class Google::Iam::Credentials::V1::IAMCredentials::Client

Client for the IAMCredentials service.

A service account is a special type of Google account that belongs to your application or a virtual machine (VM), instead of to an individual end user. Your application assumes the identity of the service account to call Google APIs, so that the users aren't directly involved.

Service account credentials are used to temporarily assume the identity of the service account. Supported credential types include OAuth 2.0 access tokens, OpenID Connect ID tokens, self-signed JSON Web Tokens (JWTs), and more.

Attributes

iam_credentials_stub[R]

@private

Public Class Methods

configure() { |configure| ... } click to toggle source

Configure the IAMCredentials Client class.

See {::Google::Iam::Credentials::V1::IAMCredentials::Client::Configuration} for a description of the configuration fields.

@example

# Modify the configuration for all IAMCredentials clients
::Google::Iam::Credentials::V1::IAMCredentials::Client.configure do |config|
  config.timeout = 10.0
end

@yield [config] Configure the Client client. @yieldparam config [Client::Configuration]

@return [Client::Configuration]

# File lib/google/iam/credentials/v1/iam_credentials/client.rb, line 64
def self.configure
  @configure ||= begin
    namespace = ["Google", "Iam", "Credentials", "V1"]
    parent_config = while namespace.any?
                      parent_name = namespace.join "::"
                      parent_const = const_get parent_name
                      break parent_const.configure if parent_const.respond_to? :configure
                      namespace.pop
                    end
    default_config = Client::Configuration.new parent_config

    default_config.rpcs.generate_access_token.timeout = 60.0
    default_config.rpcs.generate_access_token.retry_policy = {
      initial_delay: 0.1, max_delay: 60.0, multiplier: 1.3, retry_codes: [14, 4]
    }

    default_config.rpcs.generate_id_token.timeout = 60.0
    default_config.rpcs.generate_id_token.retry_policy = {
      initial_delay: 0.1, max_delay: 60.0, multiplier: 1.3, retry_codes: [14, 4]
    }

    default_config.rpcs.sign_blob.timeout = 60.0
    default_config.rpcs.sign_blob.retry_policy = {
      initial_delay: 0.1, max_delay: 60.0, multiplier: 1.3, retry_codes: [14, 4]
    }

    default_config.rpcs.sign_jwt.timeout = 60.0
    default_config.rpcs.sign_jwt.retry_policy = {
      initial_delay: 0.1, max_delay: 60.0, multiplier: 1.3, retry_codes: [14, 4]
    }

    default_config
  end
  yield @configure if block_given?
  @configure
end
new() { |config| ... } click to toggle source

Create a new IAMCredentials client object.

@example

# Create a client using the default configuration
client = ::Google::Iam::Credentials::V1::IAMCredentials::Client.new

# Create a client using a custom configuration
client = ::Google::Iam::Credentials::V1::IAMCredentials::Client.new do |config|
  config.timeout = 10.0
end

@yield [config] Configure the IAMCredentials client. @yieldparam config [Client::Configuration]

# File lib/google/iam/credentials/v1/iam_credentials/client.rb, line 137
def initialize
  # These require statements are intentionally placed here to initialize
  # the gRPC module only when it's required.
  # See https://github.com/googleapis/toolkit/issues/446
  require "gapic/grpc"
  require "google/iam/credentials/v1/iamcredentials_services_pb"

  # Create the configuration object
  @config = Configuration.new Client.configure

  # Yield the configuration if needed
  yield @config if block_given?

  # Create credentials
  credentials = @config.credentials
  # Use self-signed JWT if the endpoint is unchanged from default,
  # but only if the default endpoint does not have a region prefix.
  enable_self_signed_jwt = @config.endpoint == Client.configure.endpoint &&
                           !@config.endpoint.split(".").first.include?("-")
  credentials ||= Credentials.default scope: @config.scope,
                                      enable_self_signed_jwt: enable_self_signed_jwt
  if credentials.is_a?(::String) || credentials.is_a?(::Hash)
    credentials = Credentials.new credentials, scope: @config.scope
  end
  @quota_project_id = @config.quota_project
  @quota_project_id ||= credentials.quota_project_id if credentials.respond_to? :quota_project_id

  @iam_credentials_stub = ::Gapic::ServiceStub.new(
    ::Google::Iam::Credentials::V1::IAMCredentials::Stub,
    credentials:  credentials,
    endpoint:     @config.endpoint,
    channel_args: @config.channel_args,
    interceptors: @config.interceptors
  )
end

Public Instance Methods

configure() { |config| ... } click to toggle source

Configure the IAMCredentials Client instance.

The configuration is set to the derived mode, meaning that values can be changed, but structural changes (adding new fields, etc.) are not allowed. Structural changes should be made on {Client.configure}.

See {::Google::Iam::Credentials::V1::IAMCredentials::Client::Configuration} for a description of the configuration fields.

@yield [config] Configure the Client client. @yieldparam config [Client::Configuration]

@return [Client::Configuration]

# File lib/google/iam/credentials/v1/iam_credentials/client.rb, line 116
def configure
  yield @config if block_given?
  @config
end
generate_access_token(request, options = nil) { |response, operation| ... } click to toggle source

Generates an OAuth 2.0 access token for a service account.

@overload generate_access_token(request, options = nil)

Pass arguments to `generate_access_token` via a request object, either of type
{::Google::Iam::Credentials::V1::GenerateAccessTokenRequest} or an equivalent Hash.

@param request [::Google::Iam::Credentials::V1::GenerateAccessTokenRequest, ::Hash]
  A request object representing the call parameters. Required. To specify no
  parameters, or to keep all the default parameter values, pass an empty Hash.
@param options [::Gapic::CallOptions, ::Hash]
  Overrides the default settings for this call, e.g, timeout, retries, etc. Optional.

@overload generate_access_token(name: nil, delegates: nil, scope: nil, lifetime: nil)

Pass arguments to `generate_access_token` via keyword arguments. Note that at
least one keyword argument is required. To specify no parameters, or to keep all
the default parameter values, pass an empty Hash as a request object (see above).

@param name [::String]
  Required. The resource name of the service account for which the credentials
  are requested, in the following format:
  `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard
  character is required; replacing it with a project ID is invalid.
@param delegates [::Array<::String>]
  The sequence of service accounts in a delegation chain. Each service
  account must be granted the `roles/iam.serviceAccountTokenCreator` role
  on its next service account in the chain. The last service account in the
  chain must be granted the `roles/iam.serviceAccountTokenCreator` role
  on the service account that is specified in the `name` field of the
  request.

  The delegates must have the following format:
  `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard
  character is required; replacing it with a project ID is invalid.
@param scope [::Array<::String>]
  Required. Code to identify the scopes to be included in the OAuth 2.0 access token.
  See https://developers.google.com/identity/protocols/googlescopes for more
  information.
  At least one value required.
@param lifetime [::Google::Protobuf::Duration, ::Hash]
  The desired lifetime duration of the access token in seconds.
  Must be set to a value less than or equal to 3600 (1 hour). If a value is
  not specified, the token's lifetime will be set to a default value of one
  hour.

@yield [response, operation] Access the result along with the RPC operation @yieldparam response [::Google::Iam::Credentials::V1::GenerateAccessTokenResponse] @yieldparam operation [::GRPC::ActiveCall::Operation]

@return [::Google::Iam::Credentials::V1::GenerateAccessTokenResponse]

@raise [::Google::Cloud::Error] if the RPC is aborted.

# File lib/google/iam/credentials/v1/iam_credentials/client.rb, line 228
def generate_access_token request, options = nil
  raise ::ArgumentError, "request must be provided" if request.nil?

  request = ::Gapic::Protobuf.coerce request, to: ::Google::Iam::Credentials::V1::GenerateAccessTokenRequest

  # Converts hash and nil to an options object
  options = ::Gapic::CallOptions.new(**options.to_h) if options.respond_to? :to_h

  # Customize the options with defaults
  metadata = @config.rpcs.generate_access_token.metadata.to_h

  # Set x-goog-api-client and x-goog-user-project headers
  metadata[:"x-goog-api-client"] ||= ::Gapic::Headers.x_goog_api_client \
    lib_name: @config.lib_name, lib_version: @config.lib_version,
    gapic_version: ::Google::Iam::Credentials::V1::VERSION
  metadata[:"x-goog-user-project"] = @quota_project_id if @quota_project_id

  header_params = {
    "name" => request.name
  }
  request_params_header = header_params.map { |k, v| "#{k}=#{v}" }.join("&")
  metadata[:"x-goog-request-params"] ||= request_params_header

  options.apply_defaults timeout:      @config.rpcs.generate_access_token.timeout,
                         metadata:     metadata,
                         retry_policy: @config.rpcs.generate_access_token.retry_policy

  options.apply_defaults timeout:      @config.timeout,
                         metadata:     @config.metadata,
                         retry_policy: @config.retry_policy

  @iam_credentials_stub.call_rpc :generate_access_token, request, options: options do |response, operation|
    yield response, operation if block_given?
    return response
  end
rescue ::GRPC::BadStatus => e
  raise ::Google::Cloud::Error.from_error(e)
end
generate_id_token(request, options = nil) { |response, operation| ... } click to toggle source

Generates an OpenID Connect ID token for a service account.

@overload generate_id_token(request, options = nil)

Pass arguments to `generate_id_token` via a request object, either of type
{::Google::Iam::Credentials::V1::GenerateIdTokenRequest} or an equivalent Hash.

@param request [::Google::Iam::Credentials::V1::GenerateIdTokenRequest, ::Hash]
  A request object representing the call parameters. Required. To specify no
  parameters, or to keep all the default parameter values, pass an empty Hash.
@param options [::Gapic::CallOptions, ::Hash]
  Overrides the default settings for this call, e.g, timeout, retries, etc. Optional.

@overload generate_id_token(name: nil, delegates: nil, audience: nil, include_email: nil)

Pass arguments to `generate_id_token` via keyword arguments. Note that at
least one keyword argument is required. To specify no parameters, or to keep all
the default parameter values, pass an empty Hash as a request object (see above).

@param name [::String]
  Required. The resource name of the service account for which the credentials
  are requested, in the following format:
  `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard
  character is required; replacing it with a project ID is invalid.
@param delegates [::Array<::String>]
  The sequence of service accounts in a delegation chain. Each service
  account must be granted the `roles/iam.serviceAccountTokenCreator` role
  on its next service account in the chain. The last service account in the
  chain must be granted the `roles/iam.serviceAccountTokenCreator` role
  on the service account that is specified in the `name` field of the
  request.

  The delegates must have the following format:
  `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard
  character is required; replacing it with a project ID is invalid.
@param audience [::String]
  Required. The audience for the token, such as the API or account that this token
  grants access to.
@param include_email [::Boolean]
  Include the service account email in the token. If set to `true`, the
  token will contain `email` and `email_verified` claims.

@yield [response, operation] Access the result along with the RPC operation @yieldparam response [::Google::Iam::Credentials::V1::GenerateIdTokenResponse] @yieldparam operation [::GRPC::ActiveCall::Operation]

@return [::Google::Iam::Credentials::V1::GenerateIdTokenResponse]

@raise [::Google::Cloud::Error] if the RPC is aborted.

# File lib/google/iam/credentials/v1/iam_credentials/client.rb, line 316
def generate_id_token request, options = nil
  raise ::ArgumentError, "request must be provided" if request.nil?

  request = ::Gapic::Protobuf.coerce request, to: ::Google::Iam::Credentials::V1::GenerateIdTokenRequest

  # Converts hash and nil to an options object
  options = ::Gapic::CallOptions.new(**options.to_h) if options.respond_to? :to_h

  # Customize the options with defaults
  metadata = @config.rpcs.generate_id_token.metadata.to_h

  # Set x-goog-api-client and x-goog-user-project headers
  metadata[:"x-goog-api-client"] ||= ::Gapic::Headers.x_goog_api_client \
    lib_name: @config.lib_name, lib_version: @config.lib_version,
    gapic_version: ::Google::Iam::Credentials::V1::VERSION
  metadata[:"x-goog-user-project"] = @quota_project_id if @quota_project_id

  header_params = {
    "name" => request.name
  }
  request_params_header = header_params.map { |k, v| "#{k}=#{v}" }.join("&")
  metadata[:"x-goog-request-params"] ||= request_params_header

  options.apply_defaults timeout:      @config.rpcs.generate_id_token.timeout,
                         metadata:     metadata,
                         retry_policy: @config.rpcs.generate_id_token.retry_policy

  options.apply_defaults timeout:      @config.timeout,
                         metadata:     @config.metadata,
                         retry_policy: @config.retry_policy

  @iam_credentials_stub.call_rpc :generate_id_token, request, options: options do |response, operation|
    yield response, operation if block_given?
    return response
  end
rescue ::GRPC::BadStatus => e
  raise ::Google::Cloud::Error.from_error(e)
end
sign_blob(request, options = nil) { |response, operation| ... } click to toggle source

Signs a blob using a service account's system-managed private key.

@overload sign_blob(request, options = nil)

Pass arguments to `sign_blob` via a request object, either of type
{::Google::Iam::Credentials::V1::SignBlobRequest} or an equivalent Hash.

@param request [::Google::Iam::Credentials::V1::SignBlobRequest, ::Hash]
  A request object representing the call parameters. Required. To specify no
  parameters, or to keep all the default parameter values, pass an empty Hash.
@param options [::Gapic::CallOptions, ::Hash]
  Overrides the default settings for this call, e.g, timeout, retries, etc. Optional.

@overload sign_blob(name: nil, delegates: nil, payload: nil)

Pass arguments to `sign_blob` via keyword arguments. Note that at
least one keyword argument is required. To specify no parameters, or to keep all
the default parameter values, pass an empty Hash as a request object (see above).

@param name [::String]
  Required. The resource name of the service account for which the credentials
  are requested, in the following format:
  `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard
  character is required; replacing it with a project ID is invalid.
@param delegates [::Array<::String>]
  The sequence of service accounts in a delegation chain. Each service
  account must be granted the `roles/iam.serviceAccountTokenCreator` role
  on its next service account in the chain. The last service account in the
  chain must be granted the `roles/iam.serviceAccountTokenCreator` role
  on the service account that is specified in the `name` field of the
  request.

  The delegates must have the following format:
  `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard
  character is required; replacing it with a project ID is invalid.
@param payload [::String]
  Required. The bytes to sign.

@yield [response, operation] Access the result along with the RPC operation @yieldparam response [::Google::Iam::Credentials::V1::SignBlobResponse] @yieldparam operation [::GRPC::ActiveCall::Operation]

@return [::Google::Iam::Credentials::V1::SignBlobResponse]

@raise [::Google::Cloud::Error] if the RPC is aborted.

# File lib/google/iam/credentials/v1/iam_credentials/client.rb, line 400
def sign_blob request, options = nil
  raise ::ArgumentError, "request must be provided" if request.nil?

  request = ::Gapic::Protobuf.coerce request, to: ::Google::Iam::Credentials::V1::SignBlobRequest

  # Converts hash and nil to an options object
  options = ::Gapic::CallOptions.new(**options.to_h) if options.respond_to? :to_h

  # Customize the options with defaults
  metadata = @config.rpcs.sign_blob.metadata.to_h

  # Set x-goog-api-client and x-goog-user-project headers
  metadata[:"x-goog-api-client"] ||= ::Gapic::Headers.x_goog_api_client \
    lib_name: @config.lib_name, lib_version: @config.lib_version,
    gapic_version: ::Google::Iam::Credentials::V1::VERSION
  metadata[:"x-goog-user-project"] = @quota_project_id if @quota_project_id

  header_params = {
    "name" => request.name
  }
  request_params_header = header_params.map { |k, v| "#{k}=#{v}" }.join("&")
  metadata[:"x-goog-request-params"] ||= request_params_header

  options.apply_defaults timeout:      @config.rpcs.sign_blob.timeout,
                         metadata:     metadata,
                         retry_policy: @config.rpcs.sign_blob.retry_policy

  options.apply_defaults timeout:      @config.timeout,
                         metadata:     @config.metadata,
                         retry_policy: @config.retry_policy

  @iam_credentials_stub.call_rpc :sign_blob, request, options: options do |response, operation|
    yield response, operation if block_given?
    return response
  end
rescue ::GRPC::BadStatus => e
  raise ::Google::Cloud::Error.from_error(e)
end
sign_jwt(request, options = nil) { |response, operation| ... } click to toggle source

Signs a JWT using a service account's system-managed private key.

@overload sign_jwt(request, options = nil)

Pass arguments to `sign_jwt` via a request object, either of type
{::Google::Iam::Credentials::V1::SignJwtRequest} or an equivalent Hash.

@param request [::Google::Iam::Credentials::V1::SignJwtRequest, ::Hash]
  A request object representing the call parameters. Required. To specify no
  parameters, or to keep all the default parameter values, pass an empty Hash.
@param options [::Gapic::CallOptions, ::Hash]
  Overrides the default settings for this call, e.g, timeout, retries, etc. Optional.

@overload sign_jwt(name: nil, delegates: nil, payload: nil)

Pass arguments to `sign_jwt` via keyword arguments. Note that at
least one keyword argument is required. To specify no parameters, or to keep all
the default parameter values, pass an empty Hash as a request object (see above).

@param name [::String]
  Required. The resource name of the service account for which the credentials
  are requested, in the following format:
  `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard
  character is required; replacing it with a project ID is invalid.
@param delegates [::Array<::String>]
  The sequence of service accounts in a delegation chain. Each service
  account must be granted the `roles/iam.serviceAccountTokenCreator` role
  on its next service account in the chain. The last service account in the
  chain must be granted the `roles/iam.serviceAccountTokenCreator` role
  on the service account that is specified in the `name` field of the
  request.

  The delegates must have the following format:
  `projects/-/serviceAccounts/{ACCOUNT_EMAIL_OR_UNIQUEID}`. The `-` wildcard
  character is required; replacing it with a project ID is invalid.
@param payload [::String]
  Required. The JWT payload to sign: a JSON object that contains a JWT Claims Set.

@yield [response, operation] Access the result along with the RPC operation @yieldparam response [::Google::Iam::Credentials::V1::SignJwtResponse] @yieldparam operation [::GRPC::ActiveCall::Operation]

@return [::Google::Iam::Credentials::V1::SignJwtResponse]

@raise [::Google::Cloud::Error] if the RPC is aborted.

# File lib/google/iam/credentials/v1/iam_credentials/client.rb, line 484
def sign_jwt request, options = nil
  raise ::ArgumentError, "request must be provided" if request.nil?

  request = ::Gapic::Protobuf.coerce request, to: ::Google::Iam::Credentials::V1::SignJwtRequest

  # Converts hash and nil to an options object
  options = ::Gapic::CallOptions.new(**options.to_h) if options.respond_to? :to_h

  # Customize the options with defaults
  metadata = @config.rpcs.sign_jwt.metadata.to_h

  # Set x-goog-api-client and x-goog-user-project headers
  metadata[:"x-goog-api-client"] ||= ::Gapic::Headers.x_goog_api_client \
    lib_name: @config.lib_name, lib_version: @config.lib_version,
    gapic_version: ::Google::Iam::Credentials::V1::VERSION
  metadata[:"x-goog-user-project"] = @quota_project_id if @quota_project_id

  header_params = {
    "name" => request.name
  }
  request_params_header = header_params.map { |k, v| "#{k}=#{v}" }.join("&")
  metadata[:"x-goog-request-params"] ||= request_params_header

  options.apply_defaults timeout:      @config.rpcs.sign_jwt.timeout,
                         metadata:     metadata,
                         retry_policy: @config.rpcs.sign_jwt.retry_policy

  options.apply_defaults timeout:      @config.timeout,
                         metadata:     @config.metadata,
                         retry_policy: @config.retry_policy

  @iam_credentials_stub.call_rpc :sign_jwt, request, options: options do |response, operation|
    yield response, operation if block_given?
    return response
  end
rescue ::GRPC::BadStatus => e
  raise ::Google::Cloud::Error.from_error(e)
end