Class: Google::Auth::Extras::ServiceAccountJWTCredential

Inherits:
Signet::OAuth2::Client
  • Object
show all
Defined in:
lib/google/auth/extras/service_account_jwt_credential.rb

Overview

This credential issues JWTs signed a service account.

Instance Method Summary collapse

Constructor Details

#initialize(email_address:, target_audience:, base_credentials: nil, delegate_email_addresses: nil, issuer: nil, lifetime: 3600, subject: nil, universe_domain: 'googleapis.com') ⇒ ServiceAccountJWTCredential

A credential that obtains a signed JWT from Google for a service account.

Parameters:

  • base_credentials (Hash, String, Signet::OAuth2::Client) (defaults to: nil) —

    Credentials to use to sign the JWTs.

  • delegate_email_addresses (String, Array<String>) (defaults to: nil) —

    The email addresses (if any) of intermediate service accounts to reach the email_address from base_credentials.

  • email_address (String) —

    Email of the service account to sign the JWT.

  • issuer (String) (defaults to: nil) —

    The desired value of the iss field on the issued JWT. Defaults to the email_address.

  • lifetime (Integers) (defaults to: 3600) —

    The desired lifetime (in seconds) of the JWT before needing to be refreshed. Defaults to 3600 (1h), adjust as needed given a refresh is automatically performed when the token less than 60s of remaining life and refresh requires an additional API call.

  • subject (String) (defaults to: nil) —

    The desired value of the sub field on the issued JWT. Defaults to the email_address.

  • target_audience (String) —

    The audience for the token, such as the API or account that this token grants access to.

  • universe_domain (String) (defaults to: 'googleapis.com') —

    The universe domain of the credential, reported to gRPC google-cloud clients so they don't raise Gapic::UniverseDomainMismatch. Defaults to googleapis.com.

See Also:



42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
 
# File 'lib/google/auth/extras/service_account_jwt_credential.rb', line 42

def initialize(
  email_address:,
  target_audience:,
  base_credentials: nil,
  delegate_email_addresses: nil,
  issuer: nil,
  lifetime: 3600,
  subject: nil,
  universe_domain: 'googleapis.com'
)
  super(
    client_id: target_audience,
    target_audience: target_audience,
    universe_domain: base_credentials&.universe_domain || universe_domain,
  )

  @iam_credentials_service = Google::Apis::IamcredentialsV1::IAMCredentialsService.new.tap do |ics|
    ics.authorization = base_credentials if base_credentials
  end

  @jwt_issuer = issuer || email_address
  @jwt_lifetime = lifetime
  @jwt_subject = subject || email_address

  @sa_delegates = Array(delegate_email_addresses).map do |email|
    transform_email_to_name(email)
  end

  @sa_name = transform_email_to_name(email_address)
end

Instance Method Details

#fetch_access_token ⇒ Object 



73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
 
# File 'lib/google/auth/extras/service_account_jwt_credential.rb', line 73

def fetch_access_token(*)
  now = Time.now.to_i

  request = Google::Apis::IamcredentialsV1::SignJwtRequest.new(
    payload: JSON.dump(
      aud: target_audience,
      exp: now + @jwt_lifetime,
      iat: now,
      iss: @jwt_issuer,
      sub: @jwt_subject,
    ),
  )

  # The Google SDK doesn't like nil repeated values, but be careful with others as well.
  request.delegates = @sa_delegates unless @sa_delegates.empty?

  response = @iam_credentials_service.(@sa_name, request)

  {
    id_token: response.signed_jwt,
  }
end

#inspect ⇒ Object 



96
97
98
99
100
101
102
103
104
105
106
107
 
# File 'lib/google/auth/extras/service_account_jwt_credential.rb', line 96

def inspect
  "#<#{self.class.name}" \
    " @expires_at=#{expires_at.inspect}" \
    " @id_token=#{@id_token ? '[REDACTED]' : 'nil'}" \
    " @jwt_issuer=#{@jwt_issuer.inspect}" \
    " @jwt_lifetime=#{@jwt_lifetime.inspect}" \
    " @jwt_subject=#{@jwt_subject.inspect}" \
    " @sa_delegates=#{@sa_delegates.inspect}" \
    " @sa_name=#{@sa_name.inspect}" \
    " @target_audience=#{@target_audience.inspect}" \
    '>'
end