Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support ADC json when impersonating service user #1382

Closed
bailer opened this issue Mar 13, 2022 · 2 comments
Closed

Support ADC json when impersonating service user #1382

bailer opened this issue Mar 13, 2022 · 2 comments
Labels
priority: p3 Desirable enhancement or fix. May not be included in next release. type: feature request ‘Nice-to-have’ improvement, new feature or different behavior or design.

Comments

@bailer
Copy link

bailer commented Mar 13, 2022

Is your feature request related to a problem? Please describe.
When generating an ADC json you are able to impersonate a service user which outputs a JSON file that is not currently handled.
e.g.

gcloud auth application-default login --impersonate-service-account=server@example.iam.gserviceaccount.com

Which generates the following JSON format:

{
  "delegates": [],
  "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/server@example.iam.gserviceaccount.com:generateAccessToken",
  "source_credentials": {
    "client_id": "1234567890.apps.googleusercontent.com",
    "client_secret": "<secret>",
    "refresh_token": "<refrest_token>",
    "type": "authorized_user"
  },
  "type": "impersonated_service_account"
}

Currently the library throws the following error when doing this:
The incoming JSON object does not contain a client_email field
Describe the solution you'd like
I'd like the library to detect this format and handle it correctly
Describe alternatives you've considered
I can manually alter the file by putting the contents of source_credentials at the top level of the JSON (though unsure if this has any side-effect). I can also generate a key for the service user but since it's not recommended, impersonating the service user and using ADC would be preferred.
Additional context
I'm very new to GCP and authentication in that regard and was trying to set up local development without generating keys but still using a service user. I found that you can impersonate a service user while generating the ADC JSON but it's not working with this library. I found that e.g. google-auth-library-python supports this format so I'm thinking the node library also should.

@bailer bailer added priority: p3 Desirable enhancement or fix. May not be included in next release. type: feature request ‘Nice-to-have’ improvement, new feature or different behavior or design. labels Mar 13, 2022
@imathews
Copy link

Just a friendly +1 on this — I'm running into the same issue with google-auth-node, which is preventing us from utilizing impersonated service accounts in our local dev environment.

gcf-owl-bot bot added a commit that referenced this issue Apr 1, 2022
…1382)

* chore: Enable Size-Label bot in all googleapis NodeJs repositories

Auto-label T-shirt size indicator should be assigned on every new pull request in all googleapis NodeJs repositories

* Remove product

Remove product since it is by default true
Source-Link: googleapis/synthtool@f1562fa
Post-Processor: gcr.io/cloud-devrel-public-resources/owlbot-nodejs:latest@sha256:bb4d47d0e770abad62699a4664ce6b9ff1629d50c276a6c75860a6a1853dd19b
SurferJeffAtGoogle pushed a commit that referenced this issue Apr 4, 2022
…1382) (#1387)

* chore: Enable Size-Label bot in all googleapis NodeJs repositories

Auto-label T-shirt size indicator should be assigned on every new pull request in all googleapis NodeJs repositories

* Remove product

Remove product since it is by default true
Source-Link: googleapis/synthtool@f1562fa
Post-Processor: gcr.io/cloud-devrel-public-resources/owlbot-nodejs:latest@sha256:bb4d47d0e770abad62699a4664ce6b9ff1629d50c276a6c75860a6a1853dd19b

Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>
@danielbankhead
Copy link
Member

This has been resolved via #1425

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
priority: p3 Desirable enhancement or fix. May not be included in next release. type: feature request ‘Nice-to-have’ improvement, new feature or different behavior or design.
Projects
None yet
Development

No branches or pull requests

3 participants