Class: Google::Auth::Extras::ServiceAccountJWTCredential

Inherits:
Signet::OAuth2::Client
  • Object
show all
Includes:
IdentityCredentialRefreshPatch
Defined in:
lib/google/auth/extras/service_account_jwt_credential.rb

Overview

This credential issues JWTs signed a service account.

Instance Method Summary collapse

Methods included from IdentityCredentialRefreshPatch

#update_token!

Constructor Details

#initialize(email_address:, target_audience:, base_credentials: nil, delegate_email_addresses: nil, issuer: nil, lifetime: 3600, subject: nil) ⇒ ServiceAccountJWTCredential

A credential that obtains a signed JWT from Google for a service account.

See Also:



40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
 
# File 'lib/google/auth/extras/service_account_jwt_credential.rb', line 40

def initialize(
  email_address:,
  target_audience:,
  base_credentials: nil,
  delegate_email_addresses: nil,
  issuer: nil,
  lifetime: 3600,
  subject: nil
)
  super(client_id: target_audience, target_audience: target_audience)

  @iam_credentials_service = Google::Apis::IamcredentialsV1::IAMCredentialsService.new.tap do |ics|
    ics.authorization = base_credentials if base_credentials
  end

  @jwt_issuer = issuer || email_address
  @jwt_lifetime = lifetime
  @jwt_subject = subject || email_address

  @sa_delegates = Array(delegate_email_addresses).map do |email|
    transform_email_to_name(email)
  end

  @sa_name = transform_email_to_name(email_address)
end

Instance Method Details

#fetch_access_token ⇒ Object 



66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
 
# File 'lib/google/auth/extras/service_account_jwt_credential.rb', line 66

def fetch_access_token(*)
  now = Time.now.to_i

  request = Google::Apis::IamcredentialsV1::SignJwtRequest.new(
    payload: JSON.dump(
      aud: target_audience,
      exp: now + @jwt_lifetime,
      iat: now,
      iss: @jwt_issuer,
      sub: @jwt_subject,
    ),
  )

  # The Google SDK doesn't like nil repeated values, but be careful with others as well.
  request.delegates = @sa_delegates unless @sa_delegates.empty?

  response = @iam_credentials_service.(@sa_name, request)

  {
    id_token: response.signed_jwt,
  }
end

#inspect ⇒ Object 



89
90
91
92
93
94
95
96
97
98
99
100
 
# File 'lib/google/auth/extras/service_account_jwt_credential.rb', line 89

def inspect
  "#<#{self.class.name}" \
    " @expires_at=#{expires_at.inspect}" \
    " @id_token=#{@id_token ? '[REDACTED]' : 'nil'}" \
    " @jwt_issuer=#{@jwt_issuer.inspect}" \
    " @jwt_lifetime=#{@jwt_lifetime.inspect}" \
    " @jwt_subject=#{@jwt_subject.inspect}" \
    " @sa_delegates=#{@sa_delegates.inspect}" \
    " @sa_name=#{@sa_name.inspect}" \
    " @target_audience=#{@target_audience.inspect}" \
    '>'
end