Class: Google::Auth::ServiceAccountJwtHeaderCredentials

Inherits:
Object
  • Object
show all
Extended by:
CredentialsLoader
Defined in:
lib/googleauth/service_account.rb

Overview

Authenticates requests using Google’s Service Account credentials via JWT Header.

This class allows authorizing requests for service accounts directly from credentials from a json key file downloaded from the developer console (via ‘Generate new Json Key’). It is not part of any OAuth2 flow, rather it creates a JWT and sends that as a credential.

cf [Application Default Credentials](goo.gl/mkAHpZ)

Constant Summary collapse

JWT_AUD_URI_KEY = 
:jwt_aud_uri
AUTH_METADATA_KEY = 
Signet::OAuth2::AUTH_METADATA_KEY
TOKEN_CRED_URI = 
'https://www.googleapis.com/oauth2/v3/token'
SIGNING_ALGORITHM = 
'RS256'
EXPIRY = 
60

Constants included from CredentialsLoader

CredentialsLoader::ENV_VAR, CredentialsLoader::NOT_FOUND_ERROR, CredentialsLoader::WELL_KNOWN_ERROR, CredentialsLoader::WELL_KNOWN_PATH

Class Method Summary collapse

Instance Method Summary collapse

Methods included from CredentialsLoader

from_env, from_well_known_path, make_creds, windows?

Constructor Details

#initialize(json_key_io) ⇒ ServiceAccountJwtHeaderCredentials

Initializes a ServiceAccountJwtHeaderCredentials.

Parameters:

  • json_key_io (IO) —

    an IO from which the JSON key can be read



138
139
140
141
142
143
 
# File 'lib/googleauth/service_account.rb', line 138

def initialize(json_key_io)
  private_key, client_email = self.class.read_json_key(json_key_io)
  @private_key = private_key
  @issuer = client_email
  @signing_key = OpenSSL::PKey::RSA.new(private_key)
end

Class Method Details

.make_creds(*args) ⇒ Object

make_creds proxies the construction of a credentials instance

make_creds is used by the methods in CredentialsLoader.

By default, it calls #new with 2 args, the second one being an optional scope. Here’s the constructor only has one param, so we modify make_creds to reflect this.



122
123
124
 
# File 'lib/googleauth/service_account.rb', line 122

def self.make_creds(*args)
  new(args[0])
end

.read_json_key(json_key_io) ⇒ Object

Reads the private key and client email fields from the service account JSON key.



128
129
130
131
132
133
 
# File 'lib/googleauth/service_account.rb', line 128

def self.read_json_key(json_key_io)
  json_key = MultiJson.load(json_key_io.read)
  fail 'missing client_email' unless json_key.key?('client_email')
  fail 'missing private_key' unless json_key.key?('private_key')
  [json_key['private_key'], json_key['client_email']]
end

Instance Method Details

#apply(a_hash, opts = {}) ⇒ Object

Returns a clone of a_hash updated with the authoriation header



158
159
160
161
162
 
# File 'lib/googleauth/service_account.rb', line 158

def apply(a_hash, opts = {})
  a_copy = a_hash.clone
  apply!(a_copy, opts)
  a_copy
end

#apply!(a_hash, opts = {}) ⇒ Object

Construct a jwt token if the JWT_AUD_URI key is present in the input hash.

The jwt token is used as the value of a ‘Bearer ’.



149
150
151
152
153
154
155
 
# File 'lib/googleauth/service_account.rb', line 149

def apply!(a_hash, opts = {})
  jwt_aud_uri = a_hash.delete(JWT_AUD_URI_KEY)
  return a_hash if jwt_aud_uri.nil?
  jwt_token = new_jwt_token(jwt_aud_uri, opts)
  a_hash[AUTH_METADATA_KEY] = "Bearer #{jwt_token}"
  a_hash
end

#updater_proc ⇒ Object

Returns a reference to the #apply method, suitable for passing as a closure



166
167
168
 
# File 'lib/googleauth/service_account.rb', line 166

def updater_proc
  lambda(&method(:apply))
end