Cloud Java APIs should work with a local Cloud SDK with GAE Standard.

[ludoch]

With the following code in my Java Servlet:

   Storage storage = StorageOptions.getDefaultInstance().getService();
   
   
    String bucketName = "rdayalcloudtest"; // Change this to something unique
    Bucket bucket = storage.create(BucketInfo.of(bucketName));

    // Upload a blob to the newly created bucket
    BlobId blobId = BlobId.of(bucketName, "my_blob_name");
    Blob blob = bucket.create(
        "my_blob_name " + request.hashCode(), "a simple blob".getBytes(UTF_8), "text/plain");

I receive the following exception when attempting to test the code locally, using DevAppServer2:

Problem accessing /hello. Reason:

access denied ("java.io.FilePermission" "/Users/ludo/.config/gcloud/active_config" "read")

Caused by:

java.security.AccessControlException: access denied ("java.io.FilePermission" "/Users/ludo/.config/gcloud/active_config" "read")
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:472)
at java.security.AccessController.checkPermission(AccessController.java:884)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
at com.google.appengine.tools.development.devappserver2.DevAppServer2Factory$CustomSecurityManager.checkPermission(DevAppServer2Factory.java:232)
at java.lang.SecurityManager.checkRead(SecurityManager.java:888)
at java.io.FileInputStream.(FileInputStream.java:127)
at com.google.common.io.Files$FileByteSource.openStream(Files.java:125)
at com.google.common.io.Files$FileByteSource.openStream(Files.java:115)
at com.google.common.io.ByteSource$AsCharSource.openStream(ByteSource.java:420)
at com.google.common.io.CharSource.openBufferedStream(CharSource.java:91)
at com.google.common.io.CharSource.readFirstLine(CharSource.java:168)
at com.google.common.io.Files.readFirstLine(Files.java:513)
at com.google.cloud.ServiceOptions.activeGoogleCloudConfig(ServiceOptions.java:354)
at com.google.cloud.ServiceOptions.googleCloudProjectId(ServiceOptions.java:372)
at com.google.cloud.ServiceOptions.getDefaultProject(ServiceOptions.java:348)
at com.google.cloud.ServiceOptions.(ServiceOptions.java:281)
at com.google.cloud.HttpServiceOptions.(HttpServiceOptions.java:179)
at com.google.cloud.storage.StorageOptions.(StorageOptions.java:69)
at com.google.cloud.storage.StorageOptions.(StorageOptions.java:27)
at com.google.cloud.storage.StorageOptions$Builder.build(StorageOptions.java:64)
at com.google.cloud.storage.StorageOptions.getDefaultInstance(StorageOptions.java:99)
at com.example.HelloAppEngine.doGet(HelloAppEngine.java:40)

[lesv]

Is this the right place to report this? I think this is an issue with the Java SDK.

[roku6185]

I'm having the same problem after updating our maven plugin to:

<plugin>
  <groupId>com.google.cloud.tools</groupId>
  <artifactId>appengine-maven-plugin</artifactId>
  <version>1.0.0</version>
</plugin>

I also filed a ticket in the Google Cloud Support Center.

[roku6185]

I solved it by renaming the gcloud directory:

$ mv ~/.config/gcloud ~/.config/gcloud_backup

When I started my java service after this fix everything worked okay.

[ludoch]

Les: GAE standard current sandbox rules (for Java7, lifted on Java8) does not allow a web application to read local file...
The Cloud Java library if running locally should find a way to get the metadata info it needs (project ID, project version etc) in another way than reading local file... (env var, syst prop, GAE API,...)

[lesv]

@GoogleCloudPlatform/cloud-tools-for-java FYI - indirectly affects you.

@ludoch Try adding:

   <dependency>
      <groupId>com.google.api-client</groupId>
      <artifactId>google-api-client-appengine</artifactId>
      <version>1.21.0</version>
    </dependency>

@garrettjonesgoogle @anthmgoogle We need to do this right for GAE Standard as we get gRPC working there.

[garrettjonesgoogle]

Based on the code flow in https://github.com/GoogleCloudPlatform/google-cloud-java/blob/master/google-cloud-core/src/main/java/com/google/cloud/ServiceOptions.java#L336 , if the app engine project id is found in appEngineProjectId(), then googleCloudProjectId() won't be called. Thus, something is going wrong with detecting that this is an app engine use case.

[ludoch]

Maybe this logic has been testing in prod but not in the local GAE Java SDK? Maybe, by making the project id optional in appengine-web.xml the local dev server does not know anymore the project name to use? This might be yet another side effect of changing config in appengine-web.xml?

…

On Fri, Jan 13, 2017 at 2:53 PM, garrettjonesgoogle < ***@***.***> wrote: Based on the code flow in https://github.com/GoogleCloudPlatform/google- cloud-java/blob/master/google-cloud-core/src/main/java/com/ google/cloud/ServiceOptions.java#L336 , if the app engine project id is found in appEngineProjectId(), then googleCloudProjectId() won't be called. Thus, something is going wrong with detecting that this is an app engine use case. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1500 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAE4zaufwEgtXfgbP1FTSYwFPTgIAjWmks5rSABbgaJpZM4LbPIA> .

[ludoch]

Customer is now escalating the issue with Google support.

[shinfan]

Update: I was able to reproduce this issue with my own GAE app. Will investigate.

[shinfan]

@lesv It looks like that the reflection method raises ClassNotFound exception here while running with GAE dev server. Do you know who should I talk to regading this issue?

[lesv]

@garrettjonesgoogle Is probably the right person.

[Orbyt]

I have run into an AccessControlException as well when trying to use google-cloud-java to access Cloud Storage.

As specified here, after executing gcloud auth application-default login the path to the /Users/example/.config/gcloud/application_default_credentials.json is returned. Running my App Engine application locally after executing the above command still produces an AccessControlException.

Additionally, manually calling .setCredentials(), such as:

Storage storage = StorageOptions.newBuilder()
            .setCredentials(ServiceAccountCredentials.fromStream(new FileInputStream("/Users/example/.config/gcloud/application_default_credentials.json")))
            .build()
            .getService();

also does not work, and produces the same AccessControlException.

So given that other users are having a similar issue, should I assume this is not an issue with my own code? Or am I doing something incorrectly here?

[Orbyt]

Continuing from my above comment, I have now also tried setting a GOOGLE_APPLICATION_CREDENTIALS to the path returned from gcloud auth application-default login, however the same AccessControlException is thrown.

EDIT: Following https://developers.google.com/identity/protocols/application-default-credentials more closely, I generated a service account key as described in item "1." and set the value of GOOGLE_APPLICATION_CREDENTIALS to the path of that downloaded .json file, but the issue persists.

[ludoch]

What I could try to do is enable read permission for ~/.config only in the devappserver.

[lesv]

Garrett told me last night that Shin had gotten further, so I didn't look at this again.

@Orbyt You should rarely need to use setCredentials() -- typically it's used for x-project access, a limited scope service account, or to use from a non-google datacenter. For most other cases defaultAuth should work. In your case, passing the credentials created by gcloud is incorrect - you need to pass credentials obtained from https://console.cloud.google.com -- why don't you create a new issue, and mention me in it and I'll help you out.

[shinfan]

@Orbyt @ludoch

appEngineProjectId() uses reflection to retrieve the project ID of GAE application, the access control exception is misleading since googleCloudProjectId() should not be called under GAE environment.

Adding the following dependency to my application solves this issue:

<!-- https://mvnrepository.com/artifact/com.google.appengine/appengine-java-sdk -->
<dependency>
    <groupId>com.google.appengine</groupId>
    <artifactId>appengine-java-sdk</artifactId>
    <version>1.9.50</version>
</dependency>

[ludoch]

There is no such artifact appengine-java-sdk... What did you really add?

[shinfan]

@ludoch This is what I added to my pom file:
https://mvnrepository.com/artifact/com.google.appengine/appengine-api-1.0-sdk/1.9.50

[ludoch]

Ok, so yes, you add the GAE Standard APIs, that define the APIs that gcloud-java is calling via introspection, so it make sense... So you are not accessing ~/.config/gcloud with this dep?

…

On Fri, Mar 10, 2017 at 3:34 PM, Shin Fan ***@***.***> wrote: @ludoch <https://github.com/ludoch> This is what I added to my pom file: https://mvnrepository.com/artifact/com.google.appengine/ appengine-api-1.0-sdk/1.9.50 — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1500 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAE4zcjfDzeyhk6gStlzVcGe_U3LE6I-ks5rkd4BgaJpZM4LbPIA> .

[shinfan]

No, we should not need to access the gcloud config. According to the code flow, getAppEngineProjectId() should be able find the correct project ID through standard GAE API.

[Orbyt]

@shinfan @ludoch That dependency is already added by default when using the Java GAE quickstart.

It does not solve this issue. #1731 Provides some more information on my specific case, if needed.

[shinfan]

Customer confirmed that the issue has been solved on his end. Closing this issue now.

[rdayal]

@shinfan how come we closed this? What's the actual fix?

[shinfan]

@rdayal There is nothing to fix from our side. The issue was caused by a missing dependency and the customer has confirmed things now working. See #1731

Confirm with @Orbyt

[rdayal]

Thanks, the reason this had been filed on this side is that I had run into this issue independently, and filed an internal bug about it. I wasn't following the other thread. I'll mark the other bug as closed.