demo

packages/google-cloud-kms/.python-version

@@ -0,0 +1 @@
+auth

packages/google-cloud-kms/google/cloud/kms_v1/services/key_management_service/async_client.py

@@ -401,25 +401,29 @@ async def sample_list_key_rings():
         # Validate the universe domain.
         self._client._validate_universe_domain()
 
-        # Send the request.
-        response = await rpc(
-            request,
-            retry=retry,
-            timeout=timeout,
-            metadata=metadata,
-        )
+        try:
+            # Send the request.
+            response = await rpc(
+                request,
+                retry=retry,
+                timeout=timeout,
+                metadata=metadata,
+            )
 
-        # This method is paged; wrap the response in a pager, which provides
-        # an `__aiter__` convenience method.
-        response = pagers.ListKeyRingsAsyncPager(
-            method=rpc,
-            request=request,
-            response=response,
-            metadata=metadata,
-        )
+            # This method is paged; wrap the response in a pager, which provides
+            # an `__aiter__` convenience method.
+            response = pagers.ListKeyRingsAsyncPager(
+                method=rpc,
+                request=request,
+                response=response,
+                metadata=metadata,
+            )
 
-        # Done; return the response.
-        return response
+            # Done; return the response.
+            return response
+        except core_exceptions.GoogleAPICallError as e:
+            self._client._add_cred_info_for_auth_errors(e)
+            raise e
 
     async def list_crypto_keys(
         self,

packages/google-cloud-kms/google/cloud/kms_v1/services/key_management_service/client.py

@@ -14,6 +14,8 @@
 # limitations under the License.
 #
 from collections import OrderedDict
+from http import HTTPStatus
+import json
 import os
 import re
 from typing import (
@@ -628,6 +630,25 @@ def _validate_universe_domain(self):
         )
         return self._is_universe_domain_valid
 
+    def _add_cred_info_for_auth_errors(
+        self,
+        error: core_exceptions.GoogleAPICallError
+    ) -> None:
+        """Adds credential info string to error details for 401/403/404 errors.
+        Args:
+            error (google.api_core.exceptions.GoogleAPICallError): The error to add the cred info.
+        """
+        if error.code not in [HTTPStatus.UNAUTHORIZED, HTTPStatus.FORBIDDEN, HTTPStatus.NOT_FOUND]:
+            return
+
+        cred = self._transport._credentials
+        if not hasattr(cred, "get_cred_info"):
+            return
+
+        cred_info = cred.get_cred_info()  # type: ignore
+        if cred_info and hasattr(error._details, "append"):
+            error._details.append(json.dumps(cred_info))
+
     @property
     def api_endpoint(self):
         """Return the API endpoint used by the client instance.
@@ -885,25 +906,29 @@ def sample_list_key_rings():
         # Validate the universe domain.
         self._validate_universe_domain()
 
-        # Send the request.
-        response = rpc(
-            request,
-            retry=retry,
-            timeout=timeout,
-            metadata=metadata,
-        )
+        try:
+            # Send the request.
+            response = rpc(
+                request,
+                retry=retry,
+                timeout=timeout,
+                metadata=metadata,
+            )
 
-        # This method is paged; wrap the response in a pager, which provides
-        # an `__iter__` convenience method.
-        response = pagers.ListKeyRingsPager(
-            method=rpc,
-            request=request,
-            response=response,
-            metadata=metadata,
-        )
+            # This method is paged; wrap the response in a pager, which provides
+            # an `__iter__` convenience method.
+            response = pagers.ListKeyRingsPager(
+                method=rpc,
+                request=request,
+                response=response,
+                metadata=metadata,
+            )
 
-        # Done; return the response.
-        return response
+            # Done; return the response.
+            return response
+        except core_exceptions.GoogleAPICallError as e:
+            self._add_cred_info_for_auth_errors(e)
+            raise e
 
     def list_crypto_keys(
         self,

packages/google-cloud-kms/my_sample.py

@@ -0,0 +1,24 @@
+from google.cloud import kms_v1
+import google.auth
+import google.auth.transport.requests
+
+project = "sijun-auth"
+#project = "sijunliu-nondca-test"
+
+cred, _ = google.auth.default(scopes=["https://www.googleapis.com/auth/cloud-platform"])
+cred._always_use_jwt_access = True
+cred._create_self_signed_jwt(None)
+req = google.auth.transport.requests.Request()
+cred.refresh(req)
+
+client = kms_v1.KeyManagementServiceClient(credentials=cred)
+parent = f"projects/{project}/locations/global"
+
+try:
+    res = client.list_key_rings(request={"parent": parent})
+    print(res)
+except Exception as e:
+    print("=== e.message ===")
+    print(e.message)
+    print("=== e.details ====")
+    print(e.details)