Class: Google::Auth::ServiceAccountJwtHeaderCredentials

Inherits:
Object
  • Object
show all
Extended by:
CredentialsLoader, JsonKeyReader
Defined in:
lib/googleauth/service_account.rb

Overview

Authenticates requests using Google's Service Account credentials via JWT Header.

This class allows authorizing requests for service accounts directly from credentials from a json key file downloaded from the developer console (via 'Generate new Json Key'). It is not part of any OAuth2 flow, rather it creates a JWT and sends that as a credential.

cf Application Default Credentials

Constant Summary collapse

JWT_AUD_URI_KEY = 
:jwt_aud_uri
AUTH_METADATA_KEY = 
Google::Auth::BaseClient::AUTH_METADATA_KEY
TOKEN_CRED_URI = 
"https://www.googleapis.com/oauth2/v4/token".freeze
SIGNING_ALGORITHM = 
"RS256".freeze
EXPIRY = 
60

Constants included from CredentialsLoader

CredentialsLoader::ACCOUNT_TYPE_VAR, CredentialsLoader::AWS_ACCESS_KEY_ID_VAR, CredentialsLoader::AWS_DEFAULT_REGION_VAR, CredentialsLoader::AWS_REGION_VAR, CredentialsLoader::AWS_SECRET_ACCESS_KEY_VAR, CredentialsLoader::AWS_SESSION_TOKEN_VAR, CredentialsLoader::CLIENT_EMAIL_VAR, CredentialsLoader::CLIENT_ID_VAR, CredentialsLoader::CLIENT_SECRET_VAR, CredentialsLoader::CLOUD_SDK_CLIENT_ID, CredentialsLoader::CREDENTIALS_FILE_NAME, CredentialsLoader::ENV_VAR, CredentialsLoader::GCLOUD_CONFIG_COMMAND, CredentialsLoader::GCLOUD_POSIX_COMMAND, CredentialsLoader::GCLOUD_WINDOWS_COMMAND, CredentialsLoader::NOT_FOUND_ERROR, CredentialsLoader::PRIVATE_KEY_VAR, CredentialsLoader::PROJECT_ID_VAR, CredentialsLoader::REFRESH_TOKEN_VAR, CredentialsLoader::SYSTEM_DEFAULT_ERROR, CredentialsLoader::WELL_KNOWN_ERROR, CredentialsLoader::WELL_KNOWN_PATH

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Methods included from CredentialsLoader

from_env, from_system_default_path, from_well_known_path, load_gcloud_project_id, make_creds

Methods included from JsonKeyReader

read_json_key

Constructor Details

#initialize(options = {}) ⇒ ServiceAccountJwtHeaderCredentials

Initializes a ServiceAccountJwtHeaderCredentials.

Parameters:

  • json_key_io (IO) —

    an IO from which the JSON key can be read



166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
 
# File 'lib/googleauth/service_account.rb', line 166

def initialize options = {}
  json_key_io = options[:json_key_io]
  if json_key_io
    @private_key, @issuer, @project_id, @quota_project_id, @universe_domain =
      self.class.read_json_key json_key_io
  else
    @private_key = ENV[CredentialsLoader::PRIVATE_KEY_VAR]
    @issuer = ENV[CredentialsLoader::CLIENT_EMAIL_VAR]
    @project_id = ENV[CredentialsLoader::PROJECT_ID_VAR]
    @quota_project_id = nil
    @universe_domain = nil
  end
  @universe_domain ||= "googleapis.com"
  @project_id ||= CredentialsLoader.load_gcloud_project_id
  @signing_key = OpenSSL::PKey::RSA.new @private_key
  @scope = options[:scope]
end

Instance Attribute Details

#logger ⇒ Object

Returns the value of attribute logger.



152
153
154
 
# File 'lib/googleauth/service_account.rb', line 152

def logger
  @logger
end

#project_id ⇒ Object (readonly)

Returns the value of attribute project_id.



149
150
151
 
# File 'lib/googleauth/service_account.rb', line 149

def project_id
  @project_id
end

#quota_project_id ⇒ Object (readonly)

Returns the value of attribute quota_project_id.



150
151
152
 
# File 'lib/googleauth/service_account.rb', line 150

def quota_project_id
  @quota_project_id
end

#universe_domain ⇒ Object

Returns the value of attribute universe_domain.



151
152
153
 
# File 'lib/googleauth/service_account.rb', line 151

def universe_domain
  @universe_domain
end

Class Method Details

.make_creds(options = {}) ⇒ Object

Create a ServiceAccountJwtHeaderCredentials.

Parameters:

  • json_key_io (IO) —

    an IO from which the JSON key can be read

  • scope (string|array|nil) —

    the scope(s) to access



158
159
160
161
 
# File 'lib/googleauth/service_account.rb', line 158

def self.make_creds options = {}
  json_key_io, scope = options.values_at :json_key_io, :scope
  new json_key_io: json_key_io, scope: scope
end

Instance Method Details

#apply(a_hash, opts = {}) ⇒ Object

Returns a clone of a_hash updated with the authorization header



201
202
203
204
205
 
# File 'lib/googleauth/service_account.rb', line 201

def apply a_hash, opts = {}
  a_copy = a_hash.clone
  apply! a_copy, opts
  a_copy
end

#apply!(a_hash, opts = {}) ⇒ Object

Construct a jwt token if the JWT_AUD_URI key is present in the input hash.

The jwt token is used as the value of a 'Bearer '.



188
189
190
191
192
193
194
195
196
197
198
 
# File 'lib/googleauth/service_account.rb', line 188

def apply! a_hash, opts = {}
  jwt_aud_uri = a_hash.delete JWT_AUD_URI_KEY
  return a_hash if jwt_aud_uri.nil? && @scope.nil?
  jwt_token = new_jwt_token jwt_aud_uri, opts
  a_hash[AUTH_METADATA_KEY] = "Bearer #{jwt_token}"
  logger&.debug do
    hash = Digest::SHA256.hexdigest jwt_token
    Google::Logging::Message.from message: "Sending JWT auth token. (sha256:#{hash})"
  end
  a_hash
end

#needs_access_token? ⇒ Boolean

Duck-types the corresponding method from BaseClient

Returns:

  • (Boolean) 


237
238
239
 
# File 'lib/googleauth/service_account.rb', line 237

def needs_access_token?
  false
end

#new_jwt_token(jwt_aud_uri = nil, options = {}) ⇒ Object

Creates a jwt uri token.



214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
 
# File 'lib/googleauth/service_account.rb', line 214

def new_jwt_token jwt_aud_uri = nil, options = {}
  now = Time.new
  skew = options[:skew] || 60
  assertion = {
    "iss" => @issuer,
    "sub" => @issuer,
    "exp" => (now + EXPIRY).to_i,
    "iat" => (now - skew).to_i
  }

  jwt_aud_uri = nil if @scope

  assertion["scope"] = Array(@scope).join " " if @scope
  assertion["aud"] = jwt_aud_uri if jwt_aud_uri

  logger&.debug do
    Google::Logging::Message.from message: "JWT assertion: #{assertion}"
  end

  JWT.encode assertion, @signing_key, SIGNING_ALGORITHM
end

#updater_proc ⇒ Object

Returns a reference to the #apply method, suitable for passing as a closure



209
210
211
 
# File 'lib/googleauth/service_account.rb', line 209

def updater_proc
  proc { |a_hash, opts = {}| apply a_hash, opts }
end