Add delegate_credentials

[salrashid123]

Delegate Credentials is basically a way for a user or (more common) service account to impersonate another service account.

Ref:

• https://cloud.google.com/iam/docs/service-accounts#the_service_account_token_creator_role
• https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials
• https://cloud.google.com/iam/credentials/reference/rest/v1/projects.serviceAccounts/generateAccessToken

I've verified the sample with service_account, user_credentials and with GCE metadata server.

---

sample usage

scopes = ['https://www.googleapis.com/auth/devstorage.read_only']
svc_account_file = '/path/to/svc_account.json'

os.environ['GOOGLE_APPLICATION_CREDENTIALS'] = svc_account_file
root_credentials, project = google.auth.default(scopes=scopes)

#project = 'your_project'
#root_credentials = google.oauth2.service_account.Credentials.from_service_account_file(svc_account_file)

#user_creds_file = '/path/to/user_creds.json'
#root_credentials = credentials.Credentials.from_authorized_user_file(user_creds_file, scopes=scopes)

print "Try to list buckets in destination project (this will fail because current user/svc does not have access")
try:    
    client = storage.Client(credentials=root_credentials)
    buckets = client.list_buckets(project='your_project')
    for bkt in buckets:
      print bkt
except google.api_core.exceptions.Forbidden as e:
  print e
  pass

print('--------------------------------------------------------')
# now use as svcA@projectA.iam.gserviceaccount.com, get an access_token for
# impersonated-account@projectB.iam.gserviceaccount.com   (that account _does_ have access)

new_scopes = ['https://www.googleapis.com/auth/devstorage.read_only']
delegate_credentials = DelegateCredentials(
              root_credentials = root_credentials,
              principal='impersonated-account@fabled-ray-104117.iam.gserviceaccount.com',
              new_scopes = new_scopes,
              delegates=[],
              lifetime=500)

print("listing bucket in destination project:")
client = storage.Client(credentials=delegate_credentials)
buckets = client.list_buckets(project='fabled-ray-104117')
for bkt in buckets:
  print bkt.name

---

For https://github.com/googleapis/google-cloud-common/issues/266

/comments off

[salrashid123]

Some comments on the PR

(CI seems to be 'stuck' on one test currently)

---

I originally wanted to use google.auth.transport.AuthorizedSession in DelegateCredentials._updateToken() but the the embedded mock request object passed in through to the AuthorizedSession seems to get reset. So instead, i used the request directly

authed_session = AuthorizedSession(self._root_credentials)
response = authed_session.post(iam_endpoint,
                               headers={'Content-Type': 'application/json'},
                               json=body)
if (response.status_code == 200):
    token_response = json.loads(response.content)
    self.token = token_response['accessToken']
    self.expiry = datetime.datetime.strptime(token_response['expireTime'], '%Y-%m-%dT%H:%M:%SZ')

---

• iamcredentials.generateAccessToken() api docs states microseconds in the response
  https://cloud.google.com/iam/credentials/reference/rest/v1/projects.serviceAccounts/generateAccessToken

A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".

but hte actual API returns just seconds (i'd expect second resolution for this type of api, actually). I'll file a bug to update the docs; I've taken this into account in the PR

From the API response

{
    "expireTime": "2018-10-13T16:51:00Z", 
    "accessToken": "<redacted>"
}

[salrashid123]

changed the name of the function from DelegateCredentials --> ImpersonatedCredentials.

ref:

• https://tools.ietf.org/html/draft-ietf-oauth-token-exchange-16#section-1.1

[salrashid123]

Not sure how to squish these to make the linter happy...

google/auth/impersonated_credentials.py:77:80: E501 line too long (80 > 79 characters)
google/auth/impersonated_credentials.py:78:80: E501 line too long (83 > 79 characters)
google/auth/impersonated_credentials.py:176:80: E501 line too long (80 > 79 characters)

[theacodes]

@salrashid123 I made significant changes, but this is ready to merge. Can you please do a real-world test of the changes before we merge this in?

Thank you for all of your work and patience on this!

[salrashid123]

sure, for the record, there's the sample real testing done for the initial source_credentials as a service account and running inside GCE as computecredentials.

#!/usr/bin/python
from google.cloud import storage
import google.auth
from google.oauth2 import credentials
from google.oauth2 import service_account


from google.auth import impersonated_credentials
import google.api_core.exceptions
import os, time

# Create source identity:
# gcloud iam service-accounts create source-serviceaccount --display-name="Source Identity"
# gcloud iam service-accounts keys  create svc-src.json --iam-account=source-serviceaccount@mineral-minutia-820.iam.gserviceaccount.com


# Create target identity
# gcloud iam service-accounts create target-serviceaccount --display-name="Target Identity"

# Allow source to impersonate target
# gcloud iam service-accounts add-iam-policy-binding target-serviceaccount@mineral-minutia-820.iam.gserviceaccount.com --member='serviceAccount:source-serviceaccount@mineral-minutia-820.iam.gserviceaccount.com' --role='roles/iam.serviceAccountTokenCreator'

# Add resource ACL to target
# gcloud projects add-iam-policy-binding mineral-minutia-820 --member='serviceAccount:target-serviceaccount@mineral-minutia-820.iam.gserviceaccount.com' --role='roles/storage.admin'

# Test the app below


# now create a GCE instance of the same source identity.
# comment out the service account section and uncomment the ComputeCredential section (as ADC)
# gcloud compute instances create impersonate-test --service-account=source-serviceaccount@mineral-minutia-820.iam.gserviceaccount.com --scopes=https://www.googleapis.com/auth/iam
# Upload the source below to GCE and rerun the test

# For service account credentials
svc_account_file = 'svc-src.json'

target_scopes = ['https://www.googleapis.com/auth/devstorage.read_only']
source_credentials = service_account.Credentials.from_service_account_file(
    svc_account_file,
    scopes=target_scopes)


# For ComputeCredentials
# source_credentials, project = google.auth.default() 



try:
  client = storage.Client(credentials=source_credentials)
  buckets = client.list_buckets(project='mineral-minutia-820')
  for bucket in buckets:
    print bucket.name
except google.api_core.exceptions.Forbidden:
  print ">>>>> Forbidden"
  pass

# now try delegation
target_credentials = impersonated_credentials.Credentials(
    source_credentials = source_credentials,
    target_principal='target-serviceaccount@mineral-minutia-820.iam.gserviceaccount.com',
    target_scopes = target_scopes,
    delegates=[],
    lifetime=500)
client = storage.Client(credentials=target_credentials)
buckets = client.list_buckets(project='mineral-minutia-820')
for bucket in buckets:
    print bucket.name

[theacodes]

Cool, we should probably try to turn that into a system test at some point, but it's not needed right now.

Let me know how testing goes, then we can merge and release.

[salrashid123]

@theacodes
I already ran through those tests (been running live tests also to verify refresh() behavior w/ one credential in loop, etc)

[theacodes]

Cool, let's get this merged.