fix: detect correct auth when ADC env var is set but empty (#1374) · googleapis/google-auth-library-python@bfc07e1 · GitHub

This repository was archived by the owner on Mar 6, 2026. It is now read-only.

googleapis / google-auth-library-python Public archive

• Notifications You must be signed in to change notification settings
• Fork 351
• Star 882

• Code
• Issues
• Pull requests
• Actions
• Security and quality
• Insights

Additional navigation options

Commit bfc07e1

Browse filesBrowse the repository at this point in the historyBrowse files

mbrancato

authored

fix: detect correct auth when ADC env var is set but empty (#1374)

Treat empty strings as if the env var was not set. This fixes an issue where an environment variable for `GOOGLE_APPLICATION_CREDENTIALS` is set, but it empty. Because the default sentinel is `None`, the auth library attempts to load this file. Some systems can set or update an env var, but not unset an env var (e.g. Docker). Fixes: https://togithub.com/googleapis/python-pubsub/issues/983

1 parent 383c982 commit bfc07e1
Copy full SHA for bfc07e1

1 file changed

+6-6Lines changed: 6 additions & 6 deletions

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

• google/auth
  • _default.py

Expand file treeCollapse file tree

Open diff view settings

Collapse file

‎google/auth/_default.py‎

Copy file name to clipboardExpand all lines: google/auth/_default.py

+6-6Lines changed: 6 additions & 6 deletions

Original file line number	Diff line number	Diff line change
@@ -330,31 +330,31 @@ def _get_explicit_environ_credentials(quota_project_id=None):
330	330	from google.auth import _cloud_sdk
331	331
332	332	cloud_sdk_adc_path = _cloud_sdk.get_application_default_credentials_path()
333		- explicit_file = os.environ.get(environment_vars.CREDENTIALS)
	333	+ explicit_file = os.environ.get(environment_vars.CREDENTIALS, "")
334	334
335	335	_LOGGER.debug(
336		- "Checking %s for explicit credentials as part of auth process...", explicit_file
	336	+ "Checking '%s' for explicit credentials as part of auth process...",
	337	+ explicit_file,
337	338	)
338	339
339		- if explicit_file is not None and explicit_file == cloud_sdk_adc_path:
	340	+ if explicit_file != "" and explicit_file == cloud_sdk_adc_path:
340	341	# Cloud sdk flow calls gcloud to fetch project id, so if the explicit
341	342	# file path is cloud sdk credentials path, then we should fall back
342	343	# to cloud sdk flow, otherwise project id cannot be obtained.
343	344	_LOGGER.debug(
344		- "Explicit credentials path %s is the same as Cloud SDK credentials path, fall back to Cloud SDK credentials flow...",
	345	+ "Explicit credentials path '%s' is the same as Cloud SDK credentials path, fall back to Cloud SDK credentials flow...",
345	346	explicit_file,
346	347	)
347	348	return _get_gcloud_sdk_credentials(quota_project_id=quota_project_id)
348	349
349		- if explicit_file is not None:
	350	+ if explicit_file != "":
350	351	with warnings.catch_warnings():
351	352	warnings.simplefilter("ignore", DeprecationWarning)
352	353	credentials, project_id = load_credentials_from_file(
353	354	os.environ[environment_vars.CREDENTIALS],
354	355	quota_project_id=quota_project_id,
355	356	)
356	357	credentials._cred_file_path = f"{explicit_file} file via the GOOGLE_APPLICATION_CREDENTIALS environment variable"
357		-
358	358	return credentials, project_id
359	359
360	360	else:

0 commit comments

Comments

0 (0)