Authentication without using service account key for Datastore not working on GCE

[richardkazuomiller]

I have a VM on Google Compute Engine that I'm trying to use to access Datastore but the server rejects the requests. I'm able to fiddle with the datastore on the control panel, so this should be working from the VM but I get ApiError: Unauthorized when trying to access it with gcloud-node. I'm guessing it would work if I used the key file but this issue probably needs fixing.

ApiError: Unauthorized
    at new util.ApiError (/srv/<my-app>/node_modules/gcloud/lib/common/util.js:92:10)
    at Object.parseHttpRespMessage (/srv/<my-app>/node_modules/gcloud/lib/common/util.js:134:33)
    at Request._callback (/srv/<my-app>/node_modules/gcloud/lib/datastore/request.js:813:31)
    at Request.self.callback (/srv/<my-app>/node_modules/request/request.js:198:22)
    at emitTwo (events.js:87:13)
    at Request.emit (events.js:172:7)
    at Request.<anonymous> (/srv/<my-app>/node_modules/request/request.js:1035:10)
    at emitOne (events.js:82:20)
    at Request.emit (events.js:169:7)
    at IncomingMessage.<anonymous> (/srv/<my-app>/node_modules/request/request.js:962:12)

[richardkazuomiller]

Update: This definitely works with the service account key file, but the automagical option is broken for me.

[stephenplusplus]

Thanks for reporting. @jgeewax @jonparrott should an automagical token work with Datastore requests?

[jgeewax]

Hey @richardkazuomiller , when you created the GCE machine, did you give it access to Datastore? In the UI you have to (I think) explicitly say "this instance can talk to Datastore auto-magically".

[jgeewax]

(@stephenplusplus: If this is the issue, we should add this to the docs on gcloud-common)

[theacodes]

@stephenplusplus to clarify, yes, the token from the metadata server should work for accessing everything. Provided, of course, that the instance was created with access to the appropriate scopes.

@richardkazuomiller can you tell us the scopes on your machine? You can do gcloud compute instances describe instance-name and it'll be under the serviceAccounts key.

[richardkazuomiller]

The output is

serviceAccounts:
- email: <my-service-account-id>@developer.gserviceaccount.com
  scopes:
  - https://www.googleapis.com/auth/cloud-platform

Is my understanding that https://www.googleapis.com/auth/cloud-platform should mean the machine has full access to all Cloud APIs including datastore correct?

[dhermes]

I seem to recall the email scope is needed as well (I don't have the full URI ATM, sorry)

[richardkazuomiller]

Shouldn't the cloud-platform scope also allow access to that? I created the VM from the control panel with the Allow API access to all Google Cloud services in the same project box checked so if that's not the case I feel like that box should add that scope (´・ω・｀)

[theacodes]

cloud-platform does not include email, some APIs need this scope for the time being.

It's also possible that cloud-platform != devstorage.full_control, so if adding email fails, try explicitly including devstorage.full_control.

[richardkazuomiller]

Hmm, OK I'll try that but if that's the case I feel like checking the Allow API access to all Google Cloud services in the same project box should add the email scope. Since it's not directly related to this library, maybe this isn't the place to discuss that. If that's disabled for a security reason, then maybe put the scopes you need in the gcloud-node documentation.

[theacodes]

For datastore, it's very temporary. The next version of the API will not
require it.

On Mon, Dec 14, 2015 at 12:28 PM Ricky Miller [email protected]
wrote:

Hmm, OK I'll try that but if that's the case I feel like checking the Allow
API access to all Google Cloud services in the same project box should
add the email scope. Since it's not directly related to this library,
maybe this isn't the place to discuss that. If that's disabled for a
security reason, then maybe put the scopes you need in the gcloud-node
documentation.

—
Reply to this email directly or view it on GitHub
#1020 (comment)
.

[stephenplusplus]

@richardkazuomiller did this do the trick?

[richardkazuomiller]

@stephenplusplus Yes, I tried adding the permissions and was able to query Datastore without the key, but since I've already set up my production environment I think I'll be using the service key authentication method for now.

[stephenplusplus]

That makes sense. The docs try to provide some guidance while setting up an instance (https://googlecloudplatform.github.io/gcloud-node/#/authentication), but it's not very helpful if you already have one. I'll close this out, but if you think we can do something better, let us know.