Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: style nits #528

Merged
merged 2 commits into from
Dec 17, 2020
Merged

fix: style nits #528

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9ea0b42
fix style nits
Dec 17, 2020
92cb8bb
format
Dec 17, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
78 changes: 37 additions & 41 deletions oauth2_http/java/com/google/auth/oauth2/ImpersonatedCredentials.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,11 +61,11 @@

/**
* ImpersonatedCredentials allowing credentials issued to a user or service account to impersonate
* another. <br>
* The source project using ImpersonatedCredentials must enable the "IAMCredentials" API.<br>
* Also, the target service account must grant the orginating principal the "Service Account Token
* Creator" IAM role. <br>
* Usage:<br>
* another.
* The source project using ImpersonatedCredentials must enable the "IAMCredentials" API.
* Also, the target service account must grant the originating principal the "Service Account Token
* Creator" IAM role.<p>
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
* another.
* The source project using ImpersonatedCredentials must enable the "IAMCredentials" API.
* Also, the target service account must grant the originating principal the "Service Account Token
* Creator" IAM role.<p>
* another. The source project using ImpersonatedCredentials must enable the "IAMCredentials" API.
* Creator" IAM role.
*
* <p>Usage:

* Usage:
*
* <pre>
* String credPath = "/path/to/svc_account.json";
Expand Down Expand Up @@ -96,10 +96,6 @@ public class ImpersonatedCredentials extends GoogleCredentials
private static final String IAM_ACCESS_TOKEN_ENDPOINT =
"https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/%s:generateAccessToken";

private static final String SCOPE_EMPTY_ERROR = "Scopes cannot be null";
private static final String LIFETIME_EXCEEDED_ERROR =
"lifetime must be less than or equal to 43200";

private GoogleCredentials sourceCredentials;
private String targetPrincipal;
private List<String> delegates;
Expand All @@ -110,23 +106,23 @@ public class ImpersonatedCredentials extends GoogleCredentials
private transient HttpTransportFactory transportFactory;

/**
* @param sourceCredentials The source credential used as to acquire the impersonated credentials
* @param targetPrincipal The service account to impersonate.
* @param delegates The chained list of delegates required to grant the final access_token. If
* @param sourceCredentials the source credential used as to acquire the impersonated credentials
* @param targetPrincipal the service account to impersonate
* @param delegates the chained list of delegates required to grant the final access_token. If
* set, the sequence of identities must have "Service Account Token Creator" capability
* granted to the preceding identity. For example, if set to [serviceAccountB,
* serviceAccountC], the sourceCredential must have the Token Creator role on serviceAccountB.
* serviceAccountB must have the Token Creator on serviceAccountC. Finally, C must have Token
* Creator on target_principal. If left unset, sourceCredential must have that role on
* Creator on target_principal. If unset, sourceCredential must have that role on
* targetPrincipal.
* @param scopes Scopes to request during the authorization grant.
* @param lifetime Number of seconds the delegated credential should be valid for. By default this
* value should be at most 3600. However, you can follow the instructions described in the
* following link to set up the service account, and extend the maximum lifetime to 43200 (12
* hours).
* https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials#sa-credentials-oauth
* @param transportFactory HTTP transport factory, creates the transport used to get access
* tokens.
* @param scopes scopes to request during the authorization grant
* @param lifetime number of seconds the delegated credential should be valid. By default this
* value should be at most 3600. However, you can follow
* <a href='https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials#sa-credentials-oauth'>these
* instructions</a> to set up the service account and extend the maximum lifetime
* to 43200 (12 hours).
* @param transportFactory HTTP transport factory that creates the transport used to get access
* tokens
* @return new credentials
*/
public static ImpersonatedCredentials create(
Expand All @@ -147,20 +143,21 @@ public static ImpersonatedCredentials create(
}

/**
* @param sourceCredentials The source credential used as to acquire the impersonated credentials
* @param targetPrincipal The service account to impersonate.
* @param delegates The chained list of delegates required to grant the final access_token. If
* @param sourceCredentials the source credential used as to acquire the impersonated credentials
* @param targetPrincipal the service account to impersonate
* @param delegates the chained list of delegates required to grant the final access_token. If
* set, the sequence of identities must have "Service Account Token Creator" capability
* granted to the preceding identity. For example, if set to [serviceAccountB,
* serviceAccountC], the sourceCredential must have the Token Creator role on serviceAccountB.
* serviceAccountB must have the Token Creator on serviceAccountC. Finally, C must have Token
* Creator on target_principal. If left unset, sourceCredential must have that role on
* targetPrincipal.
* @param scopes Scopes to request during the authorization grant.
* @param lifetime Number of seconds the delegated credential should be valid for. By default this
* value should be at most 3600. However, you can follow the instructions described in the
* following link to set up the service account, and extend the maximum lifetime to 43200 (12
* hours).
* @param scopes scopes to request during the authorization grant
* @param lifetime number of seconds the delegated credential should be valid. By default this
* value should be at most 3600. However, you can follow
* <a href='https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials#sa-credentials-oauth'>these
* instructions</a> to set up the service account and extend the maximum lifetime
* to 43200 (12 hours).
* https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials#sa-credentials-oauth
* @return new credentials
*/
Expand All @@ -182,7 +179,7 @@ public static ImpersonatedCredentials create(
/**
* Returns the email field of the serviceAccount that is being impersonated.
*
* @return email address of the impersonated service account.
* @return email address of the impersonated service account
*/
@Override
public String getAccount() {
Expand Down Expand Up @@ -224,10 +221,10 @@ private ImpersonatedCredentials(Builder builder) {
this.delegates = new ArrayList<String>();
}
if (this.scopes == null) {
throw new IllegalStateException(SCOPE_EMPTY_ERROR);
throw new IllegalStateException("Scopes cannot be null");
}
if (this.lifetime > TWELVE_HOURS_IN_SECONDS) {
throw new IllegalStateException(LIFETIME_EXCEEDED_ERROR);
throw new IllegalStateException("lifetime must be less than or equal to 43200");
}
}

Expand Down Expand Up @@ -278,26 +275,25 @@ public AccessToken refreshAccessToken() throws IOException {
OAuth2Utils.validateString(responseData, "expireTime", "Expected to find an expireTime");

DateFormat format = new SimpleDateFormat(RFC3339);
Date date;
try {
date = format.parse(expireTime);
Date date = format.parse(expireTime);
return new AccessToken(accessToken, date);
} catch (ParseException pe) {
throw new IOException("Error parsing expireTime: " + pe.getMessage());
}
return new AccessToken(accessToken, date);
}

/**
* Returns an IdToken for the current Credential.
*
* @param targetAudience the audience field for the issued ID Token
* @param options List of Credential specific options for for the token. For example, an IDToken
* for a ImpersonatedCredentials can return the email address within the token claims if
* @param targetAudience the audience field for the issued ID token
* @param options credential specific options for for the token. For example, an ID token
* for an ImpersonatedCredentials can return the email address within the token claims if
* "ImpersonatedCredentials.INCLUDE_EMAIL" is provided as a list option.<br>
* Only one option value is supported: "ImpersonatedCredentials.INCLUDE_EMAIL" If no options
* are set, the default excludes the "includeEmail" attribute in the API request
* @return IdToken object which includes the raw id_token, expiration and audience.
* @throws IOException if the attempt to get an IdToken failed
* are set, the default excludes the "includeEmail" attribute in the API request.
* @return IdToken object which includes the raw id_token, expiration, and audience
* @throws IOException if the attempt to get an ID token failed
*/
@Beta
@Override
Expand Down