Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

impersonated_credentials.py should use UTC #1329

Closed
clundin25 opened this issue Jun 9, 2023 · 3 comments · Fixed by #1330
Closed

impersonated_credentials.py should use UTC #1329

clundin25 opened this issue Jun 9, 2023 · 3 comments · Fixed by #1330

Comments

@clundin25
Copy link
Contributor

ID tokens had an issue where the fromtimestamp API was used instead of utcfromtimestamp. Ref: #1323.

It appears that impersonated_credentials.py uses the same API, and is likely impacted by the same issue.

➜ rg "\.fromtimestamp" -g '!*test*'
google/auth/compute_engine/credentials.py
392:        return id_token, datetime.datetime.fromtimestamp(payload["exp"])

google/auth/impersonated_credentials.py
457:        self.expiry = datetime.fromtimestamp(jwt.decode(id_token, verify=False)["exp"])

google/auth/impersonated_credentials.py should be updated to use utcfromtimestamp instead of fromtimestamp.

@juzna
Copy link
Contributor

juzna commented Jun 9, 2023

I verified that this is failing as well:

import google.auth
import google.auth.transport.requests
import google.auth.impersonated_credentials

# gcloud auth application-default login --impersonate-service-account=...
creds, _project_id = google.auth.default(scopes=["https://www.googleapis.com/auth/cloud-platform"])
assert isinstance(creds, google.auth.impersonated_credentials.Credentials), "gcloud login with impersonated creds required"

request = google.auth.transport.requests.Request()
creds.refresh(request)
assert creds.token
assert not creds.expired

id_creds = google.auth.impersonated_credentials.IDTokenCredentials(creds, 'foo', include_email=True)
id_creds.refresh(request)
assert id_creds.token
assert not id_creds.expired

Same as in #1323, with export TZ=America/New_York the id token is considered expired immediately and the last assert fails.

@juzna
Copy link
Contributor

juzna commented Jun 9, 2023

And confirming that when I change the code to utcfromtimestamp then the test case passes.

@clundin25
Copy link
Contributor Author

Awesome ! @juzna since you've already done all the hard work, do you want to open a PR for this? :)

If not I will, and will give you credit

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants