Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

no support for google.auth.default #179

Open
fatestapestry opened this issue May 28, 2022 · 6 comments
Open

no support for google.auth.default #179

fatestapestry opened this issue May 28, 2022 · 6 comments

Comments

@fatestapestry
Copy link

fatestapestry commented May 28, 2022

To support CI workflows building off gh actions, I'd like to use the recommended auth method using google.auth.default with google-github-actions/[email protected] - https://github.com/google-github-actions/auth.

This would (hopefully) allow the following, using the more modern google.auth lib:

    gauth = GoogleAuth()
    try:
        gauth.credentials = ServiceAccountCredentials.from_json_keyfile_name(LOCAL_KEY, SCOPES)  # support local dev
    except FileNotFoundError:
        credentials, _ = google.auth.default(SCOPES)  # prod
        gauth.credentials = credentials

This is defined here:
https://google-auth.readthedocs.io/en/master/user-guide.html

Unfortunately forcing auth with a local service account key file is a poor security implementation, and not really acceptable for cloud CI.

@fatestapestry
Copy link
Author

@junpeng-jp will test after merge

@fatestapestry
Copy link
Author

Fixing this should also support:

from google.oauth2.service_account import Credentials

credentials = Credentials.from_service_account_file(key_file, scopes)

@fatestapestry
Copy link
Author

A working alternative until this is implemented is to use this after reading key from env:

oauth2client.service_account.ServiceAccountCredentials.from_json_keyfile_dict()

@junpeng-jp
Copy link

junpeng-jp commented May 30, 2022

hey @jonathanelscpt, the GoogleAuth in this library supports file-based service auth through:

  1. specifying the service credential file name in the yaml config under service_config > client_json_file_path or specifying the GOOGLE_APPLICATION_CREDENTIALS environment variable and setting service_config > use_default = True
  2. instantiate GoogleAuth
  3. run the ServiceAuth method which would:
    • reads the service credential json path
    • use the from_service_account_file class method (see here) to create the service account credentials

@junpeng-jp
Copy link

junpeng-jp commented May 30, 2022

At least, this is how it would be after my pull request above has been merged. Because the entire library's google auth is driven by the .yaml config file, I've kept to the same design whilst I was working to migrate from oauth2client -> google-auth

@shcheklein
Copy link
Member

For the record, current implementation supports reading from a dict, from ENV, etc. I'm not sure about the default credentials. It depends on the underlying implementation for them.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants