Class: Google::Auth::ServiceAccountCredentials
- Inherits:
-
Signet::OAuth2::Client
- Object
- Signet::OAuth2::Client
- Google::Auth::ServiceAccountCredentials
- Extended by:
- CredentialsLoader, JsonKeyReader
- Defined in:
- lib/googleauth/service_account.rb
Overview
Authenticates requests using Google’s Service Account credentials via an OAuth access token.
This class allows authorizing requests for service accounts directly from credentials from a json key file downloaded from the developer console (via ‘Generate new Json Key’).
cf [Application Default Credentials](cloud.google.com/docs/authentication/production)
Constant Summary collapse
- TOKEN_CRED_URI =
"https://www.googleapis.com/oauth2/v4/token".freeze
Constants included from CredentialsLoader
CredentialsLoader::ACCOUNT_TYPE_VAR, CredentialsLoader::CLIENT_EMAIL_VAR, CredentialsLoader::CLIENT_ID_VAR, CredentialsLoader::CLIENT_SECRET_VAR, CredentialsLoader::CLOUD_SDK_CLIENT_ID, CredentialsLoader::CLOUD_SDK_CREDENTIALS_WARNING, CredentialsLoader::CREDENTIALS_FILE_NAME, CredentialsLoader::ENV_VAR, CredentialsLoader::GCLOUD_CONFIG_COMMAND, CredentialsLoader::GCLOUD_POSIX_COMMAND, CredentialsLoader::GCLOUD_WINDOWS_COMMAND, CredentialsLoader::NOT_FOUND_ERROR, CredentialsLoader::PRIVATE_KEY_VAR, CredentialsLoader::PROJECT_ID_VAR, CredentialsLoader::REFRESH_TOKEN_VAR, CredentialsLoader::SYSTEM_DEFAULT_ERROR, CredentialsLoader::WELL_KNOWN_ERROR, CredentialsLoader::WELL_KNOWN_PATH
Instance Attribute Summary collapse
-
#project_id ⇒ Object
readonly
Returns the value of attribute project_id.
-
#quota_project_id ⇒ Object
readonly
Returns the value of attribute quota_project_id.
Class Method Summary collapse
-
.make_creds(options = {}) ⇒ Object
Creates a ServiceAccountCredentials.
-
.unescape(str) ⇒ Object
Handles certain escape sequences that sometimes appear in input.
Instance Method Summary collapse
-
#apply!(a_hash, opts = {}) ⇒ Object
Extends the base class.
-
#initialize(options = {}) ⇒ ServiceAccountCredentials
constructor
A new instance of ServiceAccountCredentials.
Methods included from CredentialsLoader
from_env, from_system_default_path, from_well_known_path, load_gcloud_project_id, make_creds, warn_if_cloud_sdk_credentials
Methods included from JsonKeyReader
Methods inherited from Signet::OAuth2::Client
#apply, #build_default_connection, #configure_connection, #fetch_access_token!, #notify_refresh_listeners, #on_refresh, #orig_fetch_access_token!, #retry_with_error, #updater_proc
Constructor Details
#initialize(options = {}) ⇒ ServiceAccountCredentials
Returns a new instance of ServiceAccountCredentials.
94 95 96 97 98 |
# File 'lib/googleauth/service_account.rb', line 94 def initialize = {} @project_id = [:project_id] @quota_project_id = [:quota_project_id] super end |
Instance Attribute Details
#project_id ⇒ Object (readonly)
Returns the value of attribute project_id.
53 54 55 |
# File 'lib/googleauth/service_account.rb', line 53 def project_id @project_id end |
#quota_project_id ⇒ Object (readonly)
Returns the value of attribute quota_project_id.
54 55 56 |
# File 'lib/googleauth/service_account.rb', line 54 def quota_project_id @quota_project_id end |
Class Method Details
.make_creds(options = {}) ⇒ Object
Creates a ServiceAccountCredentials.
60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 |
# File 'lib/googleauth/service_account.rb', line 60 def self.make_creds = {} json_key_io, scope, target_audience = .values_at :json_key_io, :scope, :target_audience raise ArgumentError, "Cannot specify both scope and target_audience" if scope && target_audience if json_key_io private_key, client_email, project_id, quota_project_id = read_json_key json_key_io else private_key = unescape ENV[CredentialsLoader::PRIVATE_KEY_VAR] client_email = ENV[CredentialsLoader::CLIENT_EMAIL_VAR] project_id = ENV[CredentialsLoader::PROJECT_ID_VAR] quota_project_id = nil end project_id ||= CredentialsLoader.load_gcloud_project_id new(token_credential_uri: TOKEN_CRED_URI, audience: TOKEN_CRED_URI, scope: scope, target_audience: target_audience, issuer: client_email, signing_key: OpenSSL::PKey::RSA.new(private_key), project_id: project_id, quota_project_id: quota_project_id) .configure_connection() end |
.unescape(str) ⇒ Object
Handles certain escape sequences that sometimes appear in input. Specifically, interprets the “n” sequence for newline, and removes enclosing quotes.
88 89 90 91 92 |
# File 'lib/googleauth/service_account.rb', line 88 def self.unescape str str = str.gsub '\n', "\n" str = str[1..-2] if str.start_with?('"') && str.end_with?('"') str end |
Instance Method Details
#apply!(a_hash, opts = {}) ⇒ Object
Extends the base class.
If scope(s) is not set, it creates a transient ServiceAccountJwtHeaderCredentials instance and uses that to authenticate instead.
105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 |
# File 'lib/googleauth/service_account.rb', line 105 def apply! a_hash, opts = {} # Use the base implementation if scopes are set unless scope.nil? super return end # Use the ServiceAccountJwtHeaderCredentials using the same cred values # if no scopes are set. cred_json = { private_key: @signing_key.to_s, client_email: @issuer } alt_clz = ServiceAccountJwtHeaderCredentials key_io = StringIO.new MultiJson.dump(cred_json) alt = alt_clz.make_creds json_key_io: key_io alt.apply! a_hash end |