Supporting impersonated service count (builds on #76) #77
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This PR supports parsing both formats in either the `GOOGLE_APPLICATION_CREDENTIALS` env variable or the `~/.config/gcloud/application_default_credentials.json` file.
msdrigg
commented
Aug 18, 2023
| // account specified by `service_account_impersonation_url`. | ||
| // refresh logic https://github.com/golang/oauth2/blob/a835fc4358f6852f50c4c5c33fddcd1adade5b0a/google/internal/externalaccount/impersonate.go#L57 | ||
| #[derive(Deserialize, Debug)] | ||
| pub(crate) struct ImpersonatedServiceAccountCredentials { |
There was a problem hiding this comment.
The only weirdness about this PR is that I put the deserialization for ImpersonatedServiceAccount inside the flexible_credential_source file. I did this because in theory the source credentials could be anything (the referenced go sdk source didn't discriminate between what the source credentials were).
If there is a cleaner approach to this, please let me know.
msdrigg
force-pushed
the
flexible-patch-part-2
branch
from
fc39dac
to
9dbde43
Compare
This PR adds a new `ServiceAccount` format that takes credentials from `source_credentials: ServiceAccount` and then makes a request to get a service account token using those credentials. This also adds the ability to parse the token format created by `gcloud auth application-default login --impersonate-service-account <service account>`
msdrigg
force-pushed
the
flexible-patch-part-2
branch
from
9dbde43
to
baa65d3
Compare
msdrigg
changed the title
|
Tested this PR with real world keys
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds service account impersonation. It uses a generic
Box<dyn ServiceAccount>to get the source token and then uses that token to refresh the impersonated account from theservice_account_impersonation_url.