Service Account

[domm]

I would like to access some google APIs (cloud storage, for example) using a service account. Therefore I download a json file from google, looking like this:

{
  "type": "service_account",
  "project_id": "foo",
  "private_key_id": "1234345234",
  "private_key": "-----BEGIN PRIVATE KEY-----.......",
  "client_email": "foo@priject.iam.gserviceaccount.com",
  "client_id": "38573098473985",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/....."
}

According to https://cloud.google.com/docs/authentication/getting-started, this file (and most specifically the private key) can be used to access the API.

But I cannot figure out, if WebService::GoogleAPI::Client supports this. goauth seems to only work for user OAuth2 logins.

I might have some time to add this to WebService::GoogleAPI::Client, but before I dig I wanted to know if I maybe just missed the correct way to use a Service Account, and if you would consider a patch implementing this.

Greetings,
domm

[rabbiveesh]

In the examples directory, there's a script that seems to use a service account, called dev_service_account_client_example.pl

It's not yet implemented in the package, so feel free to submit a patch.

[domm]

Great, I did not see this script, and it's very helpful, because I could not find proper docs on how/where google handles the ServiceAccount "login". All their examples use their own libs, and they never explain the low-level actions..

So, this scripts fetches an access_token via the private key, and we can then use the access_token as a Bearer Token.

Does WebService-GoogleAPI-Client support using Bearer Tokens? I cannot find this in the docs for WebService::GoogleAPI::Client->new? Could we generate a gapi_json file? I could not find any docs on this file, but what I can guess from goauth it does not support access/refresh/bearer tokens

And for long-running process we would need to add refresh-token handling.

I've done all of this (we're using a custom OAuth2 Server in our app, and also use ServiceAccounts there), so I could probably add this.

But: I'm not sure I actually want to add the whole Mojo-stack to my non-Mojo codebase. So maybe I'll try to come up with a generic Service-Account-Handler that could then be maybe plugged into WebService::GoogleAPI::Client.

Thanks for the reply!
Greetings,
domm

[pscott-au]

I have been away from the code base for a little while but I believe that access using the ServiceAccount credentials should be reasonably simple. I started to standardise this but wanted to refactor the credentials JSON to accomodate which is where I last left things.
I will look into it over the next few days and expect that I can either extend the current JSON config or minimally provide an example of how to use the provided service file.

[domm]

I'm now using https://metacpan.org/pod/WWW::Google::Cloud::Auth::ServiceAccount to use a JSON key file to get an access-token, which I then use directly with LWP to talk to Google REST API.

If you want to enable service accounts, maybe look into WWW::Google::Cloud::Auth::ServiceAccount

[rabbiveesh]

Hi, I actually have the code for this now on my rabbiveesh/service-account branch. The delay was b/c I needed to do a lot of refactoring til I was happy with the code (I'm almost there now).

I need to test it a drop more, and I should be able to merge it by next week latest.

[rabbiveesh]

This is now available on CPAN as version 0.23.

[rabbiveesh]

closing this, as the feature requested is implemented.