class Google::Auth::ServiceAccountCredentials
Authenticates requests using Google's Service Account credentials via an OAuth access token.
This class allows authorizing requests for service accounts directly from credentials from a json key file downloaded from the developer console (via 'Generate new Json Key').
cf [Application Default Credentials](cloud.google.com/docs/authentication/production)
Constants
- TOKEN_CRED_URI
Attributes
Public Class Methods
Creates a ServiceAccountCredentials
.
@param json_key_io [IO] an IO from which the JSON key can be read @param scope [string|array|nil] the scope(s) to access
# File lib/googleauth/service_account.rb, line 49 def self.make_creds options = {} json_key_io, scope, enable_self_signed_jwt, target_audience, audience, token_credential_uri = options.values_at :json_key_io, :scope, :enable_self_signed_jwt, :target_audience, :audience, :token_credential_uri raise ArgumentError, "Cannot specify both scope and target_audience" if scope && target_audience if json_key_io private_key, client_email, project_id, quota_project_id = read_json_key json_key_io else private_key = unescape ENV[CredentialsLoader::PRIVATE_KEY_VAR] client_email = ENV[CredentialsLoader::CLIENT_EMAIL_VAR] project_id = ENV[CredentialsLoader::PROJECT_ID_VAR] quota_project_id = nil end project_id ||= CredentialsLoader.load_gcloud_project_id new(token_credential_uri: token_credential_uri || TOKEN_CRED_URI, audience: audience || TOKEN_CRED_URI, scope: scope, enable_self_signed_jwt: enable_self_signed_jwt, target_audience: target_audience, issuer: client_email, signing_key: OpenSSL::PKey::RSA.new(private_key), project_id: project_id, quota_project_id: quota_project_id) .configure_connection(options) end
# File lib/googleauth/service_account.rb, line 86 def initialize options = {} @project_id = options[:project_id] @quota_project_id = options[:quota_project_id] @enable_self_signed_jwt = options[:enable_self_signed_jwt] ? true : false super options end
Handles certain escape sequences that sometimes appear in input. Specifically, interprets the ānā sequence for newline, and removes enclosing quotes.
# File lib/googleauth/service_account.rb, line 80 def self.unescape str str = str.gsub '\n', "\n" str = str[1..-2] if str.start_with?('"') && str.end_with?('"') str end
Public Instance Methods
Extends the base class to use a transient ServiceAccountJwtHeaderCredentials
for certain cases.
Signet::OAuth2::Client#apply!
# File lib/googleauth/service_account.rb, line 95 def apply! a_hash, opts = {} # Use a self-singed JWT if there's no information that can be used to # obtain an OAuth token, OR if there are scopes but also an assertion # that they are default scopes that shouldn't be used to fetch a token. if target_audience.nil? && (scope.nil? || enable_self_signed_jwt?) apply_self_signed_jwt! a_hash else super end end
# File lib/googleauth/service_account.rb, line 41 def enable_self_signed_jwt? @enable_self_signed_jwt end
Private Instance Methods
# File lib/googleauth/service_account.rb, line 108 def apply_self_signed_jwt! a_hash # Use the ServiceAccountJwtHeaderCredentials using the same cred values cred_json = { private_key: @signing_key.to_s, client_email: @issuer, project_id: @project_id, quota_project_id: @quota_project_id } key_io = StringIO.new MultiJson.dump(cred_json) alt = ServiceAccountJwtHeaderCredentials.make_creds json_key_io: key_io, scope: scope alt.apply! a_hash end