feat: service account is able to use a private token endpoint (#835) · googleapis/google-cloud-python@d37a8b5 · GitHub

googleapis / google-cloud-python Public

• Notifications You must be signed in to change notification settings
• Fork 1.8k
• Star 5.4k

• Code
• Issues 442
• Pull requests 97
• Discussions
• Actions
• Projects
• Security and quality
• Insights

Additional navigation options

Commit d37a8b5

Browse filesBrowse the repository at this point in the historyBrowse files

arithmetic1728

and

dandhlee

authored

feat: service account is able to use a private token endpoint (#835)

Co-authored-by: Dan Lee <71398022+dandhlee@users.noreply.github.com>

1 parent 34ce9ad commit d37a8b5
Copy full SHA for d37a8b5

3 files changed

+13-6Lines changed: 13 additions & 6 deletions

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

• packages/google-auth
  • google/oauth2
    • service_account.py
  • tests_async/oauth2
    • test_service_account_async.py
  • tests/oauth2
    • test_service_account.py

Expand file treeCollapse file tree

Open diff view settings

Collapse file

‎packages/google-auth/google/oauth2/service_account.py‎

Copy file name to clipboardExpand all lines: packages/google-auth/google/oauth2/service_account.py

+3-2Lines changed: 3 additions & 2 deletions

Original file line number	Diff line number	Diff line change
@@ -80,6 +80,7 @@
80	80	from google.oauth2 import _client
81	81
82	82	_DEFAULT_TOKEN_LIFETIME_SECS = 3600 # 1 hour in seconds
	83	+ _GOOGLE_OAUTH2_TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token"
83	84
84	85
85	86	class Credentials(
@@ -382,7 +383,7 @@ def _make_authorization_grant_assertion(self):
382	383	# The issuer must be the service account email.
383	384	"iss": self._service_account_email,
384	385	# The audience must be the auth token endpoint's URI
385		- "aud": self._token_uri,
	386	+ "aud": _GOOGLE_OAUTH2_TOKEN_ENDPOINT,
386	387	"scope": _helpers.scopes_to_string(self._scopes or ()),
387	388	}
388	389
@@ -643,7 +644,7 @@ def _make_authorization_grant_assertion(self):
643	644	# The issuer must be the service account email.
644	645	"iss": self.service_account_email,
645	646	# The audience must be the auth token endpoint's URI
646		- "aud": self._token_uri,
	647	+ "aud": _GOOGLE_OAUTH2_TOKEN_ENDPOINT,
647	648	# The target audience specifies which service the ID token is
648	649	# intended for.
649	650	"target_audience": self._target_audience,

Collapse file

‎packages/google-auth/tests/oauth2/test_service_account.py‎

Copy file name to clipboardExpand all lines: packages/google-auth/tests/oauth2/test_service_account.py

+2-2Lines changed: 2 additions & 2 deletions

Original file line number	Diff line number	Diff line change
@@ -167,7 +167,7 @@ def test__make_authorization_grant_assertion(self):
167	167	token = credentials._make_authorization_grant_assertion()
168	168	payload = jwt.decode(token, PUBLIC_CERT_BYTES)
169	169	assert payload["iss"] == self.SERVICE_ACCOUNT_EMAIL
170		- assert payload["aud"] == self.TOKEN_URI
	170	+ assert payload["aud"] == service_account._GOOGLE_OAUTH2_TOKEN_ENDPOINT
171	171
172	172	def test__make_authorization_grant_assertion_scoped(self):
173	173	credentials = self.make_credentials()
@@ -440,7 +440,7 @@ def test__make_authorization_grant_assertion(self):
440	440	token = credentials._make_authorization_grant_assertion()
441	441	payload = jwt.decode(token, PUBLIC_CERT_BYTES)
442	442	assert payload["iss"] == self.SERVICE_ACCOUNT_EMAIL
443		- assert payload["aud"] == self.TOKEN_URI
	443	+ assert payload["aud"] == service_account._GOOGLE_OAUTH2_TOKEN_ENDPOINT
444	444	assert payload["target_audience"] == self.TARGET_AUDIENCE
445	445
446	446	@mock.patch("google.oauth2._client.id_token_jwt_grant", autospec=True)

Collapse file

‎packages/google-auth/tests_async/oauth2/test_service_account_async.py‎

Copy file name to clipboardExpand all lines: packages/google-auth/tests_async/oauth2/test_service_account_async.py

+8-2Lines changed: 8 additions & 2 deletions

Original file line number	Diff line number	Diff line change
@@ -152,7 +152,10 @@ def test__make_authorization_grant_assertion(self):
152	152	token = credentials._make_authorization_grant_assertion()
153	153	payload = jwt.decode(token, test_service_account.PUBLIC_CERT_BYTES)
154	154	assert payload["iss"] == self.SERVICE_ACCOUNT_EMAIL
155		- assert payload["aud"] == self.TOKEN_URI
	155	+ assert (
	156	+ payload["aud"]
	157	+ == service_account.service_account._GOOGLE_OAUTH2_TOKEN_ENDPOINT
	158	+ )
156	159
157	160	def test__make_authorization_grant_assertion_scoped(self):
158	161	credentials = self.make_credentials()
@@ -311,7 +314,10 @@ def test__make_authorization_grant_assertion(self):
311	314	token = credentials._make_authorization_grant_assertion()
312	315	payload = jwt.decode(token, test_service_account.PUBLIC_CERT_BYTES)
313	316	assert payload["iss"] == self.SERVICE_ACCOUNT_EMAIL
314		- assert payload["aud"] == self.TOKEN_URI
	317	+ assert (
	318	+ payload["aud"]
	319	+ == service_account.service_account._GOOGLE_OAUTH2_TOKEN_ENDPOINT
	320	+ )
315	321	assert payload["target_audience"] == self.TARGET_AUDIENCE
316	322
317	323	@mock.patch("google.oauth2._client_async.id_token_jwt_grant", autospec=True)

0 commit comments

Comments

0 (0)