auth and serialization logic.

On Wed, Jan 14, 2015 at 1:04 PM, Danny Hermes [email protected]
wrote:

Now that I think about it, the process described in the docstring for
get_credentials_from_user_flow() is not any simpler than the process
required to set up the files / env vars needed for get_credentials() or
get_for_service_account_p12().

@silvolu https://github.com/silvolu Do we really need / want user 3LO?
I can see cases where someone would want to write a CLI application and
have users go through a flow, but we support plugging in arbitrary
credentials to our Connection classes so this doesn't preclude them.
Instead it puts the onus on those users to define their own flow.

—
Reply to this email directly or view it on GitHub
#539 (comment)
.

silvolu · 2015-01-15T01:56:28Z

@dhermes all I wanted was support for application default credentials :)
@jgeewax you wanted this to make getting started with the demo easier, do you still think that's the case?

dhermes · 2015-01-15T03:52:27Z

@anthmgoogle that hits it exactly on the head! I somehow forgot that GoogleCredentials.get_default_credentials (which we already use) could use the well-known file.

I am going to close this and we can discuss the best way to document it in #335.

Source-Link: https://togithub.com/googleapis/synthtool/commit/eaef28efd179e6eeb9f4e9bf697530d074a6f3b9 Post-Processor: gcr.io/cloud-devrel-public-resources/owlbot-python:latest@sha256:f8ca7655fa8a449cadcabcbce4054f593dcbae7aeeab34aa3fcc8b5cf7a93c9e

* fix: Add async context manager return types chore: Mock return_value should not populate oneof message fields chore: Support snippet generation for services that only support REST transport chore: Update gapic-generator-python to v1.11.0 PiperOrigin-RevId: 545430278 Source-Link: googleapis/googleapis@601b532 Source-Link: googleapis/googleapis-gen@b3f18d0 Copy-Tag: eyJwIjoiLmdpdGh1Yi8uT3dsQm90LnlhbWwiLCJoIjoiYjNmMThkMGY2NTYwYTg1NTAyMmZkMDU4ODY1ZTc2MjA0NzlkN2FmOSJ9 * 🦉 Updates from OwlBot post-processor See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md --------- Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>

* fix: Add async context manager return types chore: Mock return_value should not populate oneof message fields chore: Support snippet generation for services that only support REST transport chore: Update gapic-generator-python to v1.11.0 PiperOrigin-RevId: 545430278 Source-Link: googleapis/googleapis@601b532 Source-Link: googleapis/googleapis-gen@b3f18d0 Copy-Tag: eyJwIjoiLmdpdGh1Yi8uT3dsQm90LnlhbWwiLCJoIjoiYjNmMThkMGY2NTYwYTg1NTAyMmZkMDU4ODY1ZTc2MjA0NzlkN2FmOSJ9 * 🦉 Updates from OwlBot post-processor See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md --------- Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>

* docs: Minor formatting chore: Update gapic-generator-python to v1.11.5 build: Update rules_python to 0.24.0 PiperOrigin-RevId: 563436317 Source-Link: googleapis/googleapis@42fd37b Source-Link: googleapis/googleapis-gen@280264c Copy-Tag: eyJwIjoiLmdpdGh1Yi8uT3dsQm90LnlhbWwiLCJoIjoiMjgwMjY0Y2EwMmZiOTMxNmI0MjM3YTk2ZDBhZjFhMjM0M2E4MWE1NiJ9 * 🦉 Updates from OwlBot post-processor See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md --------- Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>

* fix(deps): Require google-api-core >=1.34.0, >=2.11.0 fix: Drop usage of pkg_resources fix: Fix timeout default values docs(samples): Snippetgen should call await on the operation coroutine before calling result PiperOrigin-RevId: 493260409 Source-Link: googleapis/googleapis@fea4387 Source-Link: googleapis/googleapis-gen@387b734 Copy-Tag: eyJwIjoiLmdpdGh1Yi8uT3dsQm90LnlhbWwiLCJoIjoiMzg3YjczNDRjNzUyOWVlNDRiZTg0ZTYxM2IxOWE4MjA1MDhjNjEyYiJ9 * 🦉 Updates from OwlBot post-processor See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md * fix(deps): require google-api-core>=1.34.0,>=2.11.0 Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com> Co-authored-by: Anthonios Partheniou <[email protected]>

…n. (#539)

Source-Link: googleapis/synthtool@d52e638 Post-Processor: gcr.io/cloud-devrel-public-resources/owlbot-python:latest@sha256:4f9b3b106ad0beafc2c8a415e3f62c1a0cc23cabea115dbe841b848f581cfe99 Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>

Source-Link: googleapis/synthtool@f15cc72 Post-Processor: gcr.io/cloud-devrel-public-resources/owlbot-python:latest@sha256:bc5eed3804aec2f05fad42aacf973821d9500c174015341f721a984a0825b6fd

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>

Source-Link: googleapis/synthtool@f15cc72 Post-Processor: gcr.io/cloud-devrel-public-resources/owlbot-python:latest@sha256:bc5eed3804aec2f05fad42aacf973821d9500c174015341f721a984a0825b6fd

* updated CHANGELOG.md [ci skip] * updated setup.cfg [ci skip] * updated setup.py Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>

silvolu mentioned this pull request Jan 13, 2015

Enable auth via oauth2client: 3LO, Implicit from Environ, p12 and JSON service account #335

Closed

6 tasks

silvolu reviewed Jan 13, 2015
View reviewed changes

gcloud/credentials.py

This comment was marked as spam.

Sign in to view

This comment was marked as spam.

Sign in to view

This comment was marked as spam.

Sign in to view

Adding 3-legged auth for users getting started.

5dd60f9

Addresses final part of googleapis#335.

Adding more user-friendly error when filename missing for user creds.

d50cc57

dhermes force-pushed the add-3LO branch from 9101a32 to d50cc57 Compare January 13, 2015 23:42

dhermes added type: feature request ‘Nice-to-have’ improvement, new feature or different behavior or design. milestone-feature labels Jan 13, 2015

tseaver reviewed Jan 14, 2015
View reviewed changes

gcloud/credentials.py

This comment was marked as spam.

Sign in to view

This comment was marked as spam.

Sign in to view

This comment was marked as spam.

Sign in to view

dhermes closed this Jan 15, 2015

parthea pushed a commit that referenced this pull request Oct 21, 2023

chore(main): release 3.17.1 (#539)

2fe6cc2

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>

release-please bot mentioned this pull request Oct 30, 2023

chore: release main #11913

Merged

parthea pushed a commit that referenced this pull request Sep 18, 2025

fix: allow to_gbq to run without bigquery.tables.create permissio…

609f7c8

…n. (#539)

parthea pushed a commit that referenced this pull request Nov 24, 2025

chore: release 1.6.0 (#539)

b01c27d

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>

parthea pushed a commit that referenced this pull request Nov 26, 2025

chore: release 1.18.0 (#539)

cd9fbee

* updated CHANGELOG.md [ci skip] * updated setup.cfg [ci skip] * updated setup.py Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>

Adding 3-legged auth for users getting started. #539

Adding 3-legged auth for users getting started. #539

Uh oh!

Conversation

dhermes commented Jan 13, 2015

Uh oh!

coveralls commented Jan 13, 2015

Uh oh!

craigcitro commented Jan 13, 2015

Uh oh!

This comment was marked as spam.

Uh oh!

This comment was marked as spam.

Uh oh!

This comment was marked as spam.

Uh oh!

silvolu commented Jan 13, 2015

Uh oh!

coveralls commented Jan 13, 2015

Uh oh!

This comment was marked as spam.

Uh oh!

This comment was marked as spam.

Uh oh!

This comment was marked as spam.

Uh oh!

dhermes commented Jan 14, 2015

Uh oh!

anthmgoogle commented Jan 15, 2015

Uh oh!

silvolu commented Jan 15, 2015

Uh oh!

dhermes commented Jan 15, 2015

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants