feat: add impersonated credential support #1838

arithmetic1728 · 2021-04-19T23:21:38Z

This PR adds impersonated credential support. ImpersonatedCredentials allowing credentials issued to a user or service account to impersonate another service account.The cloud reference is: https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials#sa-credentials-oauth. (Googlers see go/dotnet-auth-impersonated-creds for the design doc.)

The following shows how to create an impersonated credential.

# Start with a GoogleCredential which wraps either user credential or service account credential
var sourceCredential = GoogleCredential.FromFile("service_account_json_path");

# Create an impersonated credential which allows the source credential to impersonate the targetPrincipal service account.
var credential = sourceCredential.Impersonate(targetPrincipal, delegates, scopes, lifetimeInSeconds);

Then you can use it to get access token and id token the same way as you do for other types of GoogleCredential.

To sign bytes.

var signedBytes = await (credential.UnderlyingCredential as ImpersonatedCredential).SignBytes(bytesToSign);

jskeet

First pass - these are mostly nits for formatting etc... I'd need another pass to really check the impersonation-specific logic.

Src/Support/Google.Apis.Auth.Tests/OAuth2/GoogleCredentialTests.cs

Src/Support/Google.Apis.Auth.Tests/OAuth2/ImpersonatedCredentialTests.cs

Src/Support/Google.Apis.Auth/OAuth2/ImpersonatedCredential.cs

Src/Support/Google.Apis.Auth/OAuth2/Responses/TokenResponse.cs

jskeet · 2021-04-20T08:46:49Z

I've suggested that @amanda-tarafa holds off on reviewing this until you've had a chance to work through this first round of review comments, btw. I'm not perturbed by there being a lot of comments - that's normally the way for new contributors to any code base, so please don't consider it any sort of personal judgement :)

amanda-tarafa · 2021-04-20T10:31:35Z

Can you please, as part of this PR, move #1312 out of the backlog. And then just reopen it and assign it to you. Thanks!

arithmetic1728 · 2021-04-23T01:06:40Z

Can you please, as part of this PR, move #1312 out of the backlog. And then just reopen it and assign it to you. Thanks!

@amanda-tarafa I moved #1840 out of backlog in this PR. Please reopen it and assign to me since I don't have write permission to do so. Thanks!

arithmetic1728 · 2021-04-23T01:09:46Z

@jskeet Thank you for all the comments and suggestions! They are super helpful! :) PTAL.

jskeet

A few more comments... I haven't validated all the changes, but Amanda will have another look anyway before we're done.

Src/Support/Google.Apis.Auth.Tests/OAuth2/ImpersonatedCredentialTests.cs

Src/Support/Google.Apis.Auth/OAuth2/ImpersonatedCredential.cs

Src/Support/Google.Apis.Auth/OAuth2/Responses/TokenResponse.cs

Src/Support/Google.Apis.Auth/OAuth2/ImpersonatedCredential.cs

Src/Support/Google.Apis.Auth/OAuth2/GoogleAuthConsts.cs

jskeet

A couple of nits left, but I think we're nearly there. Amanda may well find things I missed though :)

Src/Support/Google.Apis.Auth.Tests/OAuth2/ImpersonatedCredentialTests.cs

amanda-tarafa

I've left some specific comments but I'd also like to explore the possibility of adding an IBlogSigner interface, that can be implemented by ImpersonatedCredential and ServiceAccountCredential and GoogleCredential. GoogleCredential checks first for the underlying credential being an IBlobSigner, else it fails (similiar to OIdc). In that way:
a) The user doesn't have to cast the underlying credential to ImpersonatedCredential which is always a bad user experience.
b) We make more discoverable the capability of ServiceAccountCredential for signing.
c) We don't have to make ImpersonatedCredential public.

Src/Support/Google.Apis.Auth/OAuth2/ImpersonatedCredential.cs

Src/Support/Google.Apis.Auth/OAuth2/GoogleCredential.cs

Src/Support/Google.Apis.Auth/OAuth2/Responses/TokenResponse.cs

Src/Support/Google.Apis.Auth/OAuth2/ImpersonatedCredential.cs

Src/Support/Google.Apis.Auth/OAuth2/GoogleCredential.cs

Src/Support/Google.Apis.Auth.Tests/OAuth2/GoogleCredentialTests.cs

arithmetic1728 · 2021-04-29T00:20:00Z

@amanda-tarafa PTAL, thanks!

amanda-tarafa

Most comments are just nits. Thanks!

Src/Support/Google.Apis.Auth/OAuth2/ImpersonationOptions.cs

amanda-tarafa · 2021-05-05T11:59:28Z

Src/Support/Google.Apis.Auth/OAuth2/ImpersonatedCredential.cs

+            var body = NewtonsoftJsonSerializer.Instance.Serialize(bodyJson);
+            var content = new StringContent(body, Encoding.UTF8, "application/json");
+
+            var response = await HttpClient.PostAsync(TokenServerUrl, content, taskCancellationToken).ConfigureAwait(false);
+            var newToken = await TokenResponse.FromHttpResponseAsync(response, Clock, Logger).ConfigureAwait(false);


See TokenRequestExtensions. I think you can add similar extension methods there for ImpersonationAccessTokenRequest, and reuse ParameterUtils as well so you don't need to do any of this here.
Same for the other requests.

I am not sure if this is necessary. This basically means moving these methods to TokenRequestExtensions class. ParameterUtils won't be used because it url encodes the body instead of using json format.

Src/Support/Google.Apis.Auth/OAuth2/ImpersonatedCredential.cs

amanda-tarafa · 2021-05-05T12:45:24Z

Src/Support/Google.Apis.Auth/OAuth2/ImpersonatedCredential.cs

+                Audience = oidcTokenOptions.TargetAudience,
+                IncludeEmail = true
+            };
+            var body = NewtonsoftJsonSerializer.Instance.Serialize(bodyJson);


See my comment above for adding extension methods.

same as above

Src/Support/Google.Apis.Auth/OAuth2/GoogleCredential.cs

Co-authored-by: Amanda Tarafa Mas <14878252+amanda-tarafa@users.noreply.github.com>

amanda-tarafa

LGTM. Just a few more nits.

@jskeet check my suggestion for the summary of ImpersonatedCredential.

I will address the setting of the bearer token on the HttpClient in a separate PR, since I have to refactor those bits anyway as part of #1851

amanda-tarafa · 2021-05-11T14:28:40Z

Src/Support/Google.Apis.Auth/OAuth2/ImpersonatedCredential.cs

+namespace Google.Apis.Auth.OAuth2
+{
+    /// <summary>
+    /// ImpersonatedCredentials allowing credentials issued to a user or service account to impersonate 


This class is internal now, so the description is slightly less important. I'm leaving a suggestions with what I think could acceptable, @jskeet what do you think?

Src/Support/Google.Apis.Auth/OAuth2/IBlobSigner.cs

Src/Support/Google.Apis.Auth/OAuth2/ImpersonatedCredential.cs

Src/Support/Google.Apis.Auth/OAuth2/ImpersonationOptions.cs

Co-authored-by: Amanda Tarafa Mas <14878252+amanda-tarafa@users.noreply.github.com>

amanda-tarafa · 2021-05-11T17:00:01Z

I'll merge now. We can do a release once I'm done with #1851. I'll try to have that done this week.

arithmetic1728 · 2021-05-11T17:01:00Z

@amanda-tarafa Thank you!

Features * googleapis#1832 Helper for loading Client Secrets directly from file. * googleapis#1838 and googleapis#1874 Support for credential impersonation. * googleapis#1851 Make it easier to configure a credential's HTTP client, in particular it's now easier to set a proxy to be used for token fetching. Fixes * googleapis#1874 ServiceAccountCredential should copy scopes from initializer. Dependencies * googleapis#1842 System.Net.Http to 4.3.4 * googleapis#1873 Add target for .NET 4.6.1

Features * #1832 Helper for loading Client Secrets directly from file. * #1838 and #1874 Support for credential impersonation. * #1851 Make it easier to configure a credential's HTTP client, in particular it's now easier to set a proxy to be used for token fetching. Fixes * #1874 ServiceAccountCredential should copy scopes from initializer. Dependencies * #1842 System.Net.Http to 4.3.4 * #1873 Add target for .NET 4.6.1

feat: add impersonated credential support

b55649d

google-cla bot added the cla: yes This human has signed the Contributor License Agreement. label Apr 19, 2021

arithmetic1728 marked this pull request as ready for review April 19, 2021 23:42

jskeet reviewed Apr 20, 2021

View reviewed changes

arithmetic1728 and others added 2 commits April 22, 2021 17:22

chore: address comments

b17ed19

Merge branch 'master' into impersonated

11e18e4

jskeet reviewed Apr 23, 2021

View reviewed changes

chore: address comments

230f161

jskeet reviewed Apr 27, 2021

View reviewed changes

Src/Support/Google.Apis.Auth.Tests/OAuth2/ImpersonatedCredentialTests.cs Outdated Show resolved Hide resolved

Src/Support/Google.Apis.Auth.Tests/OAuth2/ImpersonatedCredentialTests.cs Show resolved Hide resolved

amanda-tarafa mentioned this pull request Apr 27, 2021

Implement Google.Apis.Auth.OAuth2.ImpersonatedCredentials #1312

Closed

amanda-tarafa requested changes Apr 27, 2021

View reviewed changes

amanda-tarafa mentioned this pull request Apr 27, 2021

Generating an id_token from a UserCredential #1803

Closed

amanda-tarafa requested changes Apr 28, 2021

View reviewed changes

Src/Support/Google.Apis.Auth.Tests/OAuth2/GoogleCredentialTests.cs Outdated Show resolved Hide resolved

chore: resolve comments

c8910ed

amanda-tarafa requested changes May 5, 2021

View reviewed changes

arithmetic1728 and others added 10 commits May 6, 2021 15:46

Update Src/Support/Google.Apis.Auth/OAuth2/ImpersonationOptions.cs

b9e57f2

Co-authored-by: Amanda Tarafa Mas <14878252+amanda-tarafa@users.noreply.github.com>

Update Src/Support/Google.Apis.Auth/OAuth2/ImpersonationOptions.cs

0c8c69f

Co-authored-by: Amanda Tarafa Mas <14878252+amanda-tarafa@users.noreply.github.com>

Update Src/Support/Google.Apis.Auth/OAuth2/ImpersonationOptions.cs

95b5115

Co-authored-by: Amanda Tarafa Mas <14878252+amanda-tarafa@users.noreply.github.com>

Update Src/Support/Google.Apis.Auth/OAuth2/ImpersonationOptions.cs

d0f6be2

Co-authored-by: Amanda Tarafa Mas <14878252+amanda-tarafa@users.noreply.github.com>

Update Src/Support/Google.Apis.Auth/OAuth2/ImpersonationOptions.cs

5f4e941

Co-authored-by: Amanda Tarafa Mas <14878252+amanda-tarafa@users.noreply.github.com>

Update Src/Support/Google.Apis.Auth/OAuth2/ImpersonationOptions.cs

bd6d066

Co-authored-by: Amanda Tarafa Mas <14878252+amanda-tarafa@users.noreply.github.com>

Update Src/Support/Google.Apis.Auth/OAuth2/ImpersonationOptions.cs

d7d40f1

Co-authored-by: Amanda Tarafa Mas <14878252+amanda-tarafa@users.noreply.github.com>

Update Src/Support/Google.Apis.Auth/OAuth2/ImpersonationOptions.cs

6c5c2a5

Co-authored-by: Amanda Tarafa Mas <14878252+amanda-tarafa@users.noreply.github.com>

Update Src/Support/Google.Apis.Auth/OAuth2/Responses/TokenResponse.cs

6ee25e3

Co-authored-by: Amanda Tarafa Mas <14878252+amanda-tarafa@users.noreply.github.com>

Update Src/Support/Google.Apis.Auth/OAuth2/GoogleCredential.cs

f696a94

Co-authored-by: Amanda Tarafa Mas <14878252+amanda-tarafa@users.noreply.github.com>

arithmetic1728 and others added 3 commits May 6, 2021 16:44

Update Src/Support/Google.Apis.Auth/OAuth2/GoogleCredential.cs

2df2ede

Co-authored-by: Amanda Tarafa Mas <14878252+amanda-tarafa@users.noreply.github.com>

update

2debf61

remove lifetime validation

5e59925

amanda-tarafa approved these changes May 11, 2021

View reviewed changes

arithmetic1728 and others added 7 commits May 11, 2021 09:40

Update Src/Support/Google.Apis.Auth/OAuth2/ImpersonatedCredential.cs

b255483

Co-authored-by: Amanda Tarafa Mas <14878252+amanda-tarafa@users.noreply.github.com>

Update Src/Support/Google.Apis.Auth/OAuth2/ImpersonatedCredential.cs

5299cb2

Co-authored-by: Amanda Tarafa Mas <14878252+amanda-tarafa@users.noreply.github.com>

Update Src/Support/Google.Apis.Auth/OAuth2/ImpersonatedCredential.cs

113e738

Co-authored-by: Amanda Tarafa Mas <14878252+amanda-tarafa@users.noreply.github.com>

Update Src/Support/Google.Apis.Auth/OAuth2/IBlobSigner.cs

ab18e01

Co-authored-by: Amanda Tarafa Mas <14878252+amanda-tarafa@users.noreply.github.com>

Update Src/Support/Google.Apis.Auth/OAuth2/ImpersonatedCredential.cs

3b702a2

Co-authored-by: Amanda Tarafa Mas <14878252+amanda-tarafa@users.noreply.github.com>

Update Src/Support/Google.Apis.Auth/OAuth2/ImpersonationOptions.cs

3a10106

Co-authored-by: Amanda Tarafa Mas <14878252+amanda-tarafa@users.noreply.github.com>

update ImpersonationOptions.cs

a860459

amanda-tarafa merged commit 6b29aa0 into googleapis:master May 11, 2021

amanda-tarafa mentioned this pull request Jun 15, 2021

Update version: 1.51.0 -> 1.52.0 #1875

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add impersonated credential support #1838

feat: add impersonated credential support #1838

arithmetic1728 commented Apr 19, 2021 •

edited

Loading

jskeet left a comment

jskeet commented Apr 20, 2021

amanda-tarafa commented Apr 20, 2021

arithmetic1728 commented Apr 23, 2021

arithmetic1728 commented Apr 23, 2021

jskeet left a comment

jskeet left a comment

amanda-tarafa left a comment

arithmetic1728 commented Apr 29, 2021

amanda-tarafa left a comment

amanda-tarafa May 5, 2021

arithmetic1728 May 7, 2021

amanda-tarafa May 5, 2021

arithmetic1728 May 7, 2021

amanda-tarafa left a comment

amanda-tarafa May 11, 2021

amanda-tarafa commented May 11, 2021

arithmetic1728 commented May 11, 2021

feat: add impersonated credential support #1838

feat: add impersonated credential support #1838

Conversation

arithmetic1728 commented Apr 19, 2021 • edited Loading

jskeet left a comment

Choose a reason for hiding this comment

jskeet commented Apr 20, 2021

amanda-tarafa commented Apr 20, 2021

arithmetic1728 commented Apr 23, 2021

arithmetic1728 commented Apr 23, 2021

jskeet left a comment

Choose a reason for hiding this comment

jskeet left a comment

Choose a reason for hiding this comment

amanda-tarafa left a comment

Choose a reason for hiding this comment

arithmetic1728 commented Apr 29, 2021

amanda-tarafa left a comment

Choose a reason for hiding this comment

amanda-tarafa May 5, 2021

Choose a reason for hiding this comment

arithmetic1728 May 7, 2021

Choose a reason for hiding this comment

amanda-tarafa May 5, 2021

Choose a reason for hiding this comment

arithmetic1728 May 7, 2021

Choose a reason for hiding this comment

amanda-tarafa left a comment

Choose a reason for hiding this comment

amanda-tarafa May 11, 2021

Choose a reason for hiding this comment

amanda-tarafa commented May 11, 2021

arithmetic1728 commented May 11, 2021

arithmetic1728 commented Apr 19, 2021 •

edited

Loading