Add IAM signer #108
Add IAM signer #108
Conversation
|
FYI to @elibixby as well. |
| The IAM API signs bytes using Google-managed keys. Because of this | ||
| it's possible that the key used to sign bytes will change. In some | ||
| cases this change can occur between successive calls to :attr:`key_id` | ||
| and :meth:`sign`. This could result in a signature that was signed |
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
google/auth/iam.py
Outdated
|
|
||
| - https://www.googleapis.com/auth/iam | ||
| - https://www.googleapis.com/auth/cloud-platform | ||
| service_account_email (str): The service account email to use to |
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
google/auth/iam.py
Outdated
| - https://www.googleapis.com/auth/cloud-platform | ||
| service_account_email (str): The service account email to use to | ||
| sign bytes. Often, this can be the same as the service account | ||
| email in the given credentials. |
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
google/auth/iam.py
Outdated
| method = 'POST' | ||
| url = ( | ||
| 'https://iam.googleapis.com/v1/projects/-/serviceAccounts/{}' | ||
| ':signBlob?alt=json').format(self._service_account_email) |
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
google/auth/iam.py
Outdated
| ':signBlob?alt=json').format(self._service_account_email) | ||
| headers = {} | ||
| body = json.dumps({ | ||
| 'bytesToSign': base64.b64encode(message).decode('utf-8') |
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
google/auth/iam.py
Outdated
| response.data)) | ||
|
|
||
| data = json.loads(response.data.decode('utf-8')) | ||
| return data |
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
| .. note:: | ||
| This makes an API request to the IAM API. | ||
| """ | ||
| response = self._make_signing_request('') |
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
|
|
||
|
|
||
| def make_credentials(): | ||
| class CredentialsImpl(google.auth.credentials.Credentials): |
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
| return CredentialsImpl() | ||
|
|
||
|
|
||
| class TestSigner(object): |
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
tests/test_iam.py
Outdated
| assert returned_signature == signature | ||
|
|
||
| def test_sign_bytes_failure(self): | ||
| request = make_request(401) |
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
| response = self._request( | ||
| url=url, method=method, body=body, headers=headers) | ||
|
|
||
| if response.status != http_client.OK: |
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
|
Nope, just 200.
…On Wed, Feb 15, 2017, 4:03 PM Luke Sneeringer ***@***.***> wrote:
***@***.**** commented on this pull request.
------------------------------
In google/auth/iam.py
<#108 (comment)>
:
> + def _make_signing_request(self, message):
+ """Makes a request to the API signBlob API."""
+ message = _helpers.to_bytes(message)
+
+ method = 'POST'
+ url = _SIGN_BLOB_URI.format(self._service_account_email)
+ headers = {}
+ body = json.dumps({
+ 'bytesToSign': base64.b64encode(message).decode('utf-8'),
+ })
+
+ self._credentials.before_request(self._request, method, url, headers)
+ response = self._request(
+ url=url, method=method, body=body, headers=headers)
+
+ if response.status != http_client.OK:
Are there ever cases where this particular API would send back successes
that are not 200? (Say, 201 or 202?)
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
<#108 (review)>,
or mute the thread
<https://github.com/notifications/unsubscribe-auth/AAPUc-3fMDD2cZ4053w7zE7onq-BugWvks5rc5JHgaJpZM4MCOf8>
.
|
|
Is there any risk of that changing? Cards on table: I usually do If you are pretty sure that everything returned from the IAM API will always be 200 for a success case, though, then this is good to go. |
I feel like any change in that behavior should necessitate a change in our code. I also don't think they'll mess with it. |
/cc @matthewg