Module: Google::Auth::Extras

Extended by:
Extras
Included in:
Extras
Defined in:
lib/google/auth/extras.rb,
lib/google/auth/extras/version.rb,
lib/google/auth/extras/token_info.rb,
lib/google/auth/extras/static_credential.rb,
lib/google/auth/extras/impersonated_credential.rb,
lib/google/auth/extras/service_account_jwt_credential.rb

Overview

This module provides some extra features not supported in the normal googleauth gem.

Defined Under Namespace

Modules: TokenInfo Classes: ImpersonatedCredential, RefreshNotSupported, ServiceAccountJWTCredential, StaticCredential

Constant Summary collapse

VERSION = 
'0.6.0'

Instance Method Summary collapse

Instance Method Details

#impersonated_authorization(email_address:, base_credentials: nil, delegate_email_addresses: nil, include_email: nil, lifetime: nil, quota_project_id: nil, scope: nil, target_audience: nil, universe_domain: 'googleapis.com') ⇒ Google::Auth::Extras::ImpersonatedCredential

A credential that impersonates a service account. For usage with the older style GCP Ruby SDKs from the google-apis-* gems.

The email_address of the service account to impersonate may be the exact same as the one represented in base_credentials for any desired situation but a handy usage is for going from and access token to an ID token (aka using target_audience).

Parameters:

  • base_credentials (Hash, String, Signet::OAuth2::Client) (defaults to: nil) —

    Credentials to use to impersonate the provided email address.

  • delegate_email_addresses (String, Array<String>) (defaults to: nil) —

    The list of email address if there are intermediate service accounts that need to be impersonated using delegation.

  • email_address (String) —

    Email of the service account to impersonate.

  • include_email (Boolean) (defaults to: nil) —

    Include the service account email in the token. If set to true, the token will contain email and email_verified claims. Only supported when using a target_audience.

  • lifetime (String) (defaults to: nil) —

    The desired lifetime (in seconds) of the token before needing to be refreshed. Defaults to 1h, adjust as needed given a refresh is automatically performed when the token less than 60s of remaining life and refresh requires an additional API call. Only supported when not using a target_audience.

  • quota_project_id (String) (defaults to: nil) —

    The project ID used for quota and billing. This project may be different from the project used to create the credentials.

  • scope (String, Array<String>) (defaults to: nil) —

    The OAuth 2 scopes to request. Can either be formatted as a comma seperated string or array. Only supported when not using a target_audience.

  • universe_domain (String) (defaults to: 'googleapis.com') —

    The universe domain of the credential, reported to gRPC google-cloud clients so they don't raise Gapic::UniverseDomainMismatch. Defaults to googleapis.com.

Returns:

See Also:



72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
 
# File 'lib/google/auth/extras.rb', line 72

def impersonated_authorization(
  email_address:,
  base_credentials: nil,
  delegate_email_addresses: nil,
  include_email: nil,
  lifetime: nil,
  quota_project_id: nil,
  scope: nil,
  target_audience: nil,
  universe_domain: 'googleapis.com'
)
  ImpersonatedCredential.new(
    base_credentials: base_credentials,
    delegate_email_addresses: delegate_email_addresses,
    email_address: email_address,
    include_email: include_email,
    lifetime: lifetime,
    quota_project_id: quota_project_id,
    scope: scope,
    target_audience: target_audience,
    universe_domain: universe_domain,
  )
end

#impersonated_credential(email_address:, base_credentials: nil, delegate_email_addresses: nil, include_email: nil, lifetime: nil, quota_project_id: nil, scope: nil, target_audience: nil, universe_domain: 'googleapis.com') ⇒ Google::Auth::Credential<Google::Auth::Extras::ImpersonatedCredential>

A credential that impersonates a service account. For usage with the newer style GCP Ruby SDKs from the google-cloud-* gems.

Parameters:

  • base_credentials (Hash, String, Signet::OAuth2::Client) (defaults to: nil) —

    Credentials to use to impersonate the provided email address.

  • delegate_email_addresses (String, Array<String>) (defaults to: nil) —

    The list of email address if there are intermediate service accounts that need to be impersonated using delegation.

  • email_address (String) —

    Email of the service account to impersonate.

  • include_email (Boolean) (defaults to: nil) —

    Include the service account email in the token. If set to true, the token will contain email and email_verified claims. Only supported when using a target_audience.

  • lifetime (String) (defaults to: nil) —

    The desired lifetime (in seconds) of the token before needing to be refreshed. Defaults to 1h, adjust as needed given a refresh is automatically performed when the token less than 60s of remaining life and refresh requires an additional API call. Only supported when not using a target_audience.

  • quota_project_id (String) (defaults to: nil) —

    The project ID used for quota and billing. This project may be different from the project used to create the credentials.

  • scope (String, Array<String>) (defaults to: nil) —

    The OAuth 2 scopes to request. Can either be formatted as a comma seperated string or array. Only supported when not using a target_audience.

  • universe_domain (String) (defaults to: 'googleapis.com') —

    The universe domain of the credential, reported to gRPC google-cloud clients so they don't raise Gapic::UniverseDomainMismatch. Defaults to googleapis.com.

Returns:

See Also:



140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
 
# File 'lib/google/auth/extras.rb', line 140

def impersonated_credential(
  email_address:,
  base_credentials: nil,
  delegate_email_addresses: nil,
  include_email: nil,
  lifetime: nil,
  quota_project_id: nil,
  scope: nil,
  target_audience: nil,
  universe_domain: 'googleapis.com'
)
  wrap_authorization(
    impersonated_authorization(
      base_credentials: base_credentials,
      delegate_email_addresses: delegate_email_addresses,
      email_address: email_address,
      include_email: include_email,
      lifetime: lifetime,
      quota_project_id: quota_project_id,
      scope: scope,
      target_audience: target_audience,
      universe_domain: universe_domain,
    ),
  )
end

#service_account_jwt_authorization(email_address:, target_audience:, base_credentials: nil, delegate_email_addresses: nil, issuer: nil, lifetime: 3600, subject: nil, universe_domain: 'googleapis.com') ⇒ Google::Auth::Extras::ServiceAccountJWTCredential

A credential that obtains a signed JWT from Google for a service account. For usage with the older style GCP Ruby SDKs from the google-apis-* gems. Also useful for calling IAP-protected endpoints using the Google-managed OAuth client.

Parameters:

  • base_credentials (Hash, String, Signet::OAuth2::Client) (defaults to: nil) —

    Credentials to use to sign the JWTs.

  • delegate_email_addresses (String, Array<String>) (defaults to: nil) —

    The email addresses (if any) of intermediate service accounts to reach the email_address from base_credentials.

  • email_address (String) —

    Email of the service account to sign the JWT.

  • issuer (String) (defaults to: nil) —

    The desired value of the iss field on the issued JWT. Defaults to the email_address.

  • lifetime (Integers) (defaults to: 3600) —

    The desired lifetime (in seconds) of the JWT before needing to be refreshed. Defaults to 3600 (1h), adjust as needed given a refresh is automatically performed when the token less than 60s of remaining life and refresh requires an additional API call.

  • subject (String) (defaults to: nil) —

    The desired value of the sub field on the issued JWT. Defaults to the email_address.

  • target_audience (String) —

    The audience for the token, such as the API or account that this token grants access to.

  • universe_domain (String) (defaults to: 'googleapis.com') —

    The universe domain of the credential, reported to gRPC google-cloud clients so they don't raise Gapic::UniverseDomainMismatch. Defaults to googleapis.com.

Returns:

See Also:



205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
 
# File 'lib/google/auth/extras.rb', line 205

def (
  email_address:,
  target_audience:,
  base_credentials: nil,
  delegate_email_addresses: nil,
  issuer: nil,
  lifetime: 3600,
  subject: nil,
  universe_domain: 'googleapis.com'
)
  ServiceAccountJWTCredential.new(
    base_credentials: base_credentials,
    delegate_email_addresses: delegate_email_addresses,
    email_address: email_address,
    issuer: issuer,
    lifetime: lifetime,
    subject: subject,
    target_audience: target_audience,
    universe_domain: universe_domain,
  )
end

#service_account_jwt_credential(email_address:, target_audience:, base_credentials: nil, delegate_email_addresses: nil, issuer: nil, lifetime: 3600, subject: nil, universe_domain: 'googleapis.com') ⇒ Google::Auth::Extras::ServiceAccountJWTCredential

A credential that obtains a signed JWT from Google for a service account. For usage with the newer style GCP Ruby SDKs from the google-cloud-* gems.

Parameters:

  • base_credentials (Hash, String, Signet::OAuth2::Client) (defaults to: nil) —

    Credentials to use to sign the JWTs.

  • delegate_email_addresses (String, Array<String>) (defaults to: nil) —

    The email addresses (if any) of intermediate service accounts to reach the email_address from base_credentials.

  • email_address (String) —

    Email of the service account to sign the JWT.

  • issuer (String) (defaults to: nil) —

    The desired value of the iss field on the issued JWT. Defaults to the email_address.

  • lifetime (Integers) (defaults to: 3600) —

    The desired lifetime (in seconds) of the JWT before needing to be refreshed. Defaults to 3600 (1h), adjust as needed given a refresh is automatically performed when the token less than 60s of remaining life and refresh requires an additional API call.

  • subject (String) (defaults to: nil) —

    The desired value of the sub field on the issued JWT. Defaults to the email_address.

  • target_audience (String) —

    The audience for the token, such as the API or account that this token grants access to.

  • universe_domain (String) (defaults to: 'googleapis.com') —

    The universe domain of the credential, reported to gRPC google-cloud clients so they don't raise Gapic::UniverseDomainMismatch. Defaults to googleapis.com.

Returns:

See Also:



264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
 
# File 'lib/google/auth/extras.rb', line 264

def (
  email_address:,
  target_audience:,
  base_credentials: nil,
  delegate_email_addresses: nil,
  issuer: nil,
  lifetime: 3600,
  subject: nil,
  universe_domain: 'googleapis.com'
)
  wrap_authorization(
    (
      base_credentials: base_credentials,
      delegate_email_addresses: delegate_email_addresses,
      email_address: email_address,
      issuer: issuer,
      lifetime: lifetime,
      subject: subject,
      target_audience: target_audience,
      universe_domain: universe_domain,
    ),
  )
end

#static_authorization(token, quota_project_id: nil, universe_domain: 'googleapis.com') ⇒ Google::Auth::Extras::StaticCredential

A credential using a static access token. For usage with the older style GCP Ruby SDKs from the google-apis-* gems.

Parameters:

  • token (String) —

    The access token to use.

  • quota_project_id (String) (defaults to: nil) —

    The project ID used for quota and billing. This project may be different from the project used to create the credentials.

  • universe_domain (String) (defaults to: 'googleapis.com') —

    The universe domain of the credential, reported to gRPC google-cloud clients so they don't raise Gapic::UniverseDomainMismatch. Defaults to googleapis.com.

Returns:



304
305
306
 
# File 'lib/google/auth/extras.rb', line 304

def static_authorization(token, quota_project_id: nil, universe_domain: 'googleapis.com')
  StaticCredential.new(access_token: token, quota_project_id: quota_project_id, universe_domain: universe_domain)
end

#static_credential(token, quota_project_id: nil, universe_domain: 'googleapis.com') ⇒ Google::Auth::Credential<Google::Auth::Extras::StaticCredential>

A credential using a static access token. For usage with the newer style GCP Ruby SDKs from the google-cloud-* gems.

Parameters:

  • token (String) —

    The access token to use.

  • quota_project_id (String) (defaults to: nil) —

    The project ID used for quota and billing. This project may be different from the project used to create the credentials.

  • universe_domain (String) (defaults to: 'googleapis.com') —

    The universe domain of the credential, reported to gRPC google-cloud clients so they don't raise Gapic::UniverseDomainMismatch. Defaults to googleapis.com.

Returns:



324
325
326
327
328
 
# File 'lib/google/auth/extras.rb', line 324

def static_credential(token, quota_project_id: nil, universe_domain: 'googleapis.com')
  wrap_authorization(
    static_authorization(token, quota_project_id: quota_project_id, universe_domain: universe_domain),
  )
end

#wrap_authorization(client) ⇒ Google::Auth::Credential

Take an authorization and turn it into a credential, primarily used for setting up both the old and new style SDKs.

Parameters:

  • client (Signet::OAuth2::Client) —

    Authorization credential to wrap. The universe domain reported to gRPC google-cloud clients (so they don't raise Gapic::UniverseDomainMismatch) is taken from the client as-is; set it on the client before wrapping if needed.

Returns:

  • (Google::Auth::Credential) 


340
341
342
 
# File 'lib/google/auth/extras.rb', line 340

def wrap_authorization(client)
  ::Google::Auth::Credentials.new(client)
end