Class: Google::Auth::ServiceAccountJwtHeaderCredentials
- Inherits:
-
Object
- Object
- Google::Auth::ServiceAccountJwtHeaderCredentials
- Extended by:
- CredentialsLoader, JsonKeyReader
- Defined in:
- lib/googleauth/service_account.rb
Overview
Authenticates requests using Google's Service Account credentials via JWT Header.
This class allows authorizing requests for service accounts directly from credentials from a json key file downloaded from the developer console (via 'Generate new Json Key'). It is not part of any OAuth2 flow, rather it creates a JWT and sends that as a credential.
Constant Summary collapse
- JWT_AUD_URI_KEY =
:jwt_aud_uri
- AUTH_METADATA_KEY =
Google::Auth::BaseClient::AUTH_METADATA_KEY
- TOKEN_CRED_URI =
"https://www.googleapis.com/oauth2/v4/token".freeze
- SIGNING_ALGORITHM =
"RS256".freeze
- EXPIRY =
60
Constants included from CredentialsLoader
CredentialsLoader::ACCOUNT_TYPE_VAR, CredentialsLoader::AWS_ACCESS_KEY_ID_VAR, CredentialsLoader::AWS_DEFAULT_REGION_VAR, CredentialsLoader::AWS_REGION_VAR, CredentialsLoader::AWS_SECRET_ACCESS_KEY_VAR, CredentialsLoader::AWS_SESSION_TOKEN_VAR, CredentialsLoader::CLIENT_EMAIL_VAR, CredentialsLoader::CLIENT_ID_VAR, CredentialsLoader::CLIENT_SECRET_VAR, CredentialsLoader::CLOUD_SDK_CLIENT_ID, CredentialsLoader::CREDENTIALS_FILE_NAME, CredentialsLoader::ENV_VAR, CredentialsLoader::GCLOUD_CONFIG_COMMAND, CredentialsLoader::GCLOUD_POSIX_COMMAND, CredentialsLoader::GCLOUD_WINDOWS_COMMAND, CredentialsLoader::NOT_FOUND_ERROR, CredentialsLoader::PRIVATE_KEY_VAR, CredentialsLoader::PROJECT_ID_VAR, CredentialsLoader::REFRESH_TOKEN_VAR, CredentialsLoader::SYSTEM_DEFAULT_ERROR, CredentialsLoader::WELL_KNOWN_ERROR, CredentialsLoader::WELL_KNOWN_PATH
Instance Attribute Summary collapse
-
#project_id ⇒ Object
readonly
Returns the value of attribute project_id.
-
#quota_project_id ⇒ Object
readonly
Returns the value of attribute quota_project_id.
Class Method Summary collapse
-
.make_creds(options = {}) ⇒ Object
Create a ServiceAccountJwtHeaderCredentials.
Instance Method Summary collapse
-
#apply(a_hash, opts = {}) ⇒ Object
Returns a clone of a_hash updated with the authoriation header.
-
#apply!(a_hash, opts = {}) ⇒ Object
Construct a jwt token if the JWT_AUD_URI key is present in the input hash.
-
#initialize(options = {}) ⇒ ServiceAccountJwtHeaderCredentials
constructor
Initializes a ServiceAccountJwtHeaderCredentials.
-
#new_jwt_token(jwt_aud_uri = nil, options = {}) ⇒ Object
Creates a jwt uri token.
-
#updater_proc ⇒ Object
Returns a reference to the #apply method, suitable for passing as a closure.
Methods included from CredentialsLoader
from_env, from_system_default_path, from_well_known_path, load_gcloud_project_id, make_creds
Methods included from JsonKeyReader
Constructor Details
#initialize(options = {}) ⇒ ServiceAccountJwtHeaderCredentials
Initializes a ServiceAccountJwtHeaderCredentials.
154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 |
# File 'lib/googleauth/service_account.rb', line 154 def initialize = {} json_key_io = [:json_key_io] if json_key_io @private_key, @issuer, @project_id, @quota_project_id = self.class.read_json_key json_key_io else @private_key = ENV[CredentialsLoader::PRIVATE_KEY_VAR] @issuer = ENV[CredentialsLoader::CLIENT_EMAIL_VAR] @project_id = ENV[CredentialsLoader::PROJECT_ID_VAR] @quota_project_id = nil end @project_id ||= CredentialsLoader.load_gcloud_project_id @signing_key = OpenSSL::PKey::RSA.new @private_key @scope = [:scope] end |
Instance Attribute Details
#project_id ⇒ Object (readonly)
Returns the value of attribute project_id.
139 140 141 |
# File 'lib/googleauth/service_account.rb', line 139 def project_id @project_id end |
#quota_project_id ⇒ Object (readonly)
Returns the value of attribute quota_project_id.
140 141 142 |
# File 'lib/googleauth/service_account.rb', line 140 def quota_project_id @quota_project_id end |
Class Method Details
.make_creds(options = {}) ⇒ Object
Create a ServiceAccountJwtHeaderCredentials.
146 147 148 149 |
# File 'lib/googleauth/service_account.rb', line 146 def self.make_creds = {} json_key_io, scope = .values_at :json_key_io, :scope new json_key_io: json_key_io, scope: scope end |
Instance Method Details
#apply(a_hash, opts = {}) ⇒ Object
Returns a clone of a_hash updated with the authoriation header
183 184 185 186 187 |
# File 'lib/googleauth/service_account.rb', line 183 def apply a_hash, opts = {} a_copy = a_hash.clone apply! a_copy, opts a_copy end |
#apply!(a_hash, opts = {}) ⇒ Object
Construct a jwt token if the JWT_AUD_URI key is present in the input hash.
The jwt token is used as the value of a 'Bearer '.
174 175 176 177 178 179 180 |
# File 'lib/googleauth/service_account.rb', line 174 def apply! a_hash, opts = {} jwt_aud_uri = a_hash.delete JWT_AUD_URI_KEY return a_hash if jwt_aud_uri.nil? && @scope.nil? jwt_token = new_jwt_token jwt_aud_uri, opts a_hash[AUTH_METADATA_KEY] = "Bearer #{jwt_token}" a_hash end |
#new_jwt_token(jwt_aud_uri = nil, options = {}) ⇒ Object
Creates a jwt uri token.
196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 |
# File 'lib/googleauth/service_account.rb', line 196 def new_jwt_token jwt_aud_uri = nil, = {} now = Time.new skew = [:skew] || 60 assertion = { "iss" => @issuer, "sub" => @issuer, "exp" => (now + EXPIRY).to_i, "iat" => (now - skew).to_i } jwt_aud_uri = nil if @scope assertion["scope"] = Array(@scope).join " " if @scope assertion["aud"] = jwt_aud_uri if jwt_aud_uri JWT.encode assertion, @signing_key, SIGNING_ALGORITHM end |
#updater_proc ⇒ Object
Returns a reference to the #apply method, suitable for passing as a closure
191 192 193 |
# File 'lib/googleauth/service_account.rb', line 191 def updater_proc proc { |a_hash, opts = {}| apply a_hash, opts } end |