Adding refresh token credentials.
- The google default credentials now work with the cloud SDK.
- Verified end to end with print_default_credentials and fetch_oauth2
tools.
diff --git a/include/grpc/grpc_security.h b/include/grpc/grpc_security.h
index ab2cc08..f941834 100644
--- a/include/grpc/grpc_security.h
+++ b/include/grpc/grpc_security.h
@@ -117,6 +117,15 @@
grpc_credentials *grpc_jwt_credentials_create(const char *json_key,
gpr_timespec token_lifetime);
+/* Creates an Oauth2 Refresh Token crednetials object. May return NULL if the
+ input is invalid.
+ WARNING: Do NOT use this credentials to connect to a non-google service as
+ this could result in an oauth2 token leak.
+ - json_refresh_token is the JSON string containing the refresh token itself
+ along with a client_id and client_secret. */
+grpc_credentials *grpc_refresh_token_credentials_create(
+ const char *json_refresh_token);
+
/* Creates a fake transport security credentials object for testing. */
grpc_credentials *grpc_fake_transport_security_credentials_create(void);
diff --git a/src/core/security/credentials.c b/src/core/security/credentials.c
index 3ad1e7e..698e099 100644
--- a/src/core/security/credentials.c
+++ b/src/core/security/credentials.c
@@ -46,20 +46,6 @@
#include <grpc/support/sync.h>
#include <grpc/support/time.h>
-/* -- Constants. -- */
-
-#define GRPC_SECURE_TOKEN_REFRESH_THRESHOLD_SECS 60
-
-#define GRPC_COMPUTE_ENGINE_METADATA_HOST "metadata"
-#define GRPC_COMPUTE_ENGINE_METADATA_TOKEN_PATH \
- "/computeMetadata/v1/instance/service-accounts/default/token"
-
-#define GRPC_SERVICE_ACCOUNT_HOST "www.googleapis.com"
-#define GRPC_SERVICE_ACCOUNT_TOKEN_PATH "/oauth2/v3/token"
-#define GRPC_SERVICE_ACCOUNT_POST_BODY_PREFIX \
- "grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&" \
- "assertion="
-
/* -- Common. -- */
typedef struct {
@@ -671,8 +657,8 @@
}
gpr_asprintf(&body, "%s%s", GRPC_SERVICE_ACCOUNT_POST_BODY_PREFIX, jwt);
memset(&request, 0, sizeof(grpc_httpcli_request));
- request.host = GRPC_SERVICE_ACCOUNT_HOST;
- request.path = GRPC_SERVICE_ACCOUNT_TOKEN_PATH;
+ request.host = GRPC_GOOGLE_OAUTH2_SERVICE_HOST;
+ request.path = GRPC_GOOGLE_OAUTH2_SERVICE_TOKEN_PATH;
request.hdr_count = 1;
request.hdrs = &header;
request.use_ssl = 1;
@@ -703,6 +689,67 @@
return &c->base.base;
}
+/* -- RefreshToken credentials. -- */
+
+typedef struct {
+ grpc_oauth2_token_fetcher_credentials base;
+ grpc_auth_refresh_token refresh_token;
+} grpc_refresh_token_credentials;
+
+static void refresh_token_destroy(grpc_credentials *creds) {
+ grpc_refresh_token_credentials *c =
+ (grpc_refresh_token_credentials *)creds;
+ grpc_auth_refresh_token_destruct(&c->refresh_token);
+ oauth2_token_fetcher_destroy(&c->base.base);
+}
+
+static grpc_credentials_vtable refresh_token_vtable = {
+ refresh_token_destroy, oauth2_token_fetcher_has_request_metadata,
+ oauth2_token_fetcher_has_request_metadata_only,
+ oauth2_token_fetcher_get_request_metadata};
+
+static void refresh_token_fetch_oauth2(
+ grpc_credentials_metadata_request *metadata_req,
+ grpc_httpcli_response_cb response_cb, gpr_timespec deadline) {
+ grpc_refresh_token_credentials *c =
+ (grpc_refresh_token_credentials *)metadata_req->creds;
+ grpc_httpcli_header header = {"Content-Type",
+ "application/x-www-form-urlencoded"};
+ grpc_httpcli_request request;
+ char *body = NULL;
+ gpr_asprintf(&body, GRPC_REFRESH_TOKEN_POST_BODY_FORMAT_STRING,
+ c->refresh_token.client_id, c->refresh_token.client_secret,
+ c->refresh_token.refresh_token);
+ memset(&request, 0, sizeof(grpc_httpcli_request));
+ request.host = GRPC_GOOGLE_OAUTH2_SERVICE_HOST;
+ request.path = GRPC_GOOGLE_OAUTH2_SERVICE_TOKEN_PATH;
+ request.hdr_count = 1;
+ request.hdrs = &header;
+ request.use_ssl = 1;
+ grpc_httpcli_post(&request, body, strlen(body), deadline, response_cb,
+ metadata_req);
+ gpr_free(body);
+}
+
+grpc_credentials *grpc_refresh_token_credentials_create(
+ const char *json_refresh_token) {
+ grpc_refresh_token_credentials *c;
+ grpc_auth_refresh_token refresh_token =
+ grpc_auth_refresh_token_create_from_string(json_refresh_token);
+
+ if (!grpc_auth_refresh_token_is_valid(&refresh_token)) {
+ gpr_log(GPR_ERROR,
+ "Invalid input for refresh token credentials creation");
+ return NULL;
+ }
+ c = gpr_malloc(sizeof(grpc_refresh_token_credentials));
+ memset(c, 0, sizeof(grpc_refresh_token_credentials));
+ init_oauth2_token_fetcher(&c->base, refresh_token_fetch_oauth2);
+ c->base.base.vtable = &refresh_token_vtable;
+ c->refresh_token = refresh_token;
+ return &c->base.base;
+}
+
/* -- Fake Oauth2 credentials. -- */
typedef struct {
diff --git a/src/core/security/credentials.h b/src/core/security/credentials.h
index 454e668..0f70670 100644
--- a/src/core/security/credentials.h
+++ b/src/core/security/credentials.h
@@ -64,6 +64,22 @@
#define GRPC_GOOGLE_WELL_KNOWN_CREDENTIALS_FILE \
"application_default_credentials.json"
+#define GRPC_SECURE_TOKEN_REFRESH_THRESHOLD_SECS 60
+
+#define GRPC_COMPUTE_ENGINE_METADATA_HOST "metadata"
+#define GRPC_COMPUTE_ENGINE_METADATA_TOKEN_PATH \
+ "/computeMetadata/v1/instance/service-accounts/default/token"
+
+#define GRPC_GOOGLE_OAUTH2_SERVICE_HOST "www.googleapis.com"
+#define GRPC_GOOGLE_OAUTH2_SERVICE_TOKEN_PATH "/oauth2/v3/token"
+
+#define GRPC_SERVICE_ACCOUNT_POST_BODY_PREFIX \
+ "grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&" \
+ "assertion="
+
+#define GRPC_REFRESH_TOKEN_POST_BODY_FORMAT_STRING \
+ "client_id=%s&client_secret=%s&refresh_token=%s&grant_type=refresh_token"
+
/* --- grpc_credentials. --- */
/* It is the caller's responsibility to gpr_free the result if not NULL. */
diff --git a/src/core/security/google_default_credentials.c b/src/core/security/google_default_credentials.c
index bdc907e..ebea70d 100644
--- a/src/core/security/google_default_credentials.c
+++ b/src/core/security/google_default_credentials.c
@@ -138,6 +138,23 @@
return result;
}
+/* Takes ownership of creds_path if not NULL. */
+static grpc_credentials *create_refresh_token_creds_from_path(
+ char *creds_path) {
+ grpc_credentials *result = NULL;
+ gpr_slice creds_data;
+ int file_ok = 0;
+ if (creds_path == NULL) return NULL;
+ creds_data = gpr_load_file(creds_path, &file_ok);
+ gpr_free(creds_path);
+ if (file_ok) {
+ result = grpc_refresh_token_credentials_create(
+ (const char *)GPR_SLICE_START_PTR(creds_data));
+ gpr_slice_unref(creds_data);
+ }
+ return result;
+}
+
grpc_credentials *grpc_google_default_credentials_create(void) {
grpc_credentials *result = NULL;
int serving_cached_credentials = 0;
@@ -157,7 +174,7 @@
if (result != NULL) goto end;
/* Then the well-known file. */
- result = create_jwt_creds_from_path(
+ result = create_refresh_token_creds_from_path(
grpc_get_well_known_google_credentials_file_path());
if (result != NULL) goto end;
diff --git a/test/core/security/credentials_test.c b/test/core/security/credentials_test.c
index 0784624..d1d1ec1 100644
--- a/test/core/security/credentials_test.c
+++ b/test/core/security/credentials_test.c
@@ -84,6 +84,13 @@
"\"777-abaslkan11hlb6nmim3bpspl31ud.apps.googleusercontent."
"com\", \"type\": \"service_account\" }";
+/* Test refresh token. */
+static const char test_refresh_token_str[] =
+ "{ \"client_id\": \"32555999999.apps.googleusercontent.com\","
+ " \"client_secret\": \"EmssLNjJy1332hD4KFsecret\","
+ " \"refresh_token\": \"1/Blahblasj424jladJDSGNf-u4Sua3HDA2ngjd42\","
+ " \"type\": \"authorized_user\"}";
+
static const char valid_oauth2_json_response[] =
"{\"access_token\":\"ya29.AHES6ZRN3-HlhAPya30GnW_bHSb_\","
" \"expires_in\":3599, "
@@ -97,10 +104,6 @@
"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImY0OTRkN2M1YWU2MGRmOTcyNmM4YW"
"U0MDcyZTViYTdmZDkwODg2YzcifQ";
-static const char expected_service_account_http_body_prefix[] =
- "grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&"
- "assertion=";
-
static const char test_service_url[] = "https://foo.com/foo.v1";
static const char other_test_service_url[] = "https://bar.com/bar.v1";
@@ -463,6 +466,87 @@
grpc_httpcli_set_override(NULL, NULL);
}
+static void validate_refresh_token_http_request(
+ const grpc_httpcli_request *request, const char *body, size_t body_size) {
+ /* The content of the assertion is tested extensively in json_token_test. */
+ char *expected_body = NULL;
+ GPR_ASSERT(body != NULL);
+ GPR_ASSERT(body_size != 0);
+ gpr_asprintf(&expected_body, GRPC_REFRESH_TOKEN_POST_BODY_FORMAT_STRING,
+ "32555999999.apps.googleusercontent.com",
+ "EmssLNjJy1332hD4KFsecret",
+ "1/Blahblasj424jladJDSGNf-u4Sua3HDA2ngjd42");
+ GPR_ASSERT(strlen(expected_body) == body_size);
+ GPR_ASSERT(memcmp(expected_body, body, body_size) == 0);
+ gpr_free(expected_body);
+ GPR_ASSERT(request->use_ssl);
+ GPR_ASSERT(strcmp(request->host, GRPC_GOOGLE_OAUTH2_SERVICE_HOST) == 0);
+ GPR_ASSERT(strcmp(request->path, GRPC_GOOGLE_OAUTH2_SERVICE_TOKEN_PATH) == 0);
+ GPR_ASSERT(request->hdr_count == 1);
+ GPR_ASSERT(strcmp(request->hdrs[0].key, "Content-Type") == 0);
+ GPR_ASSERT(strcmp(request->hdrs[0].value,
+ "application/x-www-form-urlencoded") == 0);
+}
+
+static int refresh_token_httpcli_post_success(
+ const grpc_httpcli_request *request, const char *body, size_t body_size,
+ gpr_timespec deadline, grpc_httpcli_response_cb on_response,
+ void *user_data) {
+ grpc_httpcli_response response =
+ http_response(200, valid_oauth2_json_response);
+ validate_refresh_token_http_request(request, body, body_size);
+ on_response(user_data, &response);
+ return 1;
+}
+
+static int refresh_token_httpcli_post_failure(
+ const grpc_httpcli_request *request, const char *body, size_t body_size,
+ gpr_timespec deadline, grpc_httpcli_response_cb on_response,
+ void *user_data) {
+ grpc_httpcli_response response = http_response(403, "Not Authorized.");
+ validate_refresh_token_http_request(request, body, body_size);
+ on_response(user_data, &response);
+ return 1;
+}
+
+static void test_refresh_token_creds_success(void) {
+ grpc_credentials *refresh_token_creds =
+ grpc_refresh_token_credentials_create(test_refresh_token_str);
+ GPR_ASSERT(grpc_credentials_has_request_metadata(refresh_token_creds));
+ GPR_ASSERT(grpc_credentials_has_request_metadata_only(refresh_token_creds));
+
+ /* First request: http get should be called. */
+ grpc_httpcli_set_override(httpcli_get_should_not_be_called,
+ refresh_token_httpcli_post_success);
+ grpc_credentials_get_request_metadata(refresh_token_creds, test_service_url,
+ on_oauth2_creds_get_metadata_success,
+ (void *)test_user_data);
+
+ /* Second request: the cached token should be served directly. */
+ grpc_httpcli_set_override(httpcli_get_should_not_be_called,
+ httpcli_post_should_not_be_called);
+ grpc_credentials_get_request_metadata(refresh_token_creds, test_service_url,
+ on_oauth2_creds_get_metadata_success,
+ (void *)test_user_data);
+
+ grpc_credentials_unref(refresh_token_creds);
+ grpc_httpcli_set_override(NULL, NULL);
+}
+
+static void test_refresh_token_creds_failure(void) {
+ grpc_credentials *refresh_token_creds =
+ grpc_refresh_token_credentials_create(test_refresh_token_str);
+ grpc_httpcli_set_override(httpcli_get_should_not_be_called,
+ refresh_token_httpcli_post_failure);
+ GPR_ASSERT(grpc_credentials_has_request_metadata(refresh_token_creds));
+ GPR_ASSERT(grpc_credentials_has_request_metadata_only(refresh_token_creds));
+ grpc_credentials_get_request_metadata(refresh_token_creds, test_service_url,
+ on_oauth2_creds_get_metadata_failure,
+ (void *)test_user_data);
+ grpc_credentials_unref(refresh_token_creds);
+ grpc_httpcli_set_override(NULL, NULL);
+}
+
static void validate_jwt_encode_and_sign_params(
const grpc_auth_json_key *json_key, const char *scope,
gpr_timespec token_lifetime) {
@@ -515,13 +599,13 @@
GPR_ASSERT(body != NULL);
GPR_ASSERT(body_size != 0);
gpr_asprintf(&expected_body, "%s%s",
- expected_service_account_http_body_prefix, test_signed_jwt);
+ GRPC_SERVICE_ACCOUNT_POST_BODY_PREFIX, test_signed_jwt);
GPR_ASSERT(strlen(expected_body) == body_size);
- GPR_ASSERT(!memcmp(expected_body, body, body_size));
+ GPR_ASSERT(memcmp(expected_body, body, body_size) == 0);
gpr_free(expected_body);
GPR_ASSERT(request->use_ssl);
- GPR_ASSERT(strcmp(request->host, "www.googleapis.com") == 0);
- GPR_ASSERT(strcmp(request->path, "/oauth2/v3/token") == 0);
+ GPR_ASSERT(strcmp(request->host, GRPC_GOOGLE_OAUTH2_SERVICE_HOST) == 0);
+ GPR_ASSERT(strcmp(request->path, GRPC_GOOGLE_OAUTH2_SERVICE_TOKEN_PATH) == 0);
GPR_ASSERT(request->hdr_count == 1);
GPR_ASSERT(strcmp(request->hdrs[0].key, "Content-Type") == 0);
GPR_ASSERT(strcmp(request->hdrs[0].value,
@@ -711,6 +795,8 @@
test_ssl_oauth2_iam_composite_creds();
test_compute_engine_creds_success();
test_compute_engine_creds_failure();
+ test_refresh_token_creds_success();
+ test_refresh_token_creds_failure();
test_service_account_creds_success();
test_service_account_creds_http_failure();
test_service_account_creds_signing_failure();
diff --git a/test/core/security/fetch_oauth2.c b/test/core/security/fetch_oauth2.c
index 748a598..cc847c8 100644
--- a/test/core/security/fetch_oauth2.c
+++ b/test/core/security/fetch_oauth2.c
@@ -34,7 +34,6 @@
#include <stdio.h>
#include <string.h>
-#include "src/core/security/credentials.h"
#include <grpc/grpc.h>
#include <grpc/grpc_security.h>
#include <grpc/support/alloc.h>
@@ -43,6 +42,9 @@
#include <grpc/support/slice.h>
#include <grpc/support/sync.h>
+#include "src/core/security/credentials.h"
+#include "src/core/support/file.h"
+
typedef struct {
gpr_cv cv;
gpr_mu mu;
@@ -74,50 +76,50 @@
static grpc_credentials *create_service_account_creds(
const char *json_key_file_path, const char *scope) {
- char json_key[8192]; /* Should be plenty. */
- char *current = json_key;
- FILE *json_key_file = fopen(json_key_file_path, "r");
- if (json_key_file == NULL) {
- gpr_log(GPR_ERROR, "Invalid path for json key file: %s.",
- json_key_file_path);
+ int success;
+ gpr_slice json_key = gpr_load_file(json_key_file_path, &success);
+ if (!success) {
+ gpr_log(GPR_ERROR, "Could not read file %s.", json_key_file_path);
exit(1);
}
+ return grpc_service_account_credentials_create(
+ (const char *)GPR_SLICE_START_PTR(json_key), scope,
+ grpc_max_auth_token_lifetime);
+}
- do {
- size_t bytes_read = fread(
- current, 1, sizeof(json_key) - (current - json_key), json_key_file);
- if (bytes_read == 0) {
- if (!feof(json_key_file)) {
- gpr_log(GPR_ERROR, "Error occured while reading %s.",
- json_key_file_path);
- exit(1);
- }
- break;
- }
- current += bytes_read;
- } while (sizeof(json_key) > (size_t)(current - json_key));
-
- if ((current - json_key) == sizeof(json_key)) {
- gpr_log(GPR_ERROR, "Json key file %s exceeds size limit (%d bytes).",
- json_key_file_path, (int)sizeof(json_key));
+static grpc_credentials *create_refresh_token_creds(
+ const char *json_refresh_token_file_path) {
+ int success;
+ gpr_slice refresh_token =
+ gpr_load_file(json_refresh_token_file_path, &success);
+ if (!success) {
+ gpr_log(GPR_ERROR, "Could not read file %s.", json_refresh_token_file_path);
exit(1);
}
- fclose(json_key_file);
-
- return grpc_service_account_credentials_create(json_key, scope,
- grpc_max_auth_token_lifetime);
+ return grpc_refresh_token_credentials_create(
+ (const char *)GPR_SLICE_START_PTR(refresh_token));
}
int main(int argc, char **argv) {
synchronizer sync;
grpc_credentials *creds = NULL;
char *json_key_file_path = NULL;
+ char *json_refresh_token_file_path = NULL;
int use_gce = 0;
char *scope = NULL;
gpr_cmdline *cl = gpr_cmdline_create("fetch_oauth2");
- gpr_cmdline_add_string(cl, "json_key", "File path of the json key.",
+ gpr_cmdline_add_string(cl, "json_key",
+ "File path of the json key. Mutually exclusive with "
+ "--json_refresh_token.",
&json_key_file_path);
- gpr_cmdline_add_string(cl, "scope", "Space delimited permissions.", &scope);
+ gpr_cmdline_add_string(cl, "json_refresh_token",
+ "File path of the json refresh token. Mutually "
+ "exclusive with --json_key.",
+ &json_refresh_token_file_path);
+ gpr_cmdline_add_string(cl, "scope",
+ "Space delimited permissions. Only used for "
+ "--json_key, ignored otherwise.",
+ &scope);
gpr_cmdline_add_flag(
cl, "gce",
"Get a token from the GCE metadata server (only works in GCE).",
@@ -126,6 +128,12 @@
grpc_init();
+ if (json_key_file_path != NULL && json_refresh_token_file_path != NULL) {
+ gpr_log(GPR_ERROR,
+ "--json_key and --json_refresh_token are mutually exclusive.");
+ exit(1);
+ }
+
if (use_gce) {
if (json_key_file_path != NULL || scope != NULL) {
gpr_log(GPR_INFO,
@@ -137,6 +145,15 @@
gpr_log(GPR_ERROR, "Could not create gce credentials.");
exit(1);
}
+ } else if (json_refresh_token_file_path != NULL) {
+ creds = create_refresh_token_creds(json_refresh_token_file_path);
+ if (creds == NULL) {
+ gpr_log(GPR_ERROR,
+ "Could not create refresh token creds. %s does probably not "
+ "contain a valid json refresh token.",
+ json_refresh_token_file_path);
+ exit(1);
+ }
} else {
if (json_key_file_path == NULL) {
gpr_log(GPR_ERROR, "Missing --json_key option.");