Implement application default credentials (#32)
diff --git a/google/auth/__init__.py b/google/auth/__init__.py
index 339b3d6..65e1395 100644
--- a/google/auth/__init__.py
+++ b/google/auth/__init__.py
@@ -16,6 +16,13 @@
import logging
+from google.auth._default import default
+
+
+__all__ = [
+ 'default',
+]
+
# Set default logging handler to avoid "No handler found" warnings.
logging.getLogger(__name__).addHandler(logging.NullHandler())
diff --git a/google/auth/_cloud_sdk.py b/google/auth/_cloud_sdk.py
new file mode 100644
index 0000000..f48f5a6
--- /dev/null
+++ b/google/auth/_cloud_sdk.py
@@ -0,0 +1,135 @@
+# Copyright 2015 Google Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Helpers for reading the Google Cloud SDK's configuration."""
+
+import os
+
+import six
+from six.moves import configparser
+
+from google.auth import environment_vars
+import google.oauth2.credentials
+
+# The Google OAuth 2.0 token endpoint. Used for authorized user credentials.
+_GOOGLE_OAUTH2_TOKEN_ENDPOINT = 'https://accounts.google.com/o/oauth2/token'
+
+# The ~/.config subdirectory containing gcloud credentials.
+_CONFIG_DIRECTORY = 'gcloud'
+# Windows systems store config at %APPDATA%\gcloud
+_WINDOWS_CONFIG_ROOT_ENV_VAR = 'APPDATA'
+# The name of the file in the Cloud SDK config that contains default
+# credentials.
+_CREDENTIALS_FILENAME = 'application_default_credentials.json'
+# The name of the file in the Cloud SDK config that contains the
+# active configuration.
+_ACTIVE_CONFIG_FILENAME = os.path.join(
+ 'configurations', 'config_default')
+# The config section and key for the project ID in the cloud SDK config.
+_PROJECT_CONFIG_SECTION = 'core'
+_PROJECT_CONFIG_KEY = 'project'
+
+
+def get_config_path():
+ """Returns the absolute path the the Cloud SDK's configuration directory.
+
+ Returns:
+ str: The Cloud SDK config path.
+ """
+ # If the path is explicitly set, return that.
+ try:
+ return os.environ[environment_vars.CLOUD_SDK_CONFIG_DIR]
+ except KeyError:
+ pass
+
+ # Non-windows systems store this at ~/.config/gcloud
+ if os.name != 'nt':
+ return os.path.join(
+ os.path.expanduser('~'), '.config', _CONFIG_DIRECTORY)
+ # Windows systems store config at %APPDATA%\gcloud
+ else:
+ try:
+ return os.path.join(
+ os.environ[_WINDOWS_CONFIG_ROOT_ENV_VAR],
+ _CONFIG_DIRECTORY)
+ except KeyError:
+ # This should never happen unless someone is really
+ # messing with things, but we'll cover the case anyway.
+ drive = os.environ.get('SystemDrive', 'C:')
+ return os.path.join(
+ drive, '\\', _CONFIG_DIRECTORY)
+
+
+def get_application_default_credentials_path():
+ """Gets the path to the application default credentials file.
+
+ The path may or may not exist.
+
+ Returns:
+ str: The full path to application default credentials.
+ """
+ config_path = get_config_path()
+ return os.path.join(config_path, _CREDENTIALS_FILENAME)
+
+
+def get_project_id():
+ """Gets the project ID from the Cloud SDK's configuration.
+
+ Returns:
+ Optional[str]: The project ID.
+ """
+ config_path = get_config_path()
+ config_file = os.path.join(config_path, _ACTIVE_CONFIG_FILENAME)
+
+ if not os.path.isfile(config_file):
+ return None
+
+ config = configparser.RawConfigParser()
+
+ try:
+ config.read(config_file)
+ except configparser.Error:
+ return None
+
+ if config.has_section(_PROJECT_CONFIG_SECTION):
+ return config.get(
+ _PROJECT_CONFIG_SECTION, _PROJECT_CONFIG_KEY)
+
+
+def load_authorized_user_credentials(info):
+ """Loads an authorized user credential.
+
+ Args:
+ info (Mapping[str, str]): The loaded file's data.
+
+ Returns:
+ google.oauth2.credentials.Credentials: The constructed credentials.
+
+ Raises:
+ ValueError: if the info is in the wrong format or missing data.
+ """
+ keys_needed = set(('refresh_token', 'client_id', 'client_secret'))
+ missing = keys_needed.difference(six.iterkeys(info))
+
+ if missing:
+ raise ValueError(
+ 'Authorized user info was not in the expected format, missing '
+ 'fields {}.'.format(', '.join(missing)))
+
+ return google.oauth2.credentials.Credentials(
+ None, # No access token, must be refreshed.
+ refresh_token=info['refresh_token'],
+ token_uri=_GOOGLE_OAUTH2_TOKEN_ENDPOINT,
+ client_id=info['client_id'],
+ client_secret=info['client_secret'])
diff --git a/google/auth/_default.py b/google/auth/_default.py
new file mode 100644
index 0000000..3f6993a
--- /dev/null
+++ b/google/auth/_default.py
@@ -0,0 +1,264 @@
+# Copyright 2015 Google Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Application default credentials.
+
+Implements application default credentials and project ID detection.
+"""
+
+import io
+import json
+import logging
+import os
+
+from google.auth import _cloud_sdk
+from google.auth import compute_engine
+from google.auth import environment_vars
+from google.auth import exceptions
+from google.auth.compute_engine import _metadata
+import google.auth.transport._http_client
+from google.oauth2 import service_account
+import google.oauth2.credentials
+
+_LOGGER = logging.getLogger(__name__)
+
+# Valid types accepted for file-based credentials.
+_AUTHORIZED_USER_TYPE = 'authorized_user'
+_SERVICE_ACCOUNT_TYPE = 'service_account'
+_VALID_TYPES = (_AUTHORIZED_USER_TYPE, _SERVICE_ACCOUNT_TYPE)
+
+# Help message when no credentials can be found.
+_HELP_MESSAGE = """
+Could not automatically determine credentials. Please set {env} or
+explicitly create credential and re-run the application. For more
+information, please see
+https://developers.google.com/accounts/docs/application-default-credentials.
+""".format(env=environment_vars.CREDENTIALS).strip()
+
+
+def _load_credentials_from_file(filename):
+ """Loads credentials from a file.
+
+ The credentials file must be a service account key or stored authorized
+ user credentials.
+
+ Args:
+ filename (str): The full path to the credentials file.
+
+ Returns:
+ Tuple[google.auth.credentials.Credentials, Optional[str]]: Loaded
+ credentials and the project ID. Authorized user credentials do not
+ have the project ID information.
+
+ Raises:
+ google.auth.exceptions.DefaultCredentialsError: if the file is in the
+ wrong format.
+ """
+ with io.open(filename, 'r') as file_obj:
+ try:
+ info = json.load(file_obj)
+ except ValueError as exc:
+ raise exceptions.DefaultCredentialsError(
+ 'File {} is not a valid json file.'.format(filename), exc)
+
+ # The type key should indicate that the file is either a service account
+ # credentials file or an authorized user credentials file.
+ credential_type = info.get('type')
+
+ if credential_type == _AUTHORIZED_USER_TYPE:
+ try:
+ credentials = _cloud_sdk.load_authorized_user_credentials(info)
+ except ValueError as exc:
+ raise exceptions.DefaultCredentialsError(
+ 'Failed to load authorized user credentials from {}'.format(
+ filename), exc)
+ # Authorized user credentials do not contain the project ID.
+ return credentials, None
+
+ elif credential_type == _SERVICE_ACCOUNT_TYPE:
+ try:
+ credentials = (
+ service_account.Credentials.from_service_account_info(info))
+ except ValueError as exc:
+ raise exceptions.DefaultCredentialsError(
+ 'Failed to load service account credentials from {}'.format(
+ filename), exc)
+ return credentials, info.get('project_id')
+
+ else:
+ raise exceptions.DefaultCredentialsError(
+ 'The file {file} does not have a valid type. '
+ 'Type is {type}, expected one of {valid_types}.'.format(
+ file=filename, type=credential_type, valid_types=_VALID_TYPES))
+
+
+def _get_gcloud_sdk_credentials():
+ """Gets the credentials and project ID from the Cloud SDK."""
+ # Check if application default credentials exist.
+ credentials_filename = (
+ _cloud_sdk.get_application_default_credentials_path())
+
+ if not os.path.isfile(credentials_filename):
+ return None, None
+
+ credentials, project_id = _load_credentials_from_file(
+ credentials_filename)
+
+ if not project_id:
+ project_id = _cloud_sdk.get_project_id()
+
+ if not project_id:
+ _LOGGER.warning(
+ 'No project ID could be determined from the Cloud SDK '
+ 'configuration. Consider running `gcloud config set project` or '
+ 'setting the %s environment variable', environment_vars.PROJECT)
+
+ return credentials, project_id
+
+
+def _get_explicit_environ_credentials():
+ """Gets credentials from the GOOGLE_APPLICATION_CREDENTIALS environment
+ variable."""
+ explicit_file = os.environ.get(environment_vars.CREDENTIALS)
+
+ if explicit_file is not None:
+ credentials, project_id = _load_credentials_from_file(
+ os.environ[environment_vars.CREDENTIALS])
+
+ if not project_id:
+ _LOGGER.warning(
+ 'No project ID could be determined from the credentials at %s '
+ 'Consider setting the %s environment variable',
+ environment_vars.CREDENTIALS, environment_vars.PROJECT)
+
+ return credentials, project_id
+
+ else:
+ return None, None
+
+
+def _get_gae_credentials():
+ """Gets Google App Engine App Identity credentials and project ID."""
+ return None, None
+
+
+def _get_gce_credentials(request=None):
+ """Gets credentials and project ID from the GCE Metadata Service."""
+ # Ping requires a transport, but we want application default credentials
+ # to require no arguments. So, we'll use the _http_client transport which
+ # uses http.client. This is only acceptable because the metadata server
+ # doesn't do SSL and never requires proxies.
+
+ if request is None:
+ request = google.auth.transport._http_client.Request()
+
+ if _metadata.ping(request=request):
+ # Get the project ID.
+ try:
+ project_id = _metadata.get(request, 'project/project-id')
+ except exceptions.TransportError:
+ _LOGGER.warning(
+ 'No project ID could be determined from the Compute Engine '
+ 'metadata service. Consider setting the %s environment '
+ 'variable.', environment_vars.PROJECT)
+ project_id = None
+
+ return compute_engine.Credentials(), project_id
+ else:
+ return None, None
+
+
+def default(request=None):
+ """Gets the default credentials for the current environment.
+
+ `Application Default Credentials`_ provides an easy way to obtain
+ credentials to call Google APIs for server-to-server or local applications.
+ This function acquires credentials from the environment in the following
+ order:
+
+ 1. If the environment variable ``GOOGLE_APPLICATION_CREDENTIALS`` is set
+ to the path of a valid service account JSON private key file, then it is
+ loaded and returned. The project ID returned is the project ID defined
+ in the service account file if available (some older files do not
+ contain project ID information).
+ 2. If the `Google Cloud SDK`_ is installed and has application default
+ credentials set they are loaded and returned.
+
+ To enable application default credentials with the Cloud SDK run::
+
+ gcloud auth application-default login
+
+ If the Cloud SDK has an active project, the project ID is returned. The
+ active project can be set using::
+
+ gcloud config set project
+
+ 3. If the application is running in the `App Engine standard environment`_
+ then the credentials and project ID from the `App Identity Service`_
+ are used.
+ 4. If the application is running in `Compute Engine`_ or the
+ `App Engine flexible environment`_ then the credentials and project ID
+ are obtained from the `Metadata Service`_.
+ 5. If no credentials are found,
+ :class:`~google.auth.exceptions.DefaultCredentialsError` will be raised.
+
+ .. _Application Default Credentials: https://developers.google.com\
+ /identity/protocols/application-default-credentials
+ .. _Google Cloud SDK: https://cloud.google.com/sdk
+ .. _App Engine standard environment: https://cloud.google.com/appengine
+ .. _App Identity Service: https://cloud.google.com/appengine/docs/python\
+ /appidentity/
+ .. _Compute Engine: https://cloud.google.com/compute
+ .. _App Engine flexible environment: https://cloud.google.com\
+ /appengine/flexible
+ .. _Metadata Service: https://cloud.google.com/compute/docs\
+ /storing-retrieving-metadata
+
+ Example::
+
+ import google.auth
+
+ credentials, project_id = google.auth.default()
+
+ Args:
+ request (google.auth.transport.Request): An object used to make
+ HTTP requests. This is used to detect whether the application
+ is running on Compute Engine. If not specified, then it will
+ use the standard library http client to make requests.
+
+ Returns:
+ Tuple[~google.auth.credentials.Credentials, Optional[str]]:
+ the current environment's credentials and project ID. Project ID
+ may be None, which indicates that the Project ID could not be
+ ascertained from the environment.
+
+ Raises:
+ ~google.auth.exceptions.DefaultCredentialsError:
+ If no credentials were found, or if the credentials found were
+ invalid.
+ """
+ explicit_project_id = os.environ.get(environment_vars.PROJECT)
+
+ checkers = (
+ _get_explicit_environ_credentials,
+ _get_gcloud_sdk_credentials,
+ _get_gae_credentials,
+ lambda: _get_gce_credentials(request))
+
+ for checker in checkers:
+ credentials, project_id = checker()
+ if credentials is not None:
+ return credentials, explicit_project_id or project_id
+
+ raise exceptions.DefaultCredentialsError(_HELP_MESSAGE)
diff --git a/google/auth/environment_vars.py b/google/auth/environment_vars.py
new file mode 100644
index 0000000..9785c34
--- /dev/null
+++ b/google/auth/environment_vars.py
@@ -0,0 +1,32 @@
+# Copyright 2016 Google Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Environment variables used by :mod:`google.auth`."""
+
+
+PROJECT = 'GOOGLE_CLOUD_PROJECT'
+"""Environment variable defining default project.
+
+This used by :func:`google.auth.default` to explicitly set a project ID. This
+environment variable is also used by the Google Cloud Python Library.
+"""
+
+CREDENTIALS = 'GOOGLE_APPLICATION_CREDENTIALS'
+"""Environment variable defining the location of Google application default
+credentials."""
+
+# The environment variable name which can replace ~/.config if set.
+CLOUD_SDK_CONFIG_DIR = 'CLOUDSDK_CONFIG'
+"""Environment variable defines the location of Google Cloud SDK's config
+files."""