Skip to content
This repository has been archived by the owner on Oct 27, 2022. It is now read-only.

Improve use of identity tokens for authenticated HTTP requests with the client library #18

Open
grayside opened this issue Aug 10, 2020 · 2 comments

Comments

@grayside
Copy link

Current Behavior

gcloud auth print-identity-token is used to create an un-scoped token and passed around the code so requests can be made.

Desired Behavior

The new idtoken library provides an HTTP client that automatically handles identity token minting. Use that instead. This HTTP client can be passed a customized HTTP client, which is how timeouts for #16 would be supported.

An example of using the library in this way can be found in the Function-to-Function Request Sample.


This issue affects one category in my review of the repository:

  • Internals: Is the implementation efficient, effective, and maintainable?
@SaketramDurbha
Copy link
Contributor

SaketramDurbha commented Aug 10, 2020

@SaketramDurbha
Copy link
Contributor

I've been testing this draft implementation requires service account credentials provided with respect to the Application Default Credentials protocol.

Currently, we require gcloud to be authorized with either a service account or a user account. I believe that using the Go client library for this would require that the user have a service account and put those credentials in a location in accordance with ADC. And I think this would have to be on top of the separate authorization process for gcloud.

The reason that my draft implementation worked was that I was both authorized with gcloud using gcloud init with my user account and had downloaded separate service account credentials and put their location in the GOOGLE_APPLICATION_CREDENTIALS environment variable.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants