Skip to content

docs(samples): added auth samples and tests #927

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 30 commits into from
Aug 4, 2022
Merged

docs(samples): added auth samples and tests #927

Changes from 1 commit
Commits
Show all changes
30 commits
Select commit Hold shift + click to select a range
3bd604d
docs(samples): added client code for idtoken, adc and metadata server
Sita04 Jun 6, 2022
bd1bc55
docs(samples): added authexplicit and copyright
Sita04 Jun 8, 2022
ece1c56
docs(samples): add auth with metadata server
Sita04 Jun 8, 2022
0c26c33
docs(samples): minor refactoring and added tests
Sita04 Jun 8, 2022
45449b2
🦉 Updates from OwlBot post-processor
gcf-owl-bot[bot] Jun 8, 2022
7ef36df
Merge branch 'main' into auth-samples
Shabirmean Jun 14, 2022
b2f367e
refactored acc to review comments
Sita04 Jul 18, 2022
01b57ad
Merge remote-tracking branch 'origin/auth-samples' into auth-samples
Sita04 Jul 18, 2022
b9dee60
Merge branch 'main' into auth-samples
Sita04 Jul 18, 2022
3ed6be0
refactored acc to review comments
Sita04 Jul 22, 2022
dd39fd4
Merge remote-tracking branch 'origin/auth-samples' into auth-samples
Sita04 Jul 22, 2022
a46ccc4
Merge branch 'main' into auth-samples
Sita04 Jul 25, 2022
5eb6506
refactored acc to review comments
Sita04 Jul 28, 2022
cc6a5a5
Merge remote-tracking branch 'origin/auth-samples' into auth-samples
Sita04 Jul 28, 2022
7c68634
🦉 Updates from OwlBot post-processor
gcf-owl-bot[bot] Jul 28, 2022
1baeebe
minor comment update
Sita04 Jul 28, 2022
9fc3a7a
Merge remote-tracking branch 'origin/auth-samples' into auth-samples
Sita04 Jul 28, 2022
b8c5f3f
Merge branch 'main' into auth-samples
Sita04 Jul 29, 2022
680cfdd
modified google id token verification and removed third party dependency
Sita04 Jul 29, 2022
1944e5d
Merge remote-tracking branch 'origin/auth-samples' into auth-samples
Sita04 Jul 29, 2022
a943290
removed third party deps from pom
Sita04 Jul 29, 2022
d7d6257
🦉 Updates from OwlBot post-processor
gcf-owl-bot[bot] Jul 29, 2022
cf11754
Merge branch 'auth-samples' of https://github.com/googleapis/google-a…
gcf-owl-bot[bot] Jul 29, 2022
b910be5
🦉 Updates from OwlBot post-processor
gcf-owl-bot[bot] Jul 29, 2022
e23fe35
Merge branch 'auth-samples' of https://github.com/googleapis/google-a…
gcf-owl-bot[bot] Jul 29, 2022
ada91fb
Merge branch 'main' into auth-samples
Sita04 Jul 29, 2022
8573bb3
Merge branch 'main' into auth-samples
Sita04 Aug 4, 2022
591d0e6
included comment about verifying Google ID tokens
Sita04 Aug 4, 2022
82d7350
Merge remote-tracking branch 'origin/auth-samples' into auth-samples
Sita04 Aug 4, 2022
54013b5
🦉 Updates from OwlBot post-processor
gcf-owl-bot[bot] Aug 4, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
minor comment update
  • Loading branch information
@Sita04
Sita04 committed Jul 28, 2022
commit 1baeebed5764b78fcc6f2bd9e7f2366a5282e6d4
11 changes: 3 additions & 8 deletions samples/snippets/src/main/java/IdTokenFromImpersonatedCredentials.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,14 +60,9 @@ public static void getIdTokenUsingOAuth2(String impersonatedServiceAccount, Stri
GoogleCredentials googleCredentials = GoogleCredentials.getApplicationDefault();

// delegates: The chained list of delegates required to grant the final accessToken.
Copy link
Contributor

@piaxc piaxc Jun 27, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've also separated out the delegation flow from the single service account flow. It doesn't make sense to create an ID token from a delegation chain, because there's no authz included for ID tokens. So let's just stick to a single privilege-bearing (current term, subject to change) service account (no delegation chain).

Copy link
Contributor

@piaxc piaxc Jul 25, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reopening because you are still including delegate chain. There should be just one privilege-bearing service account and one caller, which can be represented by either a service account or a user account.
https://cloud.google.com/iam/docs/create-short-lived-credentials-direct

Copy link
Contributor Author

@Sita04 Sita04 Jul 28, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The delegates parameter is mandatory in the "Impersonated Credentials" API, unlike the other one we used from IAM library.
Hence, I am unable to remove it. Added clarifying comments stating that it's optional. wdyt?

Copy link
Contributor

@piaxc piaxc Jul 28, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could we just say
// delegates: Unused for this call
or something like that? I'm concerned that the subject of chaining is very complex, and that folks will spend a lot of time trying to parse and understand what identities need to have what permission on what-- only to get to the bottom and find out it's unused. Why put them through that?

//
// If set, the sequence of identities must have "Service Account Token Creator" capability
// granted to the preceding identity.
// For example, if set to [serviceAccountB, serviceAccountC], the source credential must have
// the Token Creator role on serviceAccountB. serviceAccountB must have the Token Creator on
// serviceAccountC. Finally, C must have Token Creator on impersonatedServiceAccount.
//
// If left unset, source credential must have that role on impersonatedServiceAccount.
// For more information, see:
// https://cloud.google.com/iam/docs/create-short-lived-credentials-direct#sa-credentials-permissions
// Delegate is NOT USED here.
List<String> delegates = null;

// Create the impersonated credential.
Expand Down