com.google.auth.oauth2.ImpersonatedCredentials Java Examples

@Test
public void testServiceAccountWithoutTokenCreatorRoleOnSelfFails() throws GeneralSecurityException {
  Assume.assumeNotNull(credentials);
  final String serviceAccount = "[email protected]";
  final ImpersonatedCredentials serviceAccountCredentials = ImpersonatedCredentials.newBuilder()
      .setScopes(ImmutableList.of("https://www.googleapis.com/auth/cloud-platform"))
      .setSourceCredentials(credentials)
      .setTargetPrincipal(serviceAccount)
      .setLifetime(300)
      .setDelegates(ImmutableList.of())
      .build();
  final GoogleIdTokenAuth idTokenAuth = GoogleIdTokenAuth.of(serviceAccountCredentials);
  try {
    idTokenAuth.getToken("http://styx.foo.bar");
    fail();
  } catch (IOException e) {
    assertThat(e.getMessage(), is("Unable to sign request for id token, "
                                  + "missing Service Account Token Creator role for self on "
                                  + serviceAccount + " or IAM api not enabled?"));
  }
}
 

@Before
public void setUp() throws Exception {
  var defaultCredentials = GoogleCredentials.getApplicationDefault();

  var serviceCredentials = ImpersonatedCredentials.create(
      defaultCredentials, SERVICE_ACCOUNT,
      List.of(), List.of("https://www.googleapis.com/auth/cloud-platform"), 300);

  try {
    serviceCredentials.refreshAccessToken();
  } catch (IOException e) {
    // Do not run this test if we do not have permission to impersonate the test user.
    Assume.assumeNoException(e);
  }

  iam = new Iam.Builder(
      Utils.getDefaultTransport(), Utils.getDefaultJsonFactory(),
      new HttpCredentialsAdapter(serviceCredentials.createScoped(IamScopes.all())))
      .setApplicationName("styx-test")
      .build();
}
 

@Override
public AccessToken getAccessToken(String googleIdentity, List<String> scopes) {
    if (! googleIdentity.endsWith(".iam.gserviceaccount.com")) {
        throw new IllegalArgumentException("Google identity `" + googleIdentity + "` is not a service account");
    }
    try {
        GoogleCredentials credentials = GoogleCredentials.getApplicationDefault();
        ImpersonatedCredentials impersonatedCredentials = ImpersonatedCredentials.create(credentials, googleIdentity, null, scopes, 3600);
        com.google.auth.oauth2.AccessToken token = impersonatedCredentials.refreshAccessToken();
        return new AccessToken(token.getTokenValue(), token.getExpirationTime().getTime());
    } catch (IOException e) {
        throw Status.PERMISSION_DENIED.asRuntimeException();
    }
}
 

private String getToken(String targetAudience, GoogleCredentials credentials)
    throws IOException, GeneralSecurityException {
  if (credentials instanceof ServiceAccountCredentials) {
    return getServiceAccountToken((ServiceAccountCredentials) credentials, targetAudience);
  } else if (credentials instanceof UserCredentials) {
    return getUserToken((UserCredentials) credentials);
  } else if (credentials instanceof ComputeEngineCredentials) {
    return getDefaultGCEIdToken(targetAudience);
  } else if (credentials instanceof ImpersonatedCredentials) {
    return getImpersonatedIdToken((ImpersonatedCredentials) credentials, targetAudience);
  } else {
    // Assume a type of service account credential
    return getServiceAccountIdTokenUsingAccessToken(credentials, targetAudience);
  }
}
 

@Test
public void testImpersonatedCredentials() throws IOException, GeneralSecurityException {
  Assume.assumeNotNull(credentials);
  final ImpersonatedCredentials impersonatedCredentials = ImpersonatedCredentials.newBuilder()
      .setScopes(ImmutableList.of("https://www.googleapis.com/auth/cloud-platform"))
      .setSourceCredentials(credentials)
      .setTargetPrincipal("[email protected]")
      .setLifetime(300)
      .setDelegates(ImmutableList.of())
      .build();
  assertThat(canAcquireIdToken(impersonatedCredentials), is(true));
}
 

static String serviceAccountEmail(GoogleCredentials credentials) {
  if (credentials instanceof ImpersonatedCredentials) {
    return ((ImpersonatedCredentials) credentials).toBuilder().getTargetPrincipal();
  } else if (credentials instanceof ServiceAccountSigner) {
    return ((ServiceAccountSigner) credentials).getAccount();
  } else {
    throw new IllegalArgumentException("Credential is not a service account");
  }
}
 

private String getImpersonatedIdToken(ImpersonatedCredentials credentials, String targetAudience) throws IOException {
  final String serviceAccount = credentials.toBuilder().getTargetPrincipal();
  return getServiceAccountIdTokenUsingAccessToken(credentials, serviceAccount, targetAudience);
}
 

@Test
public void serviceAccountEmailImpersonatedCredentials() {
  var credentials = ImpersonatedCredentials.create(
      sourceCredentials, SERVICE_ACCOUNT, List.of(), List.of(), 300);
  assertThat(ServiceAccounts.serviceAccountEmail(credentials), is(SERVICE_ACCOUNT));
}